Lynn Settles With Cisco, Investigated By FBI

Following up on yesterday's story, daria42 writes "Security researcher Michael Lynn has settled a dispute with Cisco over his presentation on hacking the company's routers, which was given at the Black Hat security conference in Las Vegas this week. The two parties and Black Hat organisers have agreed not to further discuss the presentation, which contained techniques Lynn said could bring the Internet to its knees." Not all is good news, though. jzeejunk writes "The FBI is investigating computer security researcher Michael Lynn for criminal conduct after he revealed that critical routers supporting the internet and many networks have a serious software flaw that could allow someone to crash or take control of them."

Comments

No good deed goes unpunished.

[TripMaster Monkey]

What a load of horseshit. Lynn follows his conscience and speaks up about Cisco's security vulnerabilities, and not only is he severely slapped down by this permanent injunction (which I don't consider 'good news' in any sense), but now the FBI has decided to get involved. It'll be chilling to watch them pull his life apart and examine each bit under a microscope over months or years.

Lynn exposed a serious security flaw that could have been used to compromise networks throughout the nation. Cisco should be rewarding him for protecting them against losses they would no doubt have experienced in the future if this flaw went unreported. As for the government, they should be pinning a medal on Lynn, not investigating him.

Re:No good deed goes unpunished.

[Stevix]

the issue is also about how he reported the flaw, not just tha he did. Cisco has its own vunerability submission protocols in house, be he instead showed his findings at a Black Hat conference instead, exposing it to any savvy hacker willing to act on them.

Re:No good deed goes unpunished.

[IAmTheDave]

We forget that if the Bush administration has taught us anything, it's that secret is better. The FBI will investigate any leaking of information, because information is not to be shared with the masses. God forbid. I am TOTALLY reporting your ass to the thought police.

Re:No good deed goes unpunished.

[daveschroeder]

Actually, the FBI has not "decided" to get involved. Lynn's own lawyer says she believes the FBI is merely following up on a complaint that it received from either Cisco or ISS before the settlement was reached. In other words, Cisco or ISS may have been (inappropriately or not, depending on your stand on trade secrets) attempting to silence Lynn, but the FBI wasn't just doing this on its own. Is the FBI not supposed to investigate allegations of crime? The FBI doesn't even know whether a crime has been committed.

Further, Lynn himself admitted that the vulnerability had already been patched by a Cisco update. Lynn's issue is that he didn't believe Cisco presented the vulnerability (or its patch) in an urgent enough fashion.

And "the government" isn't doing anything save for investigating an allegation of a crime, as it is charged with doing when it receives a complaint. Should the police no longer respond when 911 is dialed unless it's absolutely certain a crime is being committed? Is this not what "investigation" is for? Sorry, I don't buy into the conspiracies.

Re:No good deed goes unpunished.

[wfberg]

the issue is also about how he reported the flaw, not just tha he did. Cisco has its own vunerability submission protocols in house, be he instead showed his findings at a Black Hat conference instead, exposing it to any savvy hacker willing to act on them.

Yes, and this is exactly why the FBI should get involved! The army has stringent oversight procedures for this sort of thing, and to reveal flaws in top-secret installations without even going up the chain of command is tantamount to treason!

Oh wait. The dude isn't in the army. Or in government. Actually, his former employer settled the case. So the overriding federal government interest in this is...? Why, you might be forgiven to think "nothing at all, in fact, this sort of thing is precisely why such liberties as freedom of the press exist; even though this is a lone individual, surely some type of whistle-blower protection would exist that covers this, otherwise the public would never be made aware of critical flaws in the nation's privately-owned infrastructur until it was too late!"

But apparently, you'd be wrong. You see, by merely mentioning, without even going in to much specifics, that it might be possible for some-one else to exploit a flaw in Cisco's equipment, this guy has clearly commited a thought-crime. That's because warning people about security flaws is exactly the same as instructing people in cyberwarfare, and issueing commands to them to act on your behalve to bring down Western Civilization as we know it. You see, no difference there at all.

Of course, this is also why trains never run on time. If the published time tables were accurate, the railways would get prosecuted by the FBI for inviting people to commit suicide by throwing themselves in front of the 18:02 train.. Bet you didn't know that!

Re:No good deed goes unpunished.

[James_Aguilar]

Well, first of all, it's not "undoubted" that Cisco would have experienced losses if the flaw had gone unreported. According to them, they were busy fixing it, and though I know we hate to listen to the big evil corporations, there is the slightest possibility that they weren't lying.

Second, it's Cisco's right to do what they want with his research, since he did *break the law* in order to release it ( decompiling code + license agreement -> ?=( ). Following your conscience (in a way that was by some reports rash and poorly thought out) does not necessarily give you immunity from the consequences of your action.

As a security researcher, he of all people, should know the high stakes in that game. It's not like either Cisco's or the FBI's actions couldn't have been anticipated by anyone who thought the whole thing through to its logical conclusion. Hopefully, he had prepared himself for the inevitable results of his actions before he took them. Otherwise, I feel really bad for him.

Re:No good deed goes unpunished.

[Anonymous Coward]

We forget that if the Bush administration has taught us anything, it's that secret is better.

Unless, of course, you happen to work for the CIA as an undercover agent. Then, Bush Co. will out your ass at the drop of a dime.

Re:No good deed goes unpunished.

[Clockwurk]

Cisco should be rewarding him for protecting them against losses they would no doubt have experienced in the future if this flaw went unreported.

If the project is open source, there should be a push to have the flaw (and technical details) examined by the largest number of eyes possible (so that they can develop fixes).

If the software is closed source, the only person that can fix the flaw is the vendor and giving presentations to a bunch of hackers about exploiting the vulnerability doesn't seem very responsible.

Re:No good deed goes unpunished.

[cpeikert]

Further, Lynn himself admitted that the vulnerability had already been patched by a Cisco update.

One specific buffer overflow vulnerability was patched. But Lynn's presentation was a general approach to exploit any buffer overflow, with dire consequences. There is likely more exploitable code inside those routers; it's just a matter of time before some is found. At that point Lynn's attack could be executed.

Re:No good deed goes unpunished.

[goldspider]

"...because warning people about security flaws is exactly the same as instructing people in cyberwarfare, and issueing commands to them to act on your behalve to bring down Western Civilization as we know it."

Nice strawman, but that of course isn't what the (predictably modded-down) parent said.

All he's saying is that you shouldn't be surprised when the FBI investigates you after you tell a whole conference of interested parties how to take down a critical infrastructure.

Re:No good deed goes unpunished.

[jedidiah]

Except he disclosed no such information.

Re:No good deed goes unpunished.

[Alcilbiades]

I really hate to side with big business or governmental intrusion, but broadcasting to the world was irresponsible. We live in a society that does have laws. He had to break the law to get the information he got so why should he be investigated. Not only did he break the law but he published his research so that malicious hackers will have a specific area to target.

It is time people grow up and realize that actions have consequences. And no it isn't THOUGHT POLICE. That idea is about "correct" or "incorrect" thought. The problem this guy had was he didn't "think" he just got an idea and went with it. What do you think the government would have done if he would have given general information about weaknesses in NORAD or some other very important national security installation. So, the moral of the story is if you find away to bypass, break, or abuse security systems that could pose a threat to the general population you best not tell everyone and their brother about it.

Re:No good deed goes unpunished.

[Alien Being]

Right, and they'll claim that her identify is supersensitive, yet they won't prosecute someone who publishes the info (Novak). They will, however, prosecute someone who protects the info(Miller).

For crying out loud people, just because you voted for Bush doesn't mean you owe him your undying support. Oust the bastard. This shit makes Watergate look like a college prank.

Re:No good deed goes unpunished.

[Thud457]

I don't get your point. Are you saying that the FBI shouldn't be squandering the taxpayers' money investigating what is a CIVIL, not a CRIMINAL offense?

I'm sure they have more important things to be doing.

Re:No good deed goes unpunished.

[Stevix]

sure he settled with his company beforehand, their scope on the issue goes no further then a violation of trade secrets and treats it accordingly. just because you arent in the army, as you so put it doesnt mean you might not be privy to information that keeps it, or any other organization afloat. keep in mind that the US government probably uses alot of Cisco equipment, and is probably critical to its continued operation. Now this person tells anyone interested on disabling their networks how to do so. regardless of the intention on Mr Lynn's behalf, the FBI sees this as an open invitation for interested parties to shut down these networks. if you contracted out work to be done on something critical to your business, and the outside worker then tells everyone a way to basically screw you over afterwards, without mentioning it to you beforehand, to let you get a handle on any potential issues the new info could bring, you wouldn't feel pissed? well the US goverment does, and probably sees this as a very serious problem, now they want to make sure he doesnt have more of these goodies up his sleeve. i understand the need to question government just as much as you, but framing every action by them as some kind of totalitarian oppression kind of nullifies your point. if you cant see the issues this Lynn's expose' conjure's, then you have one eye open, but another one closed

Re:No good deed goes unpunished.

[Anonymous Coward]

"Should the police no longer respond when 911 is dialed unless it's absolutely certain a crime is being committed? Is this not what "investigation" is for"

I think the question isn't whether the government should investigate an allegation of a crime, but what is the crime being committed? What law with a criminal penalty may have been broken?

Without knowing a great deal about this case, the only laws even remotely relevant to this would seem to be trade secret law. Even that, I would think, would not apply unless he had some special relationship with Cisco (eg. was an employee, or had special access to the source code through another organization) or if he had signed an NDA. I had the impression (perhaps mistakenly) that trade secret law would anyways be a civil matter, not the subject of a criminal prosecution.

Unless someone can say that there was a complaint accusing him of a crime, what would they be investigating? Simply "doing something we don't like" or "hurts our profitability" is not a crime. And if Cisco or someone else just fabricated a charge, that's a problem (and they should, but of course won't, get into a serious amount of trouble over that).

Re:No good deed goes unpunished.

[wfberg]

sure he settled with his company beforehand, their scope on the issue goes no further then a violation of trade secrets and treats it accordingly.

Bullshit. Cisco has just as much interest in ensuring their kit is safe from insider attacks as the government. If they wanted to prevent loose lips from sinking ships, they wouldn't have settled.

Did this guy publish an exploit? No. Any details not know already? No.

From TFA:
Although Lynn demonstrated for the audience what hackers could do to a router if they exploited the flaw, he did not reveal technical details that would allow anyone to exploit the bug without doing the same research he did to discover it.

i understand the need to question government just as much as you, but framing every action by them as some kind of totalitarian oppression kind of nullifies your point. if you cant see the issues this Lynn's expose' conjure's, then you have one eye open, but another one closed

Not "every action". This particular one.

Re:No good deed goes unpunished.

[jimwelch]

Should the police no longer respond when 911 is dialed unless it's absolutely certain a crime is being committed?

No, they should take a nap! http://wjla.com/news/stories/0305/216976.html twice in the same office!

Re:No good deed goes unpunished.

[mysticgoat]

Lynn exposed a serious security flaw that could have been used to compromise networks throughout the nation.

Your use of the past conditional tense seems presumptious. We do not know whether anyone or any agency has been exploiting this flaw. All we know is that there have not yet been any public failures in attempting to exploit this flaw.

Re:No good deed goes unpunished.

[PriceIke]

Actually, what Sandy Burger did makes Watergate AND this Plame nonsense look like a college prank. But I don't see any outrage in Mediaville over that.

I'm sorry, was that off-topic? Well, since the parent was modded "interesting" I guess it isn't.

Re:No good deed goes unpunished.

[mcclungsr]

Second, it's Cisco's right to do what they want with his research, since he did *break the law* in order to release it ( decompiling code + license agreement -> ?=( ).

I'm not a lawyer of course, but a license agreement is essentially a contract, right? Aren't you implying that he committed a crime, when this is perhaps a breach of contract? I could be mistaken.

Even if it was a crime, does that really give Cisco any rights to his work at all?

Re:No good deed goes unpunished.

[Jeff DeMaagd]

Yep, any leak will be investigated unless the leak was perpetrated by a politician or the office of a person in the leading political party. In other words, might makes right.

Re:No good deed goes unpunished.

[Tongo]

I love how you got a troll mod for that post. The guy should have been hung for treason, flat out. You bet your ass if it had been Rice, the Democrats would have been screaming for blood.

Re:No good deed goes unpunished.

[chamenos]

The FBI is investigating a civil offence that has very far-reaching consequences which aren't limited to the company alone.

Re:No good deed goes unpunished.

[Breakfast Pants]

He didn't work for Cisco and so could not have used their in-house protocols. They have methods for people outside of the company to work with them and they are probably what you were talking about but it was a noteworthy mistake.

Re:No good deed goes unpunished.

[Alien Being]

"HAHA! oh wait, you're serious?
How cute."

You think it's a joke? How tragic.

Re:No good deed goes unpunished.

[PriceIke]

Mine was no more a troll than the post I was responding to.

I didn't intend to piss off any liberals, but I can't say I'm not satisfied that I did.

Re:No good deed goes unpunished.

[cayenne8]

"All he's saying is that you shouldn't be surprised when the FBI investigates you after you tell a whole conference of interested parties how to take down a critical infrastructure."

I guess I'm at a loss here....how is this not protected under free speech, and therefore not subject to start an investigation into some illegality. He wasn't inciting people to do anything wrong (rioting, etc)...he merely gave a presentation stating facts as his research had shown him...

Re:No good deed goes unpunished.

[Alien Being]

"I'm sorry, was that off-topic? Well, since the parent was modded "interesting" I guess it isn't."

The discussion was about the current adminstration.

"what Sandy Burger did makes Watergate AND this Plame nonsense look like a college prank."

Get real. They're bitching about missing versions of a report that they chose to ignore anyway. Officials at the National Archives thought that Berger just had copies, and not the originals, so why should anyone believe that Berger thought any differently?

Re:No good deed goes unpunished.

[cayenne8]

"He had to break the law to get the information he got so why should he be investigated. Not only did he break the law but he published his research so that malicious hackers will have a specific area to target."

Exactly what law did he break? He reversed engineered as part of research Cisco routers. He gave a presentation that is clearly protected free speech. Just because you give information, that if used wrong, would harm something, as long as you're not inciting or telling people to cause harm to others....you've broken no law.

There's tons of books out there that tell you how to make an atomic bomb...perfectly legal. You can describe pressure points on the human, that can kill, etc. Information is free to dissiminate. It is a tough part of free speech, but, really who are YOU going to trust to limit it, and say what information can and cannot be released?

