Slashdot Mirror
Cisco Complains To Obama About NSA Adding Spyware To Routers
pdclarry (175918) writes "Glenn Greenwald's book No Place to Hide reveals that the NSA intercepts shipments of networking gear destined for overseas and adds spyware. Cisco has responded by asking the President to intervene and stop this practice, as it has severely hurt their non-U.S. business, with shipments to other countries falling from 7% for emerging countries to over 25% for Brazil and Russia."
Why does NSA have to do this? Can't they just order Cisco to install this in their factory?
Or did they co-operate in this way to prevent whistle-blowing or counterintelligence at the factory?
In any case, I doubt Cisco didn't know about this. They are probably trying to save their face after a third party uncovered this.
I find it funny how the US government accused Huawei and ZTE of building in backdoor access while engaging in the exact same practice. I don't doubt that they do, they just haven't been caught red-handed. Pun full intended. I'm guessing that even if Obama were to issue an executive order halting the process, it would be largely for show. The actions will continue under renewed secrecy.
Oh that's easy, your cisco hardware actually works. I'll be here all night folks. Try the fish.
Did you know 80 to 90% of the moderators on slashdot wouldn't recognize a troll even if one dragged them under a bridge.
Problem is that there is pretty much no possible way Cisco can put the toothpaste back in the tube. They have no simple way to prove to potential customers that their gear hasn't been hacked or compromised in some way. The actions (real or perceived) of the NSA have basically screwed a number of US companies in overseas markets where security is any sort of a concern.
Basically even the perception that the NSA may have compromised the equipment is enough to keep people from buying Cisco. Of course then the question becomes who do you trust? The Chinese make a lot of gear but they are probably trusted even less than the Americans if anything. Unless the gear is manufactured domestically under supervision it's unclear how you ensure that no one has introduced undesirable code/hardware.
...to think 40 years ago we were on the brink of nuclear war with a country that did shit like this.
Chewbacon
The Bible is like Wikipedia: written by a bunch of people and verifiable by questionable sources.
During the NBN infrastructure procurement process, apparently the USA provided intelligence to Australia indicating Chinese owned Huawei be excluded as a supplier . Not doubt to aid both Cisco's chances of winning the bid, whilst also providing an easy in for the NSA to get it's ears pre-installed in Australia's NBN well in advance. It certainly smells dirty to me...
Putting open source routing software on a rack-mount PC equipped with a few NICs is looking better all the time. Since the open source routing software solutions are getting quite good, this is doable. I did it and wouldn't go back:
About three years ago I noticed that our Cisco routers were a bottle-neck, worryingly old, and I was the only member of my staff comfortable with their CLI. We definitely did not have the budget to buy new Cisco routers, so I looked into HP and D-Link layer-3 switches. They were still too expensive. We used OpenWRT on some wireless routers, so the idea of using open source routing software was not new to us. Tested using plain Linux as a router. That worked, but was (way) over my staff's head. Tried Vyatta on the same hardware. At that time Vyatta's web-interface was a joke, making it no better than plain Linux for our purposes. (The web-interface may have improved since then and as a virtual router in a VM environment, Vyatta looks quite good.) Untangle was decent, but all of the interesting features had to be bought, which nullifies most of the advantages of it being open source. Heard about pfSense on the Linux Action Show and gave it a try.
Testing pfSense and learning its feature-set convinced us that it could do everything we needed (NAT, routing/firewalling between VLANs and the outside world) as well as do some other nice tricks (VPN concentrator, web caching/filtering, nice graphs of important stats, logging web usage, acting as a DHCP and DNS server, etc.). Basically, pfSense does everything that OpenWRT does and more since it expects to be run on more powerful standard hardware. Since it runs on standard hardware, the community isn't as fragmented as with OpenWRT, and more of pfSense's users are applying it in a professional environment, so the community support is quite good. The paid support is excellent. Being able to replace a failing router or NIC with something we had on the shelf is nice too.
So we had an open source routing solution that fit our needs, and much better than Cisco's offerings. But shifting all of our routing from Cisco to pfSense was a bold move. The Huawei story was the clincher for us. If Huawei did it, Cisco could too. That realization lead to my decision to always use an open source solution on network edge devices. This story seems to support that decision.
Instead of buying backdoored equipment that's been tampered with by NSA employees, I replaced a $6,000 Cisco AVA box with a 1U dual-core atom box running pfSense for about a grand. I've also reflashed the various WRT-series routers in the field with DD-WRT. ....And now our official new IT policy is "thou shalt not buy Cisco/Linksys gear".
Way to go NSA, you sank what little remains of the US tech industry. And it's not Snowden's fault in the least for revealing the crimes and assault on our liberty at the hands of the NSA. It's the NSA's fault for committing the serious crimes against their own people in the first place. They should be shut down, tarred, feathered and put on trial for becoming domestic terrorists. Don't tread on me.