Re:No good deed goes unpunished.

[sik0fewl]

Maybe they'll investigate him and then give him a medal :)

Re:No good deed goes unpunished.

[Jumperalex]

The problem with your anaylsis is that he did NOt publish info about how to break into anything as stated plainly in the article. He only showed what could be done.

Nor did he focus any more attention than was likely there before. If you don't think people have been trying to hack those routers your nuts. Cause they had every reason to believe there was already a flaw and they were looking. all this guy did was show everyone something we already know.

Further, you are wrong that he had to break the law to do what he did. Just because the FBI is investigating doesn't mean a criminal law was actually broken. As for a civil law being broken that is debatable since the lawsuit was settled which has nothing to with his actually being liable (since you are never guilty in a civil trial iirc).

And finally the difference between this and publicly outtin NORAD is that there is little question that he would, in fact, have had to break several very serious laws to obtain that information as would the person or persons that helped him get it. So there is NO comparison between this and the disclosure of classified government information.

Re:No good deed goes unpunished.

[Jumperalex]

PS and let me add:

Yeah whatever you do, if you know there is an open and exploitable flaw that you feel a company is intentionally under-rating its criticality for reasons that are likely self-serving, DO NOT tell anyone about it.

Because security through obscurity works!

Re:No good deed goes unpunished.

[KanSer]

Off-topic but...

Plame nonsense?!

A CIA agent, who at the time was under-cover in a foreign country, was outed. Every countries security service would have run her name through their databases.

This is an act of TREASON. Punishable only by DEATH.

This is not nonsense, but a crime against every single American.

Not even Federal Agents are safe from this White House?!

That's just insane.

Re:No good deed goes unpunished.

[Flower]

Ok, exactly what law did he break? The more information that we get about the situation it becomes more and more evident that Mr. Lynn broke no law.

You can't bring up the injunction. That means nothing since the suit was settled. Mr. Lynn did not have to make any admission of wrong-doing nor pay restitution. More than likely Lynn's lawyer brought up how much it would cost to defend himself and Mr. Lynn decided that it would be better to keep making car and house payments than fight in the courts.

And it doesn't even matter that he can't talk about it any longer. The presentation hit BlackHat. I'm over here in the Mid-West and a printout of his slides are hanging outside my cube wall for any of my co-workers to go over. The stuff I'm not getting is being talked about on various blogs and I can just follow the trail of links to educate myself on what this exactly means. So where is the great admission of guilt in the injunction? Nowhere. The injunction is nothing but a PR wash for Cisco.

So what about the FBI investigation? Where are the charges? Where's the conviction? Taking his stuff and following up on Cisco's complaint is SOP for the FBI. I'm not seeing any law breaking here.

Until you've got something a heck of a lot more specific than "he broke the law and there are consequences for that" we don't have much to talk about because that axiom just isn't flying currently.

Re:No good deed goes unpunished.

[nanodude]

It's my understanding he didn't tell them how to do it, but what it does.

Re:No good deed goes unpunished.

[jfmgraphics]

Actually, she was not undercover in a foreign country at the time. In fact, for the past several years she's been at a desk job, not undercover, at CIA headquarters.

Re:No good deed goes unpunished.

[Desert Raven]

If the software is closed source, the only person that can fix the flaw is the vendor and giving presentations to a bunch of hackers about exploiting the vulnerability doesn't seem very responsible.

Bullshit.

First, Blackhat != hacker convention. It's a meeting of security professionals.

Second, while the vendor may be the only one who can fix the code, they are not the only one who can fix the problem. If I was a sysadmin and oversaw a network with serious security needs, I might consider replacing my hardware if I knew it was not secure. Cisco isn't the only router vendor out there.

Third, if the vendor knows that I know there's a problem, and that I might jump to a different vendor if I think they're dragging their feet, you'd better be assured that they will put a higher priority on fixing the problem.

Re:No good deed goes unpunished.

[farble1670]

the problem is that he gave a public presentation exposing the flaws. how would you like it if someone got on a soapbox and microphone and started telling everyone that the lock on your backdoor is broken and how you will be out of town for the week?

he could have just as easily went to cisco directly. probably even got a good chunk of change by consulting for them.

Re:No good deed goes unpunished.

[Some_Llama]

Good point, I hope they string this guy up for treason, right next to Karl Rove, I mean the guy shredded a document!!!!.

Re:No good deed goes unpunished.

[Some_Llama]

but now people can see what her "cover" work place was during the time she was covert, and this same place of work is the cover for many other operatives who ARE now in danger...

Re:No good deed goes unpunished.

[databyss]

I know this is /. but even here it's a good idea to have some remote knowledge about what the hell you're talking about.

He did report it to Cisco's internal system... over 4 months ago.

Re:No good deed goes unpunished.

[Frank T. Lofaro Jr.]

You can describe pressure points on the human, that can kill,

Does that stuff actually work. Yeah, Google for "dim mak" or "kyusho" - I have but I'm not sure I can believe it.

As for atomic bombs, the information that is out there is one thing, but giving out hugely detailed specs so Al Qaeda could level our cities is quite another.

The kind of info the Federal government publishes on their own websites is quite scary though.

Re:No good deed goes unpunished.

[mOdQuArK!]

Not that it matters. If she was undercover at one time, and some of her contacts are still undercover, then any foreign intelligence agency is going to have a clue about their identities now.

Re:No good deed goes unpunished.

[HiThere]

Saying that it's all right is quite different from saying it's not as bad, or even in the same ball park, as revealing the identity of an undercover agent.

Mind you, this does depend a lot on exactly WHAT was in the document. And we don't know (well, *I* don't know). Since I don't know, in my ignorance I don't consider destroying it to be particularly bad. Since I do know (within reasonable suspicion) probable effects of revealing the ID of an undercover agent, I consider that quite bad. Probably not technically treasonous, but quite bad. Certainly ground for immediate and permanent revocation of all security clearances. From there we would need to consider what crimes might be involved. Malfeasance seems plausible, e.g.

Rove should be doing hard time, and should have his security clearances revoked, and his file marked: not eligible for government employment in any capacity at any time, now or in the future. Also not eligible for employement with any government contractor in any capacity at any time, now or in the future.

Whether or not he gets multiple decades in prison (I'm not sure he's guilty of anything except malfeasance), he should NEVER be considered for ANY government employment, direct or indirect. He is a proven, not just a suspected, security risk.

Re:No good deed goes unpunished.

[Master of Transhuman]

You obviously have not followed the story, because he did NO SUCH THING.

There was a long period where he, his company and Cisco worked on this together.

Where he parted company with his company and Cisco was when the Black Hat talk that they were to do JOINTLY was back-pedaled because Cisco lawyers and PR people decided to hush up the nature and severity of the flaw, resorting to tearing up the presentation documents and destroying the presentation CDs and threatening to both fire and sue him if he went ahead with the talk.

So he, believing (correctly or not, I don't know the details of the flaw yet) the flaw was serious enough that thousands of unpatched routers were at risk, decided to shit-can his job and tell the story himself rather than be censored by an NDA signed by his company with Cisco.

Bruce Schneier's take on this is similar - this guy was mostly in the right and DID follow responsible disclosure procedures up until the point Cisco decided to "act like thugs."

Re:No good deed goes unpunished.

[Master of Transhuman]

EXACTLY!

At this time, Cisco should be pressured by the government in the name of national security to OPEN SOURCE IOS COMPLETELY.

They obviously cannot be trusted to eyeball their systems enough to detect serious flaws, and NOW they cannot be trusted to REPORT those flaws to people who have not installed their fixes.

Therefore, IOS should be taken AWAY from Cisco and made open source.

It's ridiculous that Cisco has been charging the earth for 486 boxes with some custom chips running a lobotomized version of UNIX and then they get to call on the FBI as their enforcement arm when someone finds a flaw in their crap.

If Cisco doesn't get its act together, the Chinese will start selling high-powered Linux boxes which have routing built in to the OS and with custom chips to do everything a Cisco router does. They won't care that EIGRP is proprietary, either.

Re:No good deed goes unpunished.

[mrsbrisby]

... a license agreement is essentially a contract, right?

Wrong. In the US, you can only rescind rights through signed contract. A "license agreement" doesn't have the power to take away rights for you see, books, movies, and software are all sold, no matter what Cisco or Microsoft or the MPAA would like to have you believe- their "license agreements" simply cannot revoke rights.

What a license agreement can do is provide you special rights that you may invoke. Nobody has to sign anything because if you "violate the license" you're simply held by-alternative in the superior laws- generally those of copyright violation and whatnot.

You still have the right to decompile software and even make copies for various fair-use purposes. You can even make changes and distribute those changes.

They cannot take this away unless you sign something. You buy it, you get all the rights associated with that sale.

They say they only "licensed it to you" but that's another big lie. You didn't sign a contract: no contract means they have none of your rights in which to withold.

Re:No good deed goes unpunished.

[qeveren]

Silly. The only thing security-through-obscurity does is make sure that nobody knows who knows about the vulnerability.

Re:No good deed goes unpunished.

[Tongo]

I dunno mister coward. Why don't we look at the reasons for treason. They are very clearly defined in the constitution (have you read that?).

Treason against the United States, shall consist only in levying War against them, or in adhering to their Enemies, giving them Aid and Comfort. No Person shall be convicted of Treason unless on the Testimony of two Witnesses to the same overt Act, or on Confession in open Court.

Mr Sandy Burgler I think fits the Aid and Comfort to the enemy (since we don't actually know the contents of the documents he stole, they could contain the names of terrorists, I know I'm stretching, but hell we don't know).

I don't know of any person in the current administration that have waged war against the united states or have given aid and comfort to the enemy.

Re:No good deed goes unpunished.

[mcheu]

I could see your argument if this fellow was in Canada, because here, some publications are banned because they promote hatred, or instruct people on how to commit illegal acts.

As the FBI is investigating, I presume this is the USA. That's where companies like the well known Paladin Press are. For those that don't know, they publish some very weird stuff. They publish books on subjects like Improvised Explosives, weapons conversions (making a semi-auto into full-auto), improvised silencers, as well as how-to's on electronics for Surveillance and sabotage. Since they're still advertising in the back of various hobby magazines, I presume they're still legal in at least some states.

What I find weird is, if stuff like that is still legal why would something like this be an issue? This is pretty lightweight stuff by comparison.

By the way, being "investigated" doesn't mean anything. Law enforcement agencies around the world "investigate" useless crap all the time. All it requires is someone filing an official complaint and it has to be followed up. You can't infer guilt just because the police want to talk to someone.

Re:No good deed goes unpunished.

[wolrahnaes]

Mind posting a link to those slides? They are not on the Blackhat site and do not seem to be coming up on google.

Re:No good deed goes unpunished.

[h4rm0ny]

Does that stuff actually work. Yeah, Google for "dim mak" or "kyusho" - I have but I'm not sure I can believe it.

The answer is a qualified "no." With sufficient force, there are a few points which can incapacitate, but not kill. There is only one where there is a real chance of death and you'd have to hit it right and hit it hard. There is another point where you could do longer term internal damage again, you'd have to hit pretty darn hard (though possible).

So incapacitate, yes - there are specific points you can whack (not tap), but Kung Fu movie poke with a finger and kill is not so feasible. Which is a good thing. Men who tell you they could kill you by hitting you in such and such are some of life's most irritating and (least liked) people on the planet. IMHO.

Regarding the nuclear know-how, I think it's generally accepted that knowledge of how to make them is, if not easy, at least not a barrier to be depended on. Nuclear weapons control is nowadays focused on preventing Uranium refinement and the obtaining of plutonium. It would have helped if the US and the UK had honoured their part of the non-proliferation treaty and scaled back their armaments as agreed, but they never delivered. Funnily enough, the rest of the World doesn't go for their "but it's okay - we're the good guys" argument and now everyone needs nuclear weapons to feel safe.

Re:No good deed goes unpunished.

[Anonymous Coward]

What if his "research" showed that orange juice caused cancer? Or that reading led to brain tumors? Or that Hitler may have had it right in attempting to exterminate a race of humans? The point is that lots of people were concerned that Mike didn't have (or would not present) all the facts and others believe he got the facts wrong.

Rushing his results out doesn't avert a future digital Pearl Harbor.

Re:No good deed goes unpunished.

[Frank T. Lofaro Jr.]

There is only one where there is a real chance of death and you'd have to hit it right and hit it hard.

Is that on the chest? Because if it is, the kill mght be from "commodio cortis" and it has to be hit during the right part of the cardiac cycle.

Re:No good deed goes unpunished.

[h4rm0ny]

Is that on the chest? Because if it is, the kill mght be from "commodio cortis" and it has to be hit during the right part of the cardiac cycle.

Not what I was referring to. I even had to google to find out what it was. And all the references I found were about a baseball incident. I'm not even 100% it isn't a medical myth, but if it is genuine, then I don't think you'd want to waste your shot on the off-chance that you got your opponent in the 15ms window that could kill him. You'd go for something that would hurt him all the time.

Seriously, though. I studied martial arts properly for just a few years and though I improved many skills over someone who had never studied, I learnt one inviable fact - I can be hurt.

Best advice for ninety-percent of people out there is if they are forced into a fight and they can't get out of there, is don't faff around looking for pressure points. Go for the jaw and pray.

Re:No good deed goes unpunished.

[Jumperalex]

Has nothing to do with a high horse and everything to do with facts. This is not a surpise that there was a flaw; anyone who thinks flaws don't exist just because no one has said anything about it is kidding themselves.

So, given that a flaw exists, what next. Well he didn't divulge how to actually do it. so all those folks with quesitonable morals still have no more ammunition.

On the other hand, now everyone knows there is a flaw and what it will look like when it happens. so the "white hats" can keep an eye out for it.

And most important, it lets everyone know that they need to start patching now, and that the bug is more critical than Cisco made it out to be and THAT is the most important thing. Because if no one knows, no one can protect themselves and no one can put pressure on the company to fix it.

Re:No good deed goes unpunished.

[James_Aguilar]

And yet there are various precedents for license agreements having been upheld as contracts. IANAL, but I think you need to check your facts.

Re:No good deed goes unpunished.

[mink]

There is no such thing as and there will never be such a thing as "a digital Pearl Harbor".

Re:No good deed goes unpunished.

[LionMage]

Cisco has its own vunerability submission protocols in house, be he instead showed his findings at a Black Hat conference instead

Just to clarify, this vulnerability was reported to Cisco many months before Mr. Lynn made his presentation at the Black Hat conference. (I think it was six months prior.) In addition, Cisco supposedly patched this particular vulnerability over three months ago; the problem is, not every vulnerable router has been patched.

So please, don't go insinuating that Mr. Lynn did something improper. Cisco had plenty of warning about this vulnerability, and supposedly has taken action to fix it. Mr. Lynn only presented new exploits (or expanded versions of existing exploits) for this vulnerability.

Re:No good deed goes unpunished.

[abaddon314159]

except I didn't tell anyone how to take anything down...As I've said repeatedly, and as you would know if you had read any of these articles, I didn't detail any vulnerability at all...I didn't even explain how to exploit a vulnerability if you had one...

All I did was prove that vulnerabilities are exploitable...period...tell me what is wrong with that...

The real issue is...

[maotx]

The real issue at hand, at least with Cisco router owners, is not the fact that Lynn released information concerning the exploit, but the fact that Cisco would not tell anyone about it. Time and time again has shown how security through obscurity is not real security, especially when Cisco's source code had been stolen.

The reality of it is that Cisco fixed the exploit last April with a patch and no longer offers the vulnerable IOS for download on their site. The problem with that though is that they did not inform anyone what the patch fixed and who needed to download it. Most people who are vulnerable to this attack are those who have not updated to Cisco's version as of April (which are a few I'm sure. No point on upgrading a working system with a patch that could break you.)
The real problem is Cisco and their disregard to release information over a severe vulnerability in order to press forward their new OS next year.

Re:The real issue is...

[hackstraw]

the fact that Cisco would not tell anyone about it

Free speech is now a crime. If Cisco released the same information that Lynn did, they will have the FBI after them as well.

WTF is going on in this country?

Re:The real issue is...

[jzeejunk]

(for me) my post got accepted and my karma is positive, thanks to FBI

Bummer

[Kyrka]

Needs to be spread if we're to expect cisco to fix it.

BS

[Anonymous Coward]

Again... how is this "illegal". When ford sold the pinto's that blew up when rearended, were mechanic's and insurance agenst who brought it to the light of the public sued? If you make a faulty design, you shouldn't have grounds to sue anyone who points it out. It's your own fault and no one else's. I didn't see the guy who figured out you could open all those bike locks with a bic pen going to prison or being investigated by the fbi...

Re:BS

[cp5i6]

just the nature of the contract he signed when he took a job with cisco.

alot of companies have non disclosure clauses in their contract and you can bet yer ass this was a breach of contract.

but like the previous person said teh fbi decided not to get involved and this is a breach of contract which in this country is illegal =)

Re:BS

[jellomizer]

Because this is computer suff. And computers are these magical things that think for themselves and no one understands them so they cant figure out how the laws should apply to them. If people stared to think of computers more as tools then modern slaves then we all be better off.

Re:BS

[Hope Thelps]

just the nature of the contract he signed when he took a job with cisco.

Ah, it didn't mention in the story that he'd worked at Cisco. Have you got a link to any more details on that? Thanks.

Re:BS

[riptide_dot]

Again... how is this "illegal".

I haven't read this anywhere, but from the start I was wondering why Cisco would think they had legal grounds to sue this guy, and then it occurred to me that since he worked for ISS, who works closely with Cisco and lots of other technology companies, that it stood to reason that ISS might have been given access to trade secrets about Cisco stuff that the public is not. If they did, maybe Lynn signed a confidentiality agreement with ISS to not divulge such information, hence the reason he quit so he could give the speech. Maybe Lynn thought he wouldn't be bound by such an NDA (if it even existed) if he quit ISS.

If that's the case, Cisco might not have been morally justified in going after him, but they might have had legal justification since Lynn, as an ISS employee, would have been one that had access to the confidential information.

Re:BS

[arkanes]

For what it's worth, in other, not totally fucking insane industries, breaking an NDA in order to reveal an issue of public safety will get you protected under whistleblower laws.

Re:I hope they nail him to the wall!

[Kyrka]

Because [insert diety of choice] knows this has been ubber-effective so far.

In Soviet Russia ...

[sosume]

Oh wel, this might as well be soviet russia!

Re:In Soviet Russia ...

[daveschroeder]

How is this funny or relevant?

Since when is it evil for a law enforcement agency to follow up on a complaint, even if the complaint is later found to be invalid? Or should law enforcement agencies be able to predict the future, and just skip the investigative step, and automatically know whether a crime has been committed? It might have been absurd or vindictive for ISS and/or Cisco to approach the FBI, but when someone approaches the FBI and claims a crime has been committed, would you prefer that the FBI did nothing? It HAS to investigate, just like the police still respond to even 911 hangups. If nothing is wrong and no crime has been committed, it's dropped. But when a complaint is initiated, the investigative step MUST take place, else, how would law enforcement even function?

Re:In Soviet Russia ...

[Anonymous Coward]

In soviet russia this is funny and relevant.

Re:In Soviet Russia ...

[HiThere]

Perhaps the FBI is acting righteously and properly. I wouldn't claim to know.

I have no similar doubts about Cisco. Current evidence indicates that Cisco acted as an abusive bully. I have seen no evidence that indicates that Cisco had ANY valid reason to call in the FBI. I have seen evidence that indicates that Cisco had NO valid reason. It's not conclusive, but in the absence of other evidence it's persuasive.

Cisco is abusing the trust of the FBI for gain. (What gain? That's a quite difficult question. They almost have to have intended financial gain, but I doubt that will be the result. Certainly I will only recommend Cisco now if there's no feasible alternative. And I will doubt every public statement they make that can't be independently verified.)

Perhaps the FBI could file charges about lying under oath...but they probably didn't get the charges sworn to. Too willing to trust Cisco just because it was large and wealthy. (...and politically connected?) Also, I don't recall ever hearing of the FBI filing charges against someone for lying to it.

Goodness...

[coop0030]

which contained techniques Lynn said could bring the Internet to its knees.

Can you imagine the chaos?

I bet some people would even end up going outside.

I would probably crawl up into a ball and cry until it was fixed; with my girlfriend consoling me.

I suppose I could look through my old cached history of webpages and pretend that I was online!

Re:Goodness...

[coop0030]

Girlfriend? What do have one of those talking Realdolls?

Woah, they can talk now?

Looks like I need an upgrade...;)

Re:Goodness...

[rcamera]

no, and that's the nice thing about them.

Re:Goodness...

[malchus6]

Yeah but your girlfriend would be offline as well, like the rest of the internet...

Re:Goodness...

[pigscanfly.ca]

It would be sweet, everything goes down we just have to change the voicemail at work to "Internet down, please phone back tommorow" and I could go out for a drink (assuming the pubs were open).
The last time we had a major failure (back in ottawa) I actually managed to completely unplug for a day, something which I have not managed to do for quite sometime.

1984 Called...

[bc90021]

...and told us that it will be the year we all live in from now on.

Regardless of what you think about Lynn's tactics, or Cisco's, or ISS's, or Blackhat's, the bottom line is that the FBI is now investigating. The government is going after a private citizen for releasing information about routers, because it's "critical to the national ingfrastructure". How long before pinging a router is an "investigable offence" for causing a drop in router resources?

Re:1984 Called...

[Blue-Footed Boobie]

Mod parent up!

This IS the point here. Although and investigation is not an arrest - it will still disrupt his life is massive ways.

Re:1984 Called...

[SilentShriek]

How long before pinging a router is an "investigable offence" for causing a drop in router resources?

Not very long, if such an act could be considered "trespassing" or something to that effect. See the cybercrime parts of the Patriot Act: CCIPS

Re:1984 Called...

[goldspider]

Here we have a person revealing vulnerabilities of an unquestionably critical national infrastructure to a group of people that exists to cause network disruptions... ...and you expect the FBI to NOT investigate him??

Re:1984 Called...

[Sheepdot]

1984 has nothing on 2005... This might be known in history as the year liberty finally died.

Re:1984 Called...

[dasdrewid]

I think you need to read the article more carefully. The FBI started investigating before the agreement was reached because someone had come to them complaining that a crime has been committed. Like an earlier poster said, it's their job to investigate when people claim a crime has been committed, if only to determine whether or not a crime has actually been committed. For all we know (and from the sounds of it), one hasn't, the investigation is going to be (possibly already) dropped, and that's all that comes of it.

As to pinging a router, all the FBI would hear at first is "I think someone committed a crime", told to them by the pinged party. The FBI would ask them what happened (which would be considered an investigation), the person would say they'd been pinged, the FBI would ask what else, the person would say that's it, and the FBI would probably laugh and stop the investigation. Basically, it's the FBI's job to investigate when a private citizen says a crime has been committed (and it falls under federal jurisdiction). While no one wants the FBI doing more than their job description tells them to do (the original one), I'd say it's fair to expect and allow them to do the basic job they were created to do.

Re:1984 Called...

[brer_rabbit]

1984 is fine by me. Another year of playing Beach Head on the C64 while rockin' out to Frankie Goes to Hollywood would be good.

Re:1984 Called...

[techmeltz]

mod parent up. people need to realize that Investigating a situation to determine if a crime was commited is not the same thing as busting bown someones door for not using Internet explorer.

Re:1984 Called...

[hackstraw]

Regardless of what you think about Lynn's tactics, or Cisco's, or ISS's, or Blackhat's, the bottom line is that the FBI is now investigating. The government is going after a private citizen for releasing information about routers, because it's "critical to the national ingfrastructure"

All he has to do is invoke fear in someone and he is now a terrorist, and could be detained at Guitmo without being charged of a crime, no lawyer, and no expectation of being released.

PATRIOT act is not cool.

Re:1984 Called...

[Lehk228]

some guy over in europe was arrested for using the wrong web browser. apparantly using lynx is a crime, ore more accurately, the police and administators of the site he went to are fucking retarded. But he went to jail for using lynx.

What was the suit about?

[Blindman]

What exactly was CISCO suing over? It seems to me that CISCO didn't like what he had to say, but that doesn't give you a right to sue somebody. Obviously, they weren't alleging libel or slander, since everything he said was apparently true. I don't recall allegations that he misappropriated trade secrets or something. Did he just give up so that he didn't have to defend a baseless suit?

Was his disclosure good for the internet in the short term? Probably not. However, unless there is some law that I'm missing, describing how to use a bomb is not the same as advocating that it be used.

Re:What was the suit about?

[Blindman]

Nevermind. I see that there was a case of misappropration.

Re:What was the suit about?

[TheoMurpse]

Violation of license agreements and DMCA infractions (reverse engineering for non-compatibility purposes).

Please, don't overreact.

[daveschroeder]

First, according to this new article, Lynn would have been allowed to speak if Cisco was allowed to speak as well.

In other words, give Cisco the opportunity to explain that patching vulnerabilities in major commercial vendor-supported code isn't just something that happens instantaneously. I'm not saying Cisco is completely in the clear here, but no everything shouldn't be open source, and patching shouldn't/can't happen like it does in the open source community. Some people will no doubt fundamentally or philosophically disagree with this, but in major network infrastructure, there is a place for stable, predictable commercial support. Along with that sometimes comes commercial and/or proprietary code - code which is kept proprietary for competitive advantage. This is not to say that flaws should not be revealed for the good of all, but speaking in generalities here, broadcasting everything as loudly and widely as possible to the public isn't necessarily the best way to address issues. Nor is hiding things in obscurity. But there is a scale here, and it's NOT black and white.

Further, the FBI is investigating not because of some corporatist government conspiracy, and is not being used as Cisco's own "police force". It is investigating a claim of a complaint it received, as it is compelled to do by its very reason for existence, and doesn't even know if a crime has been committed. Would you want law enforcement agencies to not investigate allegations of crime, whatever your opinion of this particular instance aside?

Even Lynn's own lawyer says "that she thought the agency was simply following through on a complaint it received when Cisco and ISS filed their lawsuit against Lynn and that it didn't come after her client reached his settlement. She didn't know the nature of the complaint but said it was probably something to do with intellectual property and that it most likely came from Cisco or ISS.

Granick said she did not think the FBI would arrest Lynn.

"Definitely not," she said. "I don't have any sense at all that that's where they're going. I don't know what the circumstances are under which anyone contacted the FBI. It may very well be that given that we settled the civil case yesterday, this is over."

So please, let's not overreact.

Re:Please, don't overreact.

[loqi]

This is not to say that flaws should not be revealed for the good of all, but speaking in generalities here, broadcasting everything as loudly and widely as possible to the public isn't necessarily the best way to address issues. Nor is hiding things in obscurity. But there is a scale here, and it's NOT black and white.

You're sort of straw-manning here. The problem isn't that Cisco didn't fix the vulnerability in time, the problem is that they didn't tell anyone it was a critical update. That's a far cry from open-sourcing their code or personally explaining how the vulnerability works.

Re:Please, don't overreact.

[daveschroeder]

You're sort of straw-manning here. The problem isn't that Cisco didn't fix the vulnerability in time, the problem is that they didn't tell anyone it was a critical update. That's a far cry from open-sourcing their code or personally explaining how the vulnerability works.

The problem here is that Lynn is claiming this was some kind of end-times doomsday vulnerability, and Cisco claiming it wasn't a big deal.

I'm frankly not inclined to believe either one of them.

We still don't know the EXACT nature of the vulnerability, and I haven't seen any direct evidence that the update should have been identified as critical. I realize that may be a little circular, but the only "evidence" we have of anything is the emotional factor of a respected security researcher quitting his job and nobly going forward with a presentation. While it tugs at the heartstrings and provides for good melodrama, it doesn't do much more. This is a difference of opinion about how Cisco handled a vulnerability. Should Cisco have labeled it critical? Was it really a big deal. Perhaps it was. But you can't assume that the truth is 100% on Lynn's side just as you can't assume such about Cisco. As I said in other posts, the truth is probably somewhere in between.

Re:Please, don't overreact.

[loqi]

Judging from his paper (if it's still up), the vulnerabilities allow for total execution takeover on the router, as long as you know where to hit up the overflows. Granted that's still not the *exact* nature of the vulnerability, but it sounds pretty squarely in the "CRITICAL" category to me.

you can't assume that the truth is 100% on Lynn's side

No, but the evidence is definitely in his favor. FBI investigation, talks of trade secret violation, and Cisco hasn't denied anything stated in the presentation, correct? But they did go to great lengths to ensure that the information didn't get disseminated. Not an open and shut case, but in the truth casino, my money's on Lynn.

Re:Please, don't overreact.

[Flower]

From what I can gather and I'm no genius, so don't quote me on it.

Lynn seems to have found a way to get a shell on any version of IOS that is vulnerable to an overflow be it stack (which appears to be rare) or on the heap. The problem with exploiting an overflow on the heap is that Cisco deploys a watchdog which forces a software reboot of the device if it finds that the heap has been messed with.

Going deeper in his presentation it appears that Lynn found a way to kill the watchdog and keep the router from rebooting itself. With the time now bought by doing this one can setup a TTY and get a shell to take over the device. That appears to be the kicker over previous exploits that I've seen with Cisco kit. This isn't a DoS it is a remote root.

Ok, my flame-retardant Scoobies are properly in place, tag in back. Anything I have gotten wrong please feel free to correct with whatever amount of vitrol is deemed appropriate.

PDF of the Presentation

[Irongeek_ADC]

I found this linked on Nick84's site (http://www.rootsecure.net/): http://www.infowarrior.org/users/rforno/lynn-cisco .pdf If I'm correct, it's the slides that were taken off of the hand out cd. Another link from a Wired article: http://cryptome.org/lynn-cisco.zip

Re:PDF of the Presentation

[davidwr]

http://cryptome.org/lynn-cisco.zip times out. The host appears to be in the USA, so I'm not sure if tis is the Wired/Slashdot/flash-mob effect or the FBI effect, it could be either one.

lynn-cisco.pdf appears to be up for the moment.

Re:PDF of the Presentation

[Irongeek_ADC]

I was able to get the one from http://cryptome.org/lynn-cisco.zip with wget, but it took about 10 min.

Re:PDF of the Presentation

[Anonymous Coward]

I have been following the Ciscogate affair (from a distance, that is) for professional reasons and yes, this PDF is genuine.

And for what it's worth: I think Lynn deserves enormous respect and gratitude from most of us.

• users are better off. As a result of his work my employer, (medium sized NSP), it's become clear that we need to make major changes, fast, to our network infrastructure m'ment... like, we need to apply patches. NOW. And get support... this is looking like a 7 figure sum,.. but we're going to be a lot more secure this time next week than we are today, and more importantly more secure than we were *before he gave his takl*.
• Secondly, he stood up for the ethical Right Thing (by resigning and doing the preso);
• and thirdly, by surrendering to the inevitable (by signing the Cisco/ISS gagging order) he's drawn attention to the deep crapness of BOTH Cisco and ISS, as well as highlighting the fuckedness of the system that allows legally-discovered facts to be very very nearly completely suppressed.

(Note: Cisco, allegedly at the behest of certain TLAs, pulled the plug on the preso only a day or two before it was due to be delivered. How many vendors are there out there who wouldn't allow a researcher to go within a million miles of Blackhat / Defcom, & who are succesfully suppressing information about critical security vulns at the expense of their customers?) Finally I think he's stood up in the name of security researchers everywhere. It sets a precedent, and a standard, for those people who find themselves in a similar position in future.

Re:PDF of the Presentation

[Irongeek_ADC]

Yet another mirror: http://attrition.org/misc/ee/lynn-cisco.pdf

Re:I hope they nail him to the wall!

[donleyp]

Also, if Cisco did know about it and kept it under wraps while they worked on the problem I call that common sense not secrecy. How would you like it if someone posted a sign on your street giving the code to your alarm system or garage door opener?

TFA

[MrAndrews]

"There's no arrest warrant for (Lynn) and there are no charges filed and no case pending," Granick said. "There may never be. But they got a complaint and as a result they were doing some investigation."

In other words, probably not really in trouble with the FBI.

Re:TFA

[hacker]

In other words, probably not really in trouble with the FBI.

But now he's on at least one "List(tm)", and we all know what happens to people who end up on "lists" that the US government happens to be compiling.

Re:I hope they nail him to the wall!

[dj_cel]

No, sometimes this is the only way to make progress. Companies (more appropriately managers) are content to live in the dark on security issues instead of dealing with them. In my experience, money is the only concern in respect to most PHB's, and the only way to make a change is to expose it in a critical manner. I applaude this guy.

Let's cut the tinfoil a bit

[BlackCobra43]

FBI investigation =/= FBI hunting you down and cracking down on you and your ilk Just think for a moment about how many thousands things the FBI is currently "investigating" that you will never hear about.

Re:Let's cut the tinfoil a bit

[pete6677]

According to a popup ad that I got this morning, the FBI is investigating me right now, unless I pay some guy $29.95 for this program that hides stuff from them. Sounds like a good deal, I better order it!

Re:Let's cut the tinfoil a bit

[OhHellWithIt]

It doesn't logically follow that just because the FBI doesn't arrest you, you are out of the woods. Ask Steven Hatfill.

Re:Let's cut the tinfoil a bit

[rhendershot]

yeah, I saw that pop-up too! It said something about my hard drive being shared to some organization called "NFS". I thought that was totally spooky. Then it goes on to say I'm using the "slow" internet. Like, how do I get on the fast internet then?! Dangit! And now, along comes the IOS with some kind of a beef with the ISS and some FBI thingy that needs to look into TCP... gawd my head is swimming.

Always shoot the messenger

[tulare]

That way, the only news is good news!

Everyone together now:

kumbaya, my lord, kumbaya...

Meanwhile, back at the ranch, some Eastern European "security expert" is busy cheerfully 0wn1ng j00 when you order that book from Amazon. Checked your credit card statement lately?

Free speech

[jdavidb]

"The FBI is investigating computer security researcher Michael Lynn for criminal conduct after he revealed that critical routers supporting the internet and many networks have a serious software flaw that could allow someone to crash or take control of them."

The FBI is investigating Michael Lynn... after he revealed ...

Congress shall make no law ... abridging the freedom of speech, or of the press.

He's being investigated for what, now? Talking?

Re:Free speech

[Stevix]

yes, but what he is talking about isnt exactly his opinions on politics or what have you, he is expressing information on no doubt private corporate information, or a vunerability thereof. if I worked at a company, and decided to 'practice free speech' by harping all of my employers trade secrets, i would no doubt be fired for screwing over the company, based on non-disclosure agreements. considering the impact this vunerability has on the infrastucture (think about the ramifications of shutting down the internet, including government networks, etc) The FBI sees this particular information as akin to 'speaking freely' about architectural flaws in the majority of large buildings that could bring them down with little effort, incuding government facilities. maybe a little overboard, but hey, they have been investigating more people for alot less recently.

Re:Free speech

[Shadow Wrought]

Keep in mind that the 1st Amendment is not an absolute protection against saying anything, anytime, anywhere. The classic example is shouting "FIRE!" in a crowded theatre, though I prefer the thinking of someone with a bull horn outside you window at 2 am;-)

In this particular case, and IANAL, they could be seeing whether his actions might be inciteful to others. The reality, however, is that they will quietly look at this and decide that no crime was committed.

Re:Free speech

[jdavidb]

yes, but what he is talking about isnt exactly his opinions on politics or what have you

Congress shall make no law ... abridging the freedom of speech, or of the press about politics.

No, I don't see those words in my Constitution.

if I worked at a company, and decided to 'practice free speech' by harping all of my employers trade secrets, i would no doubt be fired for screwing over the company

Exactly. You would be punished by the company, not by the government, because what you had done would not be illegal but a violation of employment terms and/or contract. The FBI would have zero jurisdiction.

In the same way if you come to my house and start spewing religious garbage I don't want to hear I can refuse to listen and remove you from my property, but I still can't restrict your right to say what you believe. You can't be thrown in jail for saying it, but you can be forcibly removed from my property and made to say it elsewhere.

A company firing someone for 'practicing free speech' is simply exercising the right all of us have in a free speech society: you can say what you like, but I don't have to like it.

but hey, they have been investigating more people for alot less recently.

No doubt that makes it right.

Re:Free speech

[tmasssey]

As one of Jehovah's Witnesses, I resemble a person "spewing religious garbage". I must say that your illustration made me laugh, though!

A threat of forcible removal happens from time to time, but not often. We don't want to be forcibly removed any more than you want to do it. Just tell us politely but firmly to go away. We'll (usually) listen...

Ever wonder why we keep bothering when (almost) no one wants to hear? The next time someone stops by, tell them that you will give them no more than, say, five minutes to hear *why* we keep this up when most people don't care.

And *then* you can go back to the forcible removal! :)

Re:Free speech

[muonman]

.... Keep in mind that the 1st Amendment is not an absolute protection against saying anything, anytime, anywhere. The classic example is shouting "FIRE!" in a crowded theatre...

Please post your copy of the first amendment which lists that exception. All copies I can find don't show it.

If your copy doesn't show it either, then perhaps either you are wrong, or America doesnt really have a Constutution after all, but instead has a nine-headed Pope!

In the latter case, don't forget to include the part about kiddy porn, and copyright, and anything else you feel particularly strongly about.

Re:Free speech

[Stevix]

politics was an example, and if i came to your house telling you not religious zealotry but saying, "and by the way, the codes to shutdown the government are *****" and had all real knowledge of this info, you wouldnt be concerned as to why id be telling you this? the open source security model Lynn is following in his announcement is not well understood by the majority of people, including the relatively old fashion FBI. if he stated his opinion on something and got fired, id be mad, if he whistle-blew on corporate shinanigans of his company and got fired, id boycott Cisco, but he has done neither of these things. And btw, i dont live in your country, and dont care if it is fair or not that more are investigated for less, but if that is the case, arent there more unambiguous cases of government spying going on? perhaps taking more interest in US out-of control politics then work break slashdot posting is in order.

Re:Free speech

[morgan_greywolf]

There are no exceptions to the 1st Amendment. Those who point out yelling 'FIRE!' in a crowded theatre fail to understand WHY it's illegal to yell 'FIRE!' in a crowded movie theatre. It has nothing whatsoever to do with any exceptions on free speech. Your free speech ends at the point it infringes on other people's rights. The example of yelling 'FIRE!' in a crowded movie theatre is an example of infringing on others' rights -- the movie theatre owner's private property rights mostly. Yelling 'FIRE!' in a crowded movie theatre is also a crime -- it's called 'battery'. Battery infringes on other people's rights. Kiddie porn is illegal because it involves the sexual molestation of children -- which is a crime in all 50 states. Again, infringing on other people's rights. But who's rights are being infringed on in this case?

Re:Free speech

[Shadow Wrought]

If your copy doesn't show it either, then perhaps either you are wrong, or America doesnt really have a Constutution after all, but instead has a nine-headed Pope!

Welcome to nine-headed Pope land! It is far easier to argue that the 1st Amendment has no limits on it whatsoever than to accept that life is not composed of absolutes. If you believe that any manner of speech is fine, you are more than welcome to your views (and kudos to your tenacity). However, you should also note that the language of the 1st Amendment specifically states that "Congress shall make no law..." That means that it provides protection only from Federal prosecution and meddling. The 1st Amendment only applies to the 50 States because that same nine-headed Pope which you deride applied them to the States. If you want to accept that the nine-headed Pope does not have the power to interpret the Constitution, than you also have to accept that your State is thereby free to restrict your speech in any manner it wishes, without being burdened with Constitutional considerations.

Your choice. Personally, I prefer to accept that our society is far too complicated to limit ourselves to the extremes of interpretation.

Re:Free speech

[Gordo_1]

Well since you've already performed a detailed investigation ahead of the FBI, why don't you enlighten us as to the details of what Lynn did and didn't do with respect to the laws of the United States?

Sheesh, how many people have to say "investigation is the FBI's role when someone complains of a crime" for you to get it? It is called the Federal Bureau of *Investigation* for g-d's sake. What would you have them do?

Re:Free speech

[tehdaemon]

Not a nine-headed Pope, it was the 14th amendment.

While I applaud the motive for the 14th amendment (end slavery etc.) the means that were used has badly broken the Consitiution. The 14th amendment needs to be repealed and replaced.

Re:Free speech

[jdavidb]

For the record, I am a member of the church of Christ. Practically everyone on this site would probably identify both of us as spewing religious garbage, and we would probably identify each other as such.

Nevertheless, if you knocked on my door, the most likely reactions would be either, "Sorry, I don't have time right now," or "Come on in and let's discuss each other's viewpoints." I've done door-knocking myself, actually.

Odds are I would never personally think of forcibly removing anyone for religious speech on my property. Depending on what's being said I might remove my children from the room, however.

But I thought it made a great illustration for free speech rights and property rights, one that most people here would get. Probably all of us would look into forcible removal if someone came into our home and refused to leave, regardless of their message.

Re:Free speech

[mink]

Honestly, does shouting "Cisco IOS has a potential serious vulnerability" in a crowded conference room have the same effect on peoples safety?

Re:free speech

[bjheu]

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.

Free speech doesn't mean you can say whatever the heck you want all it does is say the government can't prevent you from it. There are still consequences for saying whatever you want.

While I don't believe he did anything illegal per se, I certainly don't think he should have exposed a critical flaw in the forum that he did.

Re:I hope they nail him to the wall!

[donleyp]

If it weren't at least somewhat effective the Internet wouldn't even exist because the black hats wold pwn everyone's machines.

Wait, let me get this right?

[mister_llah]

A lot of you are saying the information on this vulnerability, which could cripple the Internet if taken advantage of, in order for Cisco to fix it?

I may be just a simple caveman, but this sounds like a tremendously bad idea... someone would take advantage of it sooner or later...

The Internet dropping, even for a few hours, would have a profoundly negative impact on the world economy...

I mean, geez, just think about it...

Re:Wait, let me get this right?

[cp5i6]

Sigh... so I dont get my pr0n for 4 hours..

the horr....



wait a minute... AHH!!! I WONT GET MY PR0N FOR 4 HOURS!!!!!

Re:Wait, let me get this right?

[Todd Knarr]

On the other hand, knowing about the problem I can now take steps to mitigate it by, for example, making sure my back-up routers are not made by Cisco, or by replacing vulnerable equipment with other types that aren't vulnerable. Of course this would hurt Cisco, which is the reason IMHO they tried to shut the guy up.

Re:Wait, let me get this right?

[Linus Torvaalds]

So what you are saying is that it's a really bad thing for Cisco to cover up a problem that can cause that instead of fixing the problem?

If only companies weren't allowed to cover up something like that. Oh wait, employees with consciences could blow the whistle. Oh wait, one did, and then he was threatened with a lawsuit and investigated by the FBI.

Anyone reminded of Adobe vs Skylarov? As soon as he was arrested, Adobe changed their mind and avoided bad publicity by backing off. Now that the FBI are investigating Lynn, Cisco are backing off to avoid bad publicity...

Re:Wait, let me get this right?

[loqi]

Are they saying that? I think they're saying Cisco should tell people when they have a huge security problem so they'll, I dunno... download the freakin patch.

Re:Wait, let me get this right?

[mister_llah]

Well, beyond our user needs...

A lot of companies use E-mail to arrange things, do online ordering (could mean millions in losses for online only companies) ...

Such an "attack" would destabalize faith in tech stocks and businesses... prices drop, the companies make adjustments to try and cover these losses... this can cause loss of jobs, revenue, etc...

It'd be a sharp blow... not as bad as blowing up a building, but it'd be a low point for the year, probably...

Re:Wait, let me get this right?

[mister_llah]

Hmm, you seem to be reading very much into what I was saying.

No, covering up a wide-affecting vulnerability should ALSO have consequences.

However, spreading the vulnerability is ALSO just inviting someone to use it.

Sure, Cisco would have to fix it then, but the damage would already be done...

You think too much in blacks and whites, saying 'spreading that information is not a good idea' does not mean that Cisco is doing right, there is a possible conclusion that can be drawn (that I have drawn) ... that says BOTH are wrong...

Re:Wait, let me get this right?

[mister_llah]

It would be better then, to just blow the whistle without giving specific details which could be used to "bring the Internet to its knees" ...

Cisco would be hurt, no secrets would be divulged, and Cisco would still try to fix the problem before it was discovered...

Of course, without the specifics, the information may be seen as less valid, but if they investigate the source, and the source is a trusted expert (as in this case) ... then why do you need to know the specifics? ... I'm sure Lynn contacted Cisco, also, and notified them of this vulnerability...

Re:Wait, let me get this right?

[Todd Knarr]

I need specific details for a couple of things. Firstly is to evaluate whether this is a real problem. A lot of problems are highly configuration-specific, and I need to test not just whether it's a problem in the general case but also whether it's a problem that I can be bit by given the configuration of my particular network. In addition, I need to be able to test any fixes Cisco might put out. Vendors have had histories of putting out "fixes" just to say they have, but the fix only deals with the one particular example and leaves everyone exposed to even trivial variations on the original attack (eg. dealing with Code Red by blocking the one specific URL string used, leaving you vulnerable to Code Red with one character in the padding changed).

I keep seeing how vendors react, and it's always "the researchers need to compromise". The vendor's position is always "no release of any information period". We gave them right of first notice, we gave them time to fix the problem before details were released, and after that they still seem to want more compromises. I've become convinced that they won't stop compromising short of their own position, and that as long as that's the case the only response can be no compromise at all.

Re:Wait, let me get this right?

[finse]

However, spreading the vulnerability is ALSO just inviting someone to use it.

I disagree. Lynn did not provide the details to exploit the vulnerability. I think discussing the security flaw invites the vendor to CORRECT it and to provide advisories to its customers. Its possible that nefarious organizations already know how to exploit this issue and could be at the ready to use it for evil. IMHO By disclosing this to the public, Lynn provided me and my country a service.

Re:Wait, let me get this right?

[megarich]

While I don't agree the practices of Cisco, you are right. If the net even went down for one hour everyone including /.ers will be freaking out. I mean no /. for one full hour oo the humanity ;)

Back to a serious note, while I see many posts about how this is handle wrong by Cisco, I would like to ask how Cisco should handle it? Personally I feel you should let the customer at least know its an critical update but if you divulge too much information then you risk having your systems brought to its knees just like some of these vulnerabilities in windows that have patch fixes.

Well I gave my 2 cents I definately would like to hear how others would handle the situation.

Re:Wait, let me get this right?

[bastardoperator]

Just a question, is it the end of the world for any one other than cisco and a few incomitant network admins, if there is ever an expliot for this in the wild? I personally feel that any network should be coposed of many diffent types of hardware reducing the risk that one virus/Scipt kiddy could bring the whole network down.

Re:Wait, let me get this right?

[mabhatter654]

Cisco had a 4 months since he reported it to THEM!!! They made a "token" fix but in a normal patch release but didn't notify their customers of how extensive the flaw really was...

If their "secret sauce" runs the internet to the extent everyone is crying about, then it's their DUTY to admit they have long-standing issues they need to fix. After all, Cisco is the company making Billions selling a flawed product here .. this guy's just pointing that out.

This doesn't pass the "fire in theater" test

[davidwr]

He wasn't revealing state secrets, and he didn't "yell fire in a crowded theater."

Someone should challenge the trade-secret-protection criminal laws on 1st ammendment grounds - yes, there is tort, and yes, restraining orders may be appropriate in rare circumstances, but a criminal conviction, I think not. It's time to give the local jury pool a lesson on free speech and jury nullification.

I hope they drop this ASAP, and if they don't, the ACLU should get involved. This is America, not Soviet Russia.

Re:This doesn't pass the "fire in theater" test

[tulare]

I'm not saying I agree that the FBI should be involved in this horseshit (I don't), but the way "Trade Secrets" tort works is that you sign and swear to an agreement to NOT disclose certain information. If you break that agreement, you've violated a contract and an oath, and the other party is legally entitled to go after you.

On the other hand, I think this is a case of someone making an ethical decision to violate an NDA because, by his lights, the risk he faces is not as bad as Cisco continuing to have cranio-rectal inversion syndrome over this, not to mention all the half-brained dipsticks out there who haven't applied the months-old patch that fixes most of the problem.

Ethics versus NDA... it's a choice I haven't had to deal with, and for that I'm thankful.

Re:This doesn't pass the "fire in theater" test

[loqi]

Well, it doesn't look like he'll be facing any criminal charges, but I agree 100%. Trade secret violation as a criminal offense smacks of the kind of bullshit Adam Smith warned us would happen if businessmen were allowed to make the laws.

Re:This doesn't pass the "fire in theater" test

[dgatwood]

Actually, he -did- essentially yell 'fire' in a crowded theater. However, there was smoke, and thus it was a reasonable assumption that there was fire accompanying it, and that it simply had not spread widely enough for anyone to notice.

The mere existence of the vulnerability on such a popular piece of routing hardware likely would result in someone, somewhere, knowing about it and biding his/her time for the right opportunity to exploit it. The odds are pretty good....

Someone shouting and scaring people over a bogus risk should result in punishment. Someone shouting about a real risk should be rewarded. At least htat's how it used to work before 9/11....

Re:This doesn't pass the "fire in theater" test

[MoneyT]

However, his actions in thise case were more akin to him going to Al Queda Summer Camp and giving a speech about how if you look really closely at the blue prints for some major US landmarks and look at how certain things have changed over the years, you can find exploit a major structural failing in the buildings capable of bringing them down.

Re:This doesn't pass the "fire in theater" test

[dgatwood]

No, it's more like doing that in front of a meeting of the corps of engineers. Maybe there might be a few Russian spies in the audience, but they would be well-funded, well-trained operatives masquerading as legitimate military personnel.

As much as these conferences cost, this ain't no script kiddie party. If there are true 'black hats' at this conference, it's corporate espionage types, not L33t haxxorz.

Re:I hope they nail him to the wall!

[Anonymous Coward]

The problem isn' that Cisco hadn't fixed this problem. They did, months ago. BUT, they didn't tell anyone what their patch fixed, so there are people out there running old versions because they don't know that the patch is CRITICAL to their security, mostly out of fear of munging their network up with a new IOS version.

Re:I hope they nail him to the wall!

[maotx]

there are channels he could have gone through that would have made Cisco aware of the problem (if they weren't already) without endangering the safety of the nation's network by talking to a bunch of black hats!

Two things:
First, Cisco was already aware of the problem and had released a patch for it last April.

Second, Blackhat is not about blackhats. It is about security and is visited by some of the most renown security professionals including ranking officials in the CIA, NSA, and other 3 letter acronyms.

Re:I hope they nail him to the wall!

[LurkerXXX]

He did inform them. Many months ago. They've had a fix out for 3 months for part of the problem he pinted out. They haven't fixed the rest yet. He went through the right channels. They haven't fixed it yet. There have been many many examples with them, Microsoft, and even recently mozilla, where bugs were reported and the vendor took over a year to finally getting around to fix the problem. And that was only after the problem had been 'leaked' to the public.

The hole exists. Sometimes it takes shouting about it to get it fixed. He gave them time. If you think 3+ months is enough time or not is a debatable point. But he DID notify them through channels.

Re:I hope they nail him to the wall!

[99BottlesOfBeerInMyF]

before everybody starts yelling about the need for these things to be reported, there are channels he could have gone through that would have made Cisco aware of the problem

Cisco was aware, in fact they were originally supposed to be co-presenting with him. Lynn contacted them four months ago. The problem is many of their customers were not aware of the problem, and despite reports to the contrary, while the exploit used to get onto the system has been fixed for a while, the ability to run arbitrary code has not. Now Cisco is working to abstract their hardware layer. Put these two items together and you get new routers, with a flaw, where a single, generic exploit can take them all out.

I know a lot less about networking and networking security than Mr. Lynn. I am willing to believe, however, that he would not give up a good, paying job and risk his future employment prospects unless he felt that this was a real and serious risk. Whistleblowers need to be protected and companies that willfully disregard warnings that their incompetence is threatening vital business and communications infrastructure around the world are the ones who should be investigated, not Mr. Lynn.

Hmm

[StreetFire.net]

If we're not allowed to test holes, it reminds me of that old saying, "Who will guard the guards?"

Re:I hope they nail him to the wall!

[donleyp]

Are you saying that they didn't strongly urge customers to install the patch? I can't get into their download site without a password, so I can't verify your statement one way or the other. Please support it.

Re:I hope they nail him to the wall!

[Triumph The Insult C]

How would you like it if someone posted a sign on your street giving the code to your alarm system or garage door opener?

i would feel "oh shit. i better fix that now"

It may or may not be illegal

[Infonaut]

Again... how is this "illegal".

The FBI is most likely investigating to determine whether there is a case against Lynn. If they find something in the DMCA that he has run afoul of, most likely they'll prosecute.

I've been writing letters to my Congressman and Senators about the DMCA for some time, but they're not listening. Until we can get legislators in office who actually understand how the DMCA casts a chill on issues like the Lynn fiasco, this sort of thing will continue.

My feeling is that unfortunately this just isn't a big enough issue on Joe Citizen's radar. There's a war in Iraq, the government is spending money like it's going out of style, there are disagreements over almost every social issue imaginable, and that monster SUV he bought last year now costs him $85/week to fill up. Some computer guy revealing Cisco vulnerabilities isn't high on his list, so it won't be high on his legislators' lists either.

Re:It may or may not be illegal

[Rosco P. Coltrane]

I've been writing letters to my Congressman and Senators about the DMCA for some time, but they're not listening.

One day people in this country will realize that congresscritters and senators don't listen to their constituents anymore, and they haven't done so for a very long time. Mostly they listen to corporations and their lobbies.

I'm glad you still have the proper democratic reflex a citizen should have when confronted with issues, but really you should realize "writing to your congressman" nowadays amounts to pushing a button that's been disconnected.

Re:It may or may not be illegal

[Dan Ost]

While I would be the first to agree that a healthy amount of cynicism is, well, healthy, too much cynicism is as dangerous as not enough. The truth is that there are still lawmakers who value the opinions of their constituents, especially if their constituent attempts to educate them on an issue that they were ignorant of.

It may not look like it from the outside, but I would suspect that the majority of lawmakers still attempt to cling to the ideals they started with and, when given the opportunity, will attempt to act according to them.

Don't limit your options just because cynicism dicates that they're pointless. You might be right and it's a wasted effort, but if you're wrong, you've voluntarily missed an opportunity.

Re:It may or may not be illegal

[Anonymous Coward]

I've been writing letters to my Congressman and Senators about the DMCA for some time, but they're not listening.

I've been to Washington and met with many Senators
and Congressmen. I can assure you that they are listening.

Listening for the rustle of non-consequtively numbered $100 bills being counted out, mostly.

Re:It may or may not be illegal

[geekoid]

Havine dealt with my representitives, and seem things change becasue of it, I have to say your wrong.

Have you tried to change something? do you talk to your represitive(or at least their staff?)

If not, you are an apathetic whiner. One of many who have shurked there responsibility as a citizen.

Re:It may or may not be illegal

[Bent Mind]

Living in Utah, I've always wondered about this. Utah is a Republician state. I am not a Republician. Given that, why would a represenitive listen to someone who did not and would not vote for them?

Re:It may or may not be illegal

[PsiPsiStar]

Polititians still respond to the public on issues that the public is interested in. They listen to lobbies when they can't hear anyone else talking.

I'm basing this on a few friends who have volunteered at various political establishments.

Granted, they still lie like rugs ("We're looking into it", etc.)

Lobbies are effective because they can't be easily fooled and follow up. You can have grass roots lobbies. Look at the NRA. People call it the "Gun Lobby" but it has power because it has a lot of grass roots support.

Too much cynicism breeds non-action.

Re:It may or may not be illegal

[Frank T. Lofaro Jr.]

It may not look like it from the outside, but I would suspect that the majority of lawmakers still attempt to cling to the ideals they started with and, when given the opportunity, will attempt to act according to them.

Sometimes they are te most dangerous of all.

Those doing what they are doing "for morality" or "for the children" or "for our own good" can do the most harm.

Think of the War on Drugs. Thing of Barbara Boxer and Diane Feinstein.

Re:It may or may not be illegal

[HiThere]

My representative pays attention when I write. My senators don't. My governor doesn't. I don't frequently write to my state assemblyman, so I'm not certain. My city council member trys to say things that look good, so long as he doesn't need to change his mind. My mayor ignores what I write.

I can tell the difference. Diebold has made it so that none of them need to pay attention, but some still do.

Re:It may or may not be illegal

[Lehk228]

do you tell them that you didn't vote for them at the start of your letter? if not they have no way of knowing that.

Re:It may or may not be illegal

[Infonaut]

I'm glad you still have the proper democratic reflex a citizen should have when confronted with issues, but really you should realize "writing to your congressman" nowadays amounts to pushing a button that's been disconnected.

The powerful have always had more influence on elected officials than average Joes. No doubt about it. But particularly on issues that are not on the top of your representative's agenda, a concise and well-articulated opinion can matter. The most successful politicians are those who follow Tip O'Neill's dictum that "All politics is local." It is of course easier to make things happen at the local level, because the constituencies are smaller. But Congressional staffers do take note of the letters that come in, and they let their bosses know how they are trending. The flip side of the frequent complaint that politicians will go whichever direction the wind pushes them is that when they hear enough voices from their constitutents, they will act. After all, the next election is always just around the corner.

I don't assume that my individual letters make a difference, but I do feel that when I have more involvement in the system, my gripes are more legitimate. I am taking the time and effort to be a citizen, and while my efforts may not result in any change, I know for certain that not doing anything won't help. I'd say apathy only encourage a less democratic process, because when we expect less from our institutions, we are rewarded with less.

Re:It may or may not be illegal

[mink]

Sorry, any hope I had for america died today via the Wall Stree Journal in it's coverage of Murcury, Tuna, FDA, and the fish lobby.

Re:It may or may not be illegal

[mink]

Too much cynicism breeds non-action.

Well what is the point?
Check out todays WSJ and read the bit about the FDA and tuna. What chance do we have when there is clear as day proof and the FDA due to industry says it's unpossible.

Re:I hope they nail him to the wall!

[donleyp]

Why didn't he blow the whistle to the US-CERT, then? Yeah, this is a good idea, let's present it at a Black Hat convention. Jeez

Toms Hardware Pics of Slides

[dave1g]

Here the coverage Tom's Hardware has. Some nice pictures, now I at least know what the guy looks like.

http://www.tomsnetworking.com/Sections-article131. php

There is a range...

[daveschroeder]

...between "security through obscurity" and attempting to hide vulnerabilities, and broadcasting security issues as loudly as possible at public forums.

Both are harmful, and neither benefit security optimally.

As with most things, the most beneficial position is usually a balance between extremes.

Wile E. Coyote school of security

[Weaselmancer]

Wile E. Coyote can walk off a cliff and doesn't fall - until the Roadrunner points out there's no ground under his feet.

Apparently the FBI thinks computer security works the same way.

Re:Wile E. Coyote school of security

[prof.morbius]

Actually it works exactly like that.

A secret flaw exists, but nobody knows about it for a while. Eventually, it is discovered. Maybe by the programmers (happy-in-pants scenario), maybe by the Road Runner (here, Mr. Lynn), and maybe by a 1337 |-|A>

Sounds like Mr. Lynn had the decency to extend a plank under Cisco before pointing out the lack of ground.

Makes you wonder what happened to the kid in the "Emperor's new clothes" yarn. Me, I suspect public torture and beheading, just to keep the peasants in line.

I do wonder why Cisco thinks that'll work for them.

Use a brain, go to jail.

[mmell]

Of course, with the internet down we could all agree to meet and pretend to chat with each other in the big blue room. I'd even be willing to use my face to emulate emoticons, if that'll help.

Relax

[kevin_conaway]

Relax, see here and here. Now take a deep breath

I don't see why they should care

[portwojc]

Cisco is quoted as saying:

Cisco denied that the flaw was as critical as Lynn said it was

Then what really is the problem?

The FBI is investigating...

[iminplaya]

Wow! Sure is a good thing we have the first amendment to club them over the head with... or has it been completely repealed now? Like the 4th?

I was in just about as much trouble as he is...

[1336.5]

But my situation was a little different - it was something like, "I swear officer, she told me she was 18, I SWEAR!!!!!!"

Re:I hope they nail him to the wall!

[99BottlesOfBeerInMyF]

Why didn't he blow the whistle to the US-CERT, then? Yeah, this is a good idea, let's present it at a Black Hat convention. Jeez

Do you have any idea who is at Black Hat these days? It is a huge security convention sponsored by hundreds of major computer and security vendors, even Microsoft is a sponsor. Heck the Department of Defense, the Army, West Point, Stanford Law School, etc. all had people giving presentations. If you want to get the word out when a major threat is being ignored, blackhat is a pretty good place to do it. It seems to have worked, don't you think?

Copy of presentation/notes?

[Kiaser Wilhelm II]

This sounds like another DeCSS.

If anyone has copies of the stuff Cisco wants censored, we could all host it and make torrents of it. Those who are less brave can use something like FreeNet to host it.

If hundreds of thousands of people host it, it will be a giant embarassment for Cisco and there will be nothing the authorities can do to stop it.

Re:Copy of presentation/notes?

[Kiaser Wilhelm II]

No, DeCSS was spread as a political statement. Do you not remember the t-shirts, the music files, and all the like that came directly as a result of the DeCSS ruling to protest the blatant violations of the 1st Amendment by the court?

The point of spreading this is to show that free speech cannot be stopped, not matter how hard our government or Cisco wants and tries.

Re:I hope they nail him to the wall!

[dgatwood]

It's not -a- black hat conference. It's -the- Black Hat USA conference. It's a (quite expensive) conference designed to train security professionals on issues relevant to securing the nation's network infrastructure.

More information here. Blowing the whistle here is roughly equivalent to sending the info to US-CERT except that US-CERT probably doesn't allow whistle-blowing against a vendor....

I wonder what would happen...

[Todd Knarr]

I wonder what would happen if a large user of network equipment, who depends on that equipment operating properly to stay in business, filed against Cisco on this? After all, they know how dependent others are on their equipment, they knew their errors in coding had put those other people at risk, and they not only didn't do anything about the situation they actively tried to block information from the people who'd be harmed. Seems to me that if a dangerous situation existed and the person responsible for it actively tried to keep the people endangered from finding out about it, that's usually grounds for additional penalties against the responsible party.

Just so we're clear...

[ninja_assault_kitten]

Everyone is aware that the presentation has been published on numerous mailing lists and websites, right?

Re:How long...

[kesuki]

no video, but a full writeup has already been on the net for a few days... in fact the Proof-of-concept seems to be up too. but you have to compile it yourself.

http://www.antiserver.it.nyud.net:8090/Cisco-Explo it/

Re:I hope they nail him to the wall!

[daveschroeder]

I am willing to believe, however, that he would not give up a good, paying job and risk his future employment prospects unless he felt that this was a real and serious risk.

How do you know this? That seems to be what everyone is basing their assumptions on the seriousness of the vulnerability on. I'm sorry, but people quit and resign over petty conflicts all the time. Just because this person is a security researcher doesn't make him a martyr, and doesn't necessitate that his resignation was some noble act for the good of the global internet community. You and he may believe that it was, and I'll be willing to consider the possibility that it was as well.

But the real issue here was that Lynn didn't want Cisco to speak at the forum with him, essentially giving its side of the story, instead of a somewhat vague assertion that Cisco's general irresponsibility will someday lead to an exploit bringing the internet to its knees. There is no specific outstanding vulnerability. Merely an assertion that Cisco didn't handle a previous vulnerability, which Lynn alleges was serious (but we don't know that for sure), urgently enough. I'm sorry, but someone quitting their job doesn't lend more credibility to the facts of a claim. The facts themselves, however, would.

Cisco discloses actual vulnerability

[mdouglas]

Crafted IPv6 packet vulnerability.

http://www.cisco.com/warp/public/707/cisco-sa-2005 0729-ipv6.shtml

http://www.eweek.com/article2/0,1759,1841669,00.as p

Upshot is that if you aren't running IPv6 on the router, this doesn't affect you.

Re:Cisco discloses actual vulnerability

[maggotbrain_777]

True, Cisco did release this announcement of _a_ vulnerabiltiy; but, if you take a look at the pdf of the presentation that Lynn gave at the Black Hat conference, you will see that this is not directly related to what he is demontrating. His is a genreal approach to identifying and potentially exploiting IOS code. What Lynn revealed is _not_ tied to a particular IOS code rev, protocol, or Cisco device. In other words, any IOS is still potentially vulnerable. Unfortunately, Cisco, while trying to keep the horse in the barn, has instead set the barn on fire, in lending far more controversy to this issue.

Re:Cisco discloses actual vulnerability

[Frank T. Lofaro Jr.]

Crafted IPv6 packet vulnerability.

So what, there are like 6 people affected by this?

Only thing IPv6 has done for me lately is bite me in the ass.

Apache 2 + Solaris 8 + IPv6 in Apache by default + IPv6 in OS by default + IPv6 not configured by default = many erros about being unable to contact listener.

Ironically, I'm an IPv6 supporter but it seems no major ISP will even route those packets.

So if Al Qaeda or whoever wanted to do an exploit, they'd have to get physically on your network, it which case they could just shoot you or bomb you or something.

anonymity

[harkabeeparolyn]

If Lynn just wanted to help people, he could have published his information anonymously. But he wanted to use this to build his reputation so he has to take whatever lumps he finds in the refined sugar of fame.

The lesson to be learned here is that full, immediate and anonymous disclosure is the best way to publish vulnerabilities. It's too bad that vendors and law enforcement have scared the shit out of such that this is necessary, but they too have to live with the consequences of their actions.

This piece of information wants to be free...

[aquila78]

As a consumer I think I have the right to know about this. Giving the vendor some time to fix the bug is the usual procedure and is common courtesy. I don't know if Lynn gave cisco a window to fix the bugs. I know from experience how vendors can sometimes try to pull this window forever. At some point, the bug must be exposed. This way vendors are forced to fix their sh.. Maybe Lynn exposed this prematurely, which should probably have some consequences for him professionally (but legally? I don't think so) The real villains here are Cisco: An important point of full disclosure is that the bad guys and the good guys have the same information at the same time. This is opposed to the bad guys having the information, while the good guys are in the dark... Which is the present situation: Cisco are leaving their customers in the dark right now. Cisco is definately in the wrong covering this up. (How am I supposed to protect my cisco router if the details of the attack are secret). I am sure the real "blackhats" are exploiting it this very moment. So what Cisco is doing is basically giving the blackhats free hands while tying up the hands of their customers. Somebody should sue the h... out of Cisco!

Or let's put it another way

[Sycraft-fu]

If you call the police, and claim someone stole your TV, tell them who it was and where they live, the police will investigate that person. Why? Well that's their job. If it turns out you were making shit up, you might get in trouble for filing a false police report later, but they'll still investigate the person. They don't just assume you are lying, I mean unless they investigate and reach their own conclusions, how will they know?

We want the police (the FBI is just the federal police) to investigate reports of crimes. We want them to do so in as unbiased fashion as possible. We don't want them to just assume that reports are false unless they are presented with overwhelming evidence, we want them to go and look for their own evidence and reach their own conclsuions.

Re:I hope they nail him to the wall!

[Anonymous Coward]

Hey, how bout we try a proper analogy:

How would you like it if you had your security number written on a piece of paper stuck to the side of your house and some kid told you he knew about it and said you should take that down. After you told him no, he rand around the neighborhood and told everyone.

I'd be embarassed too, but it'd be my own damn fault.

Re:I hope they nail him to the wall!

[waferhead]

If anyone needs investigated, or any new laws need to be written, it should concentrate on Cisco and other majors who sit on known vulnerabilities for months (or years).

I'll vote for whatever congressdroid steps up with a "Software Infrastructure accountability act of 2005" that actually codifies the "right" sequence/timetable for this sort of thing.

God Bless America(TM)

[Eric_Cartman_South_P]

Unlike the rest of the world, we have such great Freedom of SpeE&F@%&**#$@HDTH+H+[NO CARRIER]

Big mistake - wrong conference

[ch-chuck]

You should always give these type of presentations at the "White Hat Security Researchers Conference of Law Enforcing Good Guys", not the "Black Hat Hacker Convention of Nefarious Ne'er-do-wells and Juvenile Deliquents".

No fires, nothing to see here....

[Thu25245]

The Motion Picture Association of America and Regal Entertainment corporation have assured me that the theater is perfectly safe, and that any reports of fire are greatly exaggerated.

Details of Cisco security hole

[wfsavenger]

Either this has been posted or soon will be. To me, this doesn't seem like the "massive Internet outage" risk that Michael was talking about...

Cisco Internetwork Operating System (IOS®) Software is vulnerable to a Denial of Service (DoS) and potentially an arbitrary code execution attack from a specifically crafted IPv6 packet. The packet must be sent from a local network segment. Only devices that have been explicitly configured to process IPv6 traffic are affected. Upon successful exploitation, the device may reload or be open to further exploitation.

Cisco has made free software available to address this vulnerability for all affected customers.

Re:Details of Cisco security hole

[Helevius]

"To me, this doesn't seem like the 'massive Internet outage' risk that Michael was talking about..."

That's because it's not the right vulnerability.

Helevius

Download the Presentation

[Anonymous Coward]

PDF:
Lynn-cisco.pdf"

Wow my Hats off to you Americans

[DarthVain]

I may just be a simple Canadian, but wouldn't common sense dictate that this should read: Lynn awarded medal by greatful country, and FBI investigates Cisco Systems for possible negligance which would endanger the entire Country. Ok perhaps a bit long winded, but really come on people get with the program! Corporations seem to be getting out of control with the amount of power given to them. There are so many things wrong with this its unreal. First off is (seemingly) a Corporation influancing the FBI, a Federal Law enforcement adjency!

The bottom line is that Lynn is a whistle blower, and the FBI should be investigating Cisco for innappropiate conduct by trying to hide (not fix) a serious vunrability that could effect the entire country.

The whole thing sickens me.

Re:Wow my Hats off to you Americans

[SilentShriek]

I'm considering moving to Canada...

Re:Wow my Hats off to you Americans

[Erwos]

"The bottom line is that Lynn is a whistle blower, and the FBI should be investigating Cisco for innappropiate conduct by trying to hide (not fix) a serious vunrability that could effect the entire country."

What law did Cisco break? I mean, I'm sick and tired of hearing /.'ers everywhere scream "freedom of speech", yet beg for Cisco to be indicted for some unknown law.

-Erwos

Re:Wow my Hats off to you Americans

[HiThere]

Do it while you're young. Once you get past 30 it gets much harder to get landed immigrant status.

Re:Wow my Hats off to you Americans

[SilentShriek]

It's more a matter of ethical business practice.

Re:Wow my Hats off to you Americans

[symbolic]

Yes, the next person to discover such a vulnerability should carefully document it, bring it to Cisco's attention in no uncertain terms, and then wait. I understand he waited four months, but the time to strike (that will have an impact on how these issues are handled in the future), is AFTER someone has been harmed by the exploit, and the injured party's attorney is looking for discoverable evidence to support a sizable lawsuit.

Re:Wow my Hats off to you Americans

[Christopheles]

Shhhhhh, if they actually come up with a system that encourages fixing vital software errors, then how are we going to do the exploiting?

Re:Wow my Hats off to you Americans

[DarthVain]

I am not really that well versed in American law... but I am pretty sure if a Corporation that ran the Power distrabution or perhaps the Communication for a large chunk of the country was found to have serious security problems that they knew about and tried to cover up instead of fixing that the gouvernment would be very interested in said corporation and that serious action (most likely legal) would shortly follow. Not to mention it is just plain wrong.

The internet and the various other networks, for good or ill, are a major part of a developed countries (particulary the US) infrastructure.

I am 100% sure there are a whole slew of laws in which they could "possibly" be in violation of.

However I am not sure if you RTFA as I am unsure why Cisco would be indicted under the anything to do with 'free speech'. The article and my response had nothing to do with free speech.

In Fact I am pretty sure you didn't even read my response as I didn't beg anyone to 'be indicted for some unknown law'. I had suggested that they be "investigated" for a breach of law. The whole point of my article being, why is Lynn being investigated and not Cisco.

So following that logic, you not reading either article, yet posting an inflamatory response, one could simply assume you cannot read.

Truly I was unaware that George Bush visited this website!

If the Internet went down

[Laser Lou]

because of this, that would bring Al-Qaeda to a screeching halt. The wouldn't be able to plan any attacks. They'd have to go to the libraries, then *bam*, we got'em!

. . . to say RTFA

[RosenSama]

Or you're misinterpretting events. Check out a prior post: http://slashdot.org/comments.pl?sid=05/07/29/18502 34

Get it right: Cisco is mad because it was exposed

[Fallen Kell]

Cisco already HAS a fix. AND HAS HAD that fix out since April. They are pissed because it was exposed that there was a SERIOUS flaw in their previous IOS software, which Cisco had not disclosed to the public, even though they made a patch, and basically told people that it was an update, NOT THAT IS FIXED A MAJOR SECURITY FLAW, since that would cause the public to think that Cisco screwed up, and we can't have that can we?

Moral of the story

[Colonel Panic]

Present the info, but stay anonymous.

Use a fake name. Wear some kind of disguise to the Black Hat conference (or wherever you're doing your presentation), do your security-flaw-revealing presentation in the disguise and then quickly run off stage and change.

This is no longer the home of the free and I haven't noticed a lot of bravery lately...

CISCO

[dotpavan]

ahem, I am not sure if anybody else saw this but CISCO has SCO in it.. just an observation :)

Re:I hope they nail him to the wall!

[99BottlesOfBeerInMyF]

There is no specific outstanding vulnerability. Merely an assertion that Cisco didn't handle a previous vulnerability...

Actually, if you look at the presentation you'll see he presented a walkthrough of exploiting the shellcode which Cisco has done nothing (yet) to mitigate. The (fixed) exploit he mentions was merely an example of how to get on the box, but there are obviously going to be more ways to do that and quite likely someone already knows some of them. He also explains that while this is not the end of the world, the hardware abstraction Cisco is pursuing will make this type of attack work on many more routers.

Obviously as soon as the press gets involved all sorts of misconceptions, simplifications, and dramatization immediately drowns out the factual info. I don't know Lynn, but I know a number of people who do and from what I have heard he is probably trying to do the right thing.

As for Cisco wanting to have their fair say, it was my understanding that they were originally going to present the flaw with him, but backed out. Perhaps I was misinformed.

[insert 1984 reference here...]

[Larmal]

It never ceases to amaze me that companies and the government can take this kind of action for somebody merely giving a presentation on the security vulnerabilities of a router, or a chunk of code, or how to bypass encryption. What the hell has happened to us?

When I was growing up, my grandmother told me there's three things I should never talk about in public: sex, politics, and religion. I guess now we can say the three things you should never talk about in public are security vulnerabilities, P2P, and political dissent.

Dear America, I miss you. Come home soon.

The internet has knees?

[gatkinso]

I didn't know that!

Lawyer's quotes

[hotspotbloc]

As I'm sure you know most lawyers involved in a high profile case will commonly talk it up, putting the best possible face on it in public while having a different, private opinion. This is a good thing, not bad, and a realistic part of defending a client. Negative comments could quietly taint a jury pool. Imagine something like this:

But Lynn's lawyer, Jennifer Granick, confirmed that the FBI told her it was investigating her client.

Granick was quoted as saying "Oh God! Oh God! Oh God! What am I going to do? I mean this guy did something, right or wrong, and is going to end up in a dog cage at Gitmo and there isn't jack shit I can do about it!" She then crawled into the fetal position on the ground holding her briefcase like an infant child.

"I think the best thing we can do for Mike," she said, "is to help him stock up on soap-on-a-rope and cigarettes."

Re:Lawyer's quotes

[daveschroeder]

Sorry, but that's not right.

Defense attorneys will, yes, paint their client in a positive light, however, if they feel that their client is being unfairly persecuted (or want to portray it in that light), they will most definitely play that up. In other words, the lawyer is not downplaying the FBI investigation to put a positive light on it; what she said is almost positively the truth: the FBI is following up on a complaint, as it has to do, and there is nothing more to it. Wired (and slashdot) is trying to make hay of it as one of these "OMG! The big bad jackbooted totalitarian government is going after a noble whistleblower on the part of its corporate minions!!" type stories, except that it's not. She's not even shopping around the story herself.

Re:I hope they nail him to the wall!

[warkda rrior]

[...] other 3 letter acronyms.

Such as TLA?

RTFA

[techmeltz]

He didn't work for Cisco, he worked for Internet Security Systems. The FBI does not investigate charges of contract breach. They are civil matters.

The Emperor is Stark Raving Naked

[Anonymous Coward]

If you dare mention that the emperor isn't wearing any clothes, you will surely get beheaded for it.

Re:I hope they nail him to the wall!

[Chosen Reject]

If the internet didn't exist they wouldn't be able to pwn my computer unless I let them into my house. /pedantic

Re:I hope they nail him to the wall!

[Anonymous Coward]

No way.

If you tell companies like Cisco "it's okay to write garbage software, some good samaritan will report it 'through the proper channels'", what exactly is the incentive for them to do better next time? And why the hell do *we* have to do Cisco's work for them? Mr Lynn has no obligation to Cisco whatsoever. I don't even know why he bothered waiting, put this info out THE MOMENT YOU FIND IT.

Cisco should feel *something* when they fuck up. Lower market share, lower revenue, bad PR, whatever. Not hand-holding and pat on the shoulder and "that's okay Cisco, do better next time".

This is serious stuff, I don't want Cisco to think they can call the lawyers whenever something like this happens. I want them to sweat.

So you didn't go through proper channels...

[Nom du Keyboard]

Next time he should just post the vulnerabilities to /. as AC. Clearly Cisco would rather punish him than fix their problems.

In the mean time, time to do a Freenet search for his paper. I can't believe all of the copies were destroyed.

I looked at the presentation!

[putko]

I read the presentation. (here).

Lynn shows how to do a remote exploit on Cisco's firmware. This is impressive because the router runs software that attempts to detect inconsistencies. It will reset itself and start up afresh. The big deal is that Lynn shows how an exploit can fix things up and avoid those measures. Basically, his technique is like a ninja, that breaks into a building through a window, but then immediately reassembles the window before the security guard making his rounds can notice that the window got destroyed. That's it!

There's no indication Lynn stole ANYTHING from Cisco, or broke any law.

Lynn apparently "reverse engineered" the OS in order to do this. That's usually fine; it is his right to do that.

Considering this, I'm pretty pissed that Cisco's spokeswoman, Mojdan Khalili, said that Lynn broke the law (without saying what law it was). I think that could be libel (or slander -- I'm not a lawyer) -- in any case, Mojdan Khalili, working for Cisco, just ruined this guys rep, and sicced the FBI on his ass.

Perhaps if you write her, she will get Cisco to ask the FBI to lay off the good researcher (ask her to have Cisco "take it all back"). From yesterday, here's her contact info:

978-936-1297 mkhalili@cisco.com

Also, some total jerk looked up her address and posted it (here). I think that's totally inappropriate; if you show up on her doorstep and bother her, I hope she calls the FBI on you, you freak!

Re:I looked at the presentation!

[HiThere]

Considering the public accusation that she made, I suppose that publically posting her contact informatin is reasonable. I don't think it will have any good effect, however. She won't even understand why you consider that she has the morals of a starved rat, without the excuse.

Perhaps it would be better to let others at Cisco know how you feel, or to recommend products by other vendors that you would recommend as alternatives to Cisco products. Only someone with "standing" is allowed to succeed by filing suit. (That, or someone with a few million they don't mind throwing away.)

OTOH, slander or libel (libel probably) and defamation of character suits seem to be quite reasonable responses.

P.S.: Just because you can't call off the FBI after you sic them on someone doesn't absolve you of guilt. I have not forgiven Adobe for a similar act (Skylarov), and I don't intend to. Whenever I see a chance to do them a bad turn (cheaply, I admit), I do not hesitate to do it. Unless new information comes to light, Cisco is joining Adobe in my "premanent bad books".

Re:I looked at the presentation!

[Beryllium Sphere(tm)]

>Lynn shows how to do a remote exploit on Cisco's firmware.

That leaves the wrong impression.

Someone who looks through Lynn's presentation won't know how to turn a heap overflow into a remote shell.

Lynn deliberately left some details as vague outlines and skipped others altogether precisely because he didn't want to tell people how to own Cisco routers. He wanted to prove that someone can exploit buffer overflows on IOS.

Re:I looked at the presentation!

[putko]

They could have just called the local cops or state police. Did they really have to call the Federales? That seems a bit extreme. It looks like a simple case of reverse engineering.

Also, there's plenty of info that Cisco was cooperating up to the very end -- there was no big surprise. He just didn't do exactly what they wanted.

Hopefully the FBI will see it that way, after they investigate. And I hope homeboy's affairs are all totally clean, so that the FBI wraps up quickly. Now I get why people just release this info anonymously.

That story of the jihad guy is really something! But in that case, it wasn't that he was hacking for Osama. He just happened to be a jihad-lovin' software guy. I hope they "go Taliban" on him in prison. I hear the blacks are really hard on people like him.

Whistleblower's Failure to...

[mpapet]

Execute the delivery of the information in a way that protects him is what's got him in trouble.

This guy's smart enough comprehend the exploit, he utterly failed in communicating it.

Never in a million years do you just blurt something out like this. I don't care how bad it is. Figure out the proper channels and work them.
That's what a focused and intelligent adult interaction with the world looks like.

Now, I admit he needed a Karl Rove power broker/media bulldog to keep the story from spinning against him. But he really needed to spend some time figuring out how to deliver the message to insulate himself better.

Shades of Adobe?

[Valdrax]

Is anyone else feeling a little deja vu here?

A big software company gets mad at a researcher giving a speech on a security flaw in their software and attempts to sue them. They get the FBI involved before realizing that they're taking a lot of PR damage and then suddenly act all buddy-buddy with the person they went on the attack against. In the meantime, the FBI doesn't give up just because the company now wants to polish its image, and the researcher's life is negatively impacted.

Sounds like Adobe and Dmitri Sklyarov, doesn't it?

It doesn't *have* to be done, but

[RM6f9]

1. Read Slashdot article slamming Cisco for attempting security through obscurity and unfairly siccing the FBI on the whistleblower.

2. Short-sell Cisco stock or buy put options.

3. PROFIT!!!!

Interesting

[PacketScan]

I don't think they are investigating Lynn per say but the Information that he has found. There is a problem were software and hardware vendors keep this type of vulnerablity information sacred ( so they can fix it){bullshit they don't want to spend the extra money to fix it}. In any event i think we will see this investigation turn to cisco. This is a National Security Issue and If it's True that Cisco has all of this information and has been sitting on it, then i hope the government through the book at them. And my friends say why to you have 4 internet firewalls, well besides the paranoia it's just extra defense.

Learn a lesson: Some examples

[tod_miller]

Woah, that ladder does look safe!

WRONG! you are no longer allowed to point out potential security weaknesses to people who have paid money for something. Discussing the weakness of a product is wrong, and will in fact lead to the ladder breaking by itself. Inform the ladder manufacturer, and I am sure they will recall all ladders sold.

For fucks sake, everyone has no idea about security, there is no such thing as security in computing ONLY programs that are sub-standard and do not do their job properly.

Since this has become mainstream, the whole ideal has become warped, and not the onus is on the consumer to bear the risk, IN SILENCE, for fear of prosecution, because it is illegal to discover and discuss the flaws in software you have paid for.

This guy is a consumer, he paid for and analysed his product, which is no more different than talking about the fruit you bought at the market, or the shaving cream you use. He voiced his opinion that stated that the software was buggy, and would fail under certain circumstances. Not allowing him this right, or anyone else is wrong, and you cannot put the onus of security in shutting up everyone and anyone, because the next person will not nicely talk about it, but strike, oh no that will never happen. Code red, slammer, and a million other worms have costs BUSINESSES who pay the fucking FBI's wages BILLIONS. SO GO AND FUCK YOURSELF FBI, YOU FUCKING IGNORANT PIECES OF SHIT

*muttly mutterings*

To confirm you're not a script,
please type the word in this image: descry random letters - if you are visually impaired, please email us at pater@slashdot.org

Companies should offer rewards for patching

[EMIce]

They could always pay to have it fixed. The author says much of the code is secure, so why not take undertake a massive effort to overhaul the suspect portions, and then offer a $75 cash incentive for each router a tech patches or a substantial discount for a replacement router? They do have serial #'s so patching could be tracked, perhaps they could even use some relatively inexpensive hardware or software verification module. It could generate a code to verify proper patch status, or even incorporate patching functions in this simple device.

This might hurt business less in the long run than a widespread, debilitating breakdown. It will be expensive, probably ~$120 a pop in the end, considering payout, as well as the cost of verification hardware/software devlopment and production, but they'll reduce the destruction for their customer's businesses and to their own image.

I don't know just how much this would cut into Cisco's revenues, which would of course reduce short term profits and thus investment interest. Someone up there should be weighing something like this though, however painful it sounds. It would also set Cisco apart in market where cheaper competitors are taking away Cisco's profits. How many of them would go to such lengths in the event of a vulnerability? Companies love insuring themselves against everything.

The Obvious Question

[shareme]

The Obvious Question.. Is releasing trade secrets by a non contractual party a civl case or criminal case? If its civil than FBIO i snot investigating on Trade Secrets calims but soemthing else such as Code Stealign and etc.. Remember, our security hero was not a contractual party ot any cisco product..or am I worng on this point?

You are making a *LARGE* assumption...

[schon]

In other words, give Cisco the opportunity to explain that patching vulnerabilities in major commercial vendor-supported code isn't just something that happens instantaneously.

He gave Cisco *FOUR MONTHS* to fix it, which is hardly "instantaneous".

Cisco issues advisory

[SpaceLifeForm]

http://www.cisco.com/warp/public/707/cisco-sa-2005 0729-ipv6.shtml

Cisco Internetwork Operating System (IOS®) Software is vulnerable to a Denial of Service (DoS) and potentially an arbitrary code execution attack from a specifically crafted IPv6 packet. The packet must be sent from a local network segment. Only devices that have been explicitly configured to process IPv6 traffic are affected. Upon successful exploitation, the device may reload or be open to further exploitation.

Death of teh Intarweb exaggerated, AGAIN

[gibmichaels]

Most tier 1 and 2 ISPs upgrade their code in a timely fashion. They're also on a mix of Cisco, Juniper, and Foundry (and I hear someone actually uses Extreme). Some third-rate companies or pretenders might have problems in a situation like this, but the effect has been greatly exaggerated.

The disclosure aspect is sad, but it's not like this is anything new. Might want to get the lawyer hooked up *after* you quit your job to release the paper, and *before* you head out to the conference. Don't expect any different behavior from companies until the next regime change...

Cisco IOS is tackier than we thought

[Animats]

After reading the slides, it's clear that IOS is tackier than I thought. Their approach to buffer overflow prevention involves magic values on the stack and periodic processes that check them. That's a containment effort for transient hardware errors and a debug tool, not a security measure.

Apparently buffer overflows within IOS aren't that hard to create, and so all the usual attack approaches can be used. That's the real story. And apparently IOS is a single-address-space unprotected OS, so anything can clobber anything. There's so much stuff in IOS now that there just has to be trouble.

Now I see why they're switching their larger routers to QNX, which is a protected-mode microkernel OS.

Re:Cisco IOS is tackier than we thought

[Frank T. Lofaro Jr.]

Perhaps Linux should use a microkernel as well. :)

I am surprised....

[WindBourne]

that he is even able to talk about having gag order on him. It seems that the gov. these days is all about slapping anybody with a gag order such as Sibel Edmunds. I wonder how many other gag orders there are.

Gov't should have more oversight

[failedlogic]

I'm a non-IT, non-programmer type, so I'm really an outsider looking in.

In many press-releases and conferences and what-not, the U.S. Gov't always refers to the Internet as critical infrastructure. I agree it is: a lot of e-commerce, day trading, exchaning of new, etc takes place on it everyday.

Instead of spending time "investigating" people who might or might not be committing a crime on the Internet, would it not be a better use of resources to instead help make the Internet more secure? Fine, a lot of the internet works on equipment and IP of the private industry (a good part based in the U.S. too). Should the gov't not attempt to make law, something where companies must in X number of day issue patches for critical software (say 60 or 90 days, less is better)? What about establishing some sort of industry standard ISO-type stuff for computer security? Fines might not be a good idea if a patch is late, but something should be done. The threat of lawsuits is deterrrent enough for the industry but gov't should be more positively involved in this matter.

I'm all for the FBI doing their job: investigating and preventing crimes. The government should also try and involve itself and the industry for preventative and "patching" standards with-in the industry.

Be mroe afraid of what is left gaged

[WindBourne]

Sibel Edmunds. The interesting thing about her if you believe the rumours, is that this may also hit democrats just as hard as the republicans. Supposedly, it will topple GWB's admin, but it may put ex-clinton ppl in prison as well.

Free Speech?

[Phil Urich]

That's Socialist talk, you . . . you liberal!

The problem with that thinking is...

[Svartalf]

Is that the "proper channels" weren't at all interested in conveying the info to everyone- because it was bad for business.

At that point, you're left with two decisions- let it all blow up, or whistle blow.

Considering what I know of Michael (I worked with him for some time at one of his previous jobs- Michael, if you're seeing this, try to get in touch with me, you already know how...) he had only one- to whistle blow.

Re:The problem with that thinking is...

[mpapet]

Blowing up is not a -guaranteed- outcome in this scenario.

Even if the worst things really did happen, there would be the usual media hue and cry followed by some empty corporate-speak response followed by a government hearing or two and the whole thing would eventually die down.

IMHO That -is- a viable alternative. The corporation representatives dealing with the government representatives. That's "proper channels" communicating with each other. He needed to wait to get something similar in order, maybe have the EFF deliver it? ACLU? Certainly not what he did.

I wish him all the luck, because it's going to be a bumpy ride for a while.

Boo on Cisco

[Stumbles]

What it really boils down to is Cisco knows their code/firmware is about as well written as Microsoft windows and just about as secure. They just don't want everyone else to know about it.

The world inside out?

[gcantallopsr]

Cisco should be punished, not Lynn. This issue is a problem caused by Cisco to its customers.

OK, I'm not so naïve. I understand Cisco, their methods and their motivation... but I don't have to like it. And it's good to explain the truth to people.

What a freakin mess

[l0ungeb0y]

While Lynn did good work discovering this flaw I don't agree with his actions in the slightest. Cisco made the fix and released a patch in a timely fashion. Who is he to dictate how Cisco goes about announcing it? Is he the boss of Cisco because he found a flaw?

Granted, it would be advised to mark the patch as critical and give it some press. But is that required?

Personally, Lynn's the ultimate loser here. He stands to watch his career go straight down the shitter and for what? Some ego-centric power play? I don't think any corporation will want to bring him in at the risk of him pulling some stunt like this on them if he gets his nose bent out of joint.

And as to the FBI, they're just doing their job -- they got a complaint so they flat foot it a bit and check it out. I'm sure they'll bug out of it soon enough.

And while Cisco and ISS maybe playing hardball, I can understand why. The dude started a fire and they damn well sure want to stomp it out.

And it seems that both ISS and Cisco were willing to allow him to make this public disclosure -- they just wanted some PR guys their to do damage control and make sure their side was accurately reflected. But for whatever reason, Lynn would have none of that -- so he quit his job and gave them all a big F-U.

Personally, this guy sounds like a complete ass-hat and I question his real intentions here. There are many alternative ways he could have raised the issues he wanted to bring to bear.
Showing up at a black hat conference and giving a how to on this exploit was certainly never going to do anything more than harm Cisco.

What I want to know, is if Lynn really did want to help out, why he couldn't have set up a blog that merely discussed the abstract points of the security update and explain why the patch was critical and then post to slashdot or other IT news site to generate the publicity?

If he'd simply cast his ego aside and thought things through a bit better, and worked with all parties involved he'd probably still have a job and the message would have gone out in a far more positive manner.

-- Just calling it as I see it.

Michael Lynn/Abaddon Defense Fun.

[d3dkat]

Hello Slashdotters, I just got off the phone with Mike. There is a paypal account setup as a defense fund, please spread the word. Before you ask, it's Mike's paypal account, and he is a "Verified Premier Member".

It is abaddon (at) io . com

James Schallau

Lynn is morally guilty

[AB3A]

Sure, free speech and all that... He did nothing illegal, but he should have put a bit more thought in to the whys and hows of the release.

First, nobody has yet attacked via this vector. There are no examples of concept code out there. Had someone exploited this vector, then it makes sense to educate the public that it exists and why. Until then, I think the moral thing would be to STFU. Cisco has a right to be angry (though not to use heavy-handed tactics).

Second, I would find his position to be much more moral if he had given this information anonymously to the conference, or some other such forum. The fact that he put his name on it smacks of a grab for infamy. His goals, if they were truly altruistic, should not have included his identity because that was irrelevant to his presentation.

He's no hero in my book. I'll give him credit for trying to do the right thing, but I still see his actions as ultimately counterproductive.

Re:Lynn is morally guilty

[Flower]

First, nobody has yet attacked via this vector. That you know of... There are no examples of concept code out there. That you know of... Had someone exploited this vector, then it makes sense to educate the public that it exists and why. If I know about it I can keep an eye on my neck of the woods, implement workarounds as I deem necessary and sound the alert if I see it in the wild... Until then, I think the moral thing would be to STFU. I think the moral thing is to not keep me ignorant but that's just me. Cisco has a right to be angry (though not to use heavy-handed tactics).
Cisco's emotional state is really not my problem. The network I admin using their products is.

Re:Lynn is morally guilty

[AB3A]

Gosh, where to begin?

Of most of the exploits we have seen thus far, the vast majority have been script kiddies. Very few worms and viruses have used undocumented attack vectors. Now, that doesn't mean that All of them are like this, but it does mean that there is some security to be had through obscurity.

Given that IOS is entirely proprietary, it would be wise to give Cisco plenty of notice of the vulnerability and let them patch the problem first. After all, you probably don't have access to the IOS software sources. Patching your own routers with just the information presented by Lynn would be a monumental achievement. I doubt you or most slashdot readers could do it in a timely fashion.

I am not defending Cisco's attempt to sweep this under the rug. However, computer networks are a fragile technology built on a thin veneer of civilization. Telling people how to tear it apart before we can even take measures to reinforce it is nothing less than irresponsible.

I'd have to think long and hard before hiring a guy like Lynn.

Re:MOD DOWN! Reasons inline

[Dahan]

In conclusion, I believe the results speak for themselves. Please mod down to no less than -6

DONE! I modded it to -13.2.

FBI Involvement

[omb]

This is the most stupid use of Federal Intelligence and policeing ever;

One must assume that the politicised senior
executives have not the wit to understand the
benefit of timely disclosure of security exploits
and the fact that the black hats will know without
public fanfare.

The FBI and the DHS have a job that SLOULD fully
occupy them, find Ussama bin Laden, and kill him.
When they have done that they can turn to lesser
priorities.

Cisco are Vulnerable

[GC]

By the title I mean, not necessarily in their technical sense, but they are vulnerable through market forces.

Let's face it, companies pay through the nose for Cisco kit, mostly simply through conitnuity purchasing.

Yes, the Cisco kit generally performs as advertised, but I doubt that that has ever influenced someone who had the responsibility for buying the kit.

The market is crying out for a network supplier who can provide the goods & functionality of the Cisco kit for what is deservedly a fraction of the price that Cisco charge.

Cisco have a terrible support policy, unless you purchase your particular item with support you're knackered.

Compare that to even Microsoft, who at least have a larve knowledge base freely available, have reviewed their security updates and made their OS secure as any closed OS can become.

Cisco lag behind in their field far further than any of the other companies in IT.

Their strategy? Invoke achievablie certification which gains advocates for their products. Sign those advocates up to virtual-non-disclosure and reap the benefits.

This information needs to be FREE!!!!

[JRHelgeson]

Anyone that wants a copy of the presentation; email me: joel[dot]helgeson[at]gmail[dot]com with the subject of "CISCO" and I'll reply with the presentation.

welcome to the ussr of old

[suezz]

what a crock of shit - cisco should be thanking this guy for finding their bug in the first place.

doesn't the FBI have anything better to do like find Osama bin laden and their followers.

One other thing is why didn't all their ccna's or whatever find the bug? Aren't they certified?
My snort logs still pick up unpatched cisco routers at work all the time.

This information needs to be FREE!!

[JRHelgeson]

Email me here if you'd like a copy of the presentation.

Re:In Soviet Russia ... router 0wns YOU

[UnapprovedThought]

Maybe the GP made the mistake of reading the story title? You can sort of begin to see a hint there how cooperating with Cisco might not always produce the results you wanted. The GP is spared from going to room 101 -- this time.

Anyhow, from my limited understanding, Cisco claimed that the exploit had already been patched since April, the patch supplied to customers and they deny that it was ever anything approaching a critical issue. The civil charges were settled, supposedly. So, then, if the original complaint was satisfied, who is the damaged party that they are investigating him on behalf of? Tick. Tock. But wait... the plot thickens.

Quoting him from the wired article:

"I was really mad at ISS before and now I'm extremely disappointed," Lynn told Wired News. "At this point, they're just trying to milk it for punitive damages. We already had a standing agreement, and now they're trying to attack me in some other way."

Extremely disappointed? Didn't he mean to say double-plus unappointed? That is, if he actually exists. I did not claim that he ever existed, by the way, just in case all archives of his existence suddenly disappear.

Oh noes

[1310nm]

critical routers supporting the internet

Phew, good thing those are made by Juniper.

Wow

[k2r]

> he has agreed to pay a $10,000 fine and
> accept a three-year suspension of his national
> security clearance.

Wow, if I got it right this guy intentionally DESTROYED DOCUMENTS TAKEN FROM YOUR COUNTRYS ARCHIVE and he will GET BACK his security clearance after a while?

Looks like you're fucked, basically.

k2r

The other problem is

[NewToNix]

that I seem to detect a bit of yellow showing through that particular Black Hat.

Not a good sign... it requires gutsy people to push the envelope, in order for progress to occur.

Lynn showed what he's made off... and so did Cisco and Black Hat.

All in all, not a good day for anyone... except maybe admins that now know a bit more about their Cisco system then they did before.

I hope...

There is no sig like the old sig, so this is it.

How the POTUS could be killed.

[the_raptor]

This is a plan on how someone could kill the President of a United States. Wait until the POTUS is known to be inside 1600 Pensylvania Av then either A) Detonate a Truck filled with high explosive outside the oval office, or B) Hijack an airliner and crash it into the building.

Wow the FBI better lock me up for giving away this tottally non-obvious information to the terrorists. Hell I even gave them the address and everything.

Or maybe talking about obvious and non-specific information with the intent to prevent such an attack occuring is something people should be rewarded for?

filing a false police report

[mabhatter654]

filing a false police report!

That's what Cisco is doing here.. YES, they ARE using the FBI and "national security" as a cover for a personal vendetta.

What they're basically asking is because their software is insecure, they've not reported the info to the public for 4 months, but this guy did, they want the FBI to "investigate" until they FIND something to charge him with. Because and FBI investigation is punishement in and of itself... It should take no more than 5 minutes for the FBI to realize this is a open & shut whistleblower case and Cisco is wasting their time. Unfortunately, the FBI doesn't care about what a person's RIGHTS are, only if they can find some crime you committed.. after all, they'll have to find something to justify spending the $100k's they've already spent!!! Going back to Cisco and fining them for a "false" police report almost never happens.

You never had a right to free speech...

[Vryl]

The oft quoted example of shouting 'fire' in a theatre...

Or defaming people, ie 'hackstraw is a paedophile', etc

Not that I disagree with your presumed sentiment. Cisco *are* out of order here.