Slashdot Mirror
Cisco Security Appliances Found To Have Default SSH Keys
Trailrunner7 writes: Many Cisco security appliances contain default, authorized SSH keys that can allow an attacker to connect to an appliance and take almost any action he chooses. The company said all of its Web Security Virtual Appliances, Email Security Virtual Appliances, and Content Security Management Virtual Appliances are affected by the vulnerability.
This bug is about as serious as they come for enterprises. An attacker who is able to discover the default SSH key would have virtually free reign on vulnerable boxes, which, given Cisco's market share and presence in the enterprise worldwide, is likely a high number. The default key apparently was inserted into the software for support reasons.
"The vulnerability is due to the presence of a default authorized SSH key that is shared across all the installations of WSAv, ESAv, and SMAv. An attacker could exploit this vulnerability by obtaining the SSH private key and using it to connect to any WSAv, ESAv, or SMAv. An exploit could allow the attacker to access the system with the privileges of the root user," Cisco said.
This bug is about as serious as they come for enterprises. An attacker who is able to discover the default SSH key would have virtually free reign on vulnerable boxes, which, given Cisco's market share and presence in the enterprise worldwide, is likely a high number. The default key apparently was inserted into the software for support reasons.
"The vulnerability is due to the presence of a default authorized SSH key that is shared across all the installations of WSAv, ESAv, and SMAv. An attacker could exploit this vulnerability by obtaining the SSH private key and using it to connect to any WSAv, ESAv, or SMAv. An exploit could allow the attacker to access the system with the privileges of the root user," Cisco said.
Was THIS the way you finally managed to get off ssh1, Cisco?
#DeleteChrome
Quit whining and learn to configure it yourselves ladies.
This is the example of precisely how disciplined the 'appliances' you get from vendors are constructed.
This is a *security* focused appliance that made this goof from one of the more well regarded vendors in the market.
Think about that next time you save a few seconds of your time buying an appliance or even pulling down something from dockerhub instead of just installing the platform.
Of course the software industry has gone to town with appliances, meaning they spend no time properly packaging things anymore because an 'appliance' will take care of all of it.
XML is like violence. If it doesn't solve the problem, use more.
NSA conspiracy theory in 3... 2... 1...
But seriously, WTF? This level of incompetence is as good as NSA-level malice.
There might be reasons other than "support" for universal access SSH keys.
Why is it that people are tempted to write "free reign"? Sure, horses are scarce nowadays, but so is monarchy.
is this a bug?
default, authorized SSH keys
"If any question why we died, Tell them because our fathers lied."
https://techlib.barracuda.com/...
You can't change the keys, so if you want to use SSHFS to backup systems that aren't agent supported, you've potentially given root access to anyone who's extracted the private key from the appliance (and leaked it to the internet). I wouldn't be surprised if the agents used the same craptastic cryptographic fail.
"Why do you consent to live in ignorance and fear?" - Bad Religion
I hear it's 12345.
Modern app appers secure their apps with App Apps, not Luddite Cisco!
Apps!
It's odd how companies like Microsoft get criticized a lot about their malice and monopoly position, but Cisco gets a free pass even when they are the dominant player in enterprise networking gear. Why is this? I'm sure that even this message goes through mountains of Cisco hardware when I send it.
How many home routers have default passwords that aren't forcibly changed when the router is first set up?
It's the same principle, with the only difference being it is something that has to be discovered by someone, once, rather than guessed like so many easy-to-guess default passwords ("admin", "password", etc.).
The other difference is that one should expect better from a device that is specifically marketed as a security device. But that's a social issue not a technical one.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Dropped. Glass shatters, children scream, NSA listens, system designer resigns, the management offers blue spectacles to the largest clients. And then they do it again.
America - the insecure.
This class of bug is unknown in the free software world because your project will forked.
All corporations are subject to enormous pressure from corporations, and therefore can not be trusted, even if the management wanted to play it straight.
All populations, including the U.S'es are targets of information warfare by the NSA and GCHQ.
There is no security without the source code.
Company bakes duplicate keys into entire product line to save production costs - color me surprised.
It's all too tempting to just drop a key into the stock image and just replicate that onto everything rolling off the factory floor. That same key is probably baked into their end-of-line test harness just before they pop on the polystyrene and stick it in a shipping box.
Sure.
One day, Slashdot will post an article without language errors... but perhaps not in my lifetime. :/
This isn't a bug.
This is crap security by design.
And you can probably bet that the NSA and the Chinese have these keys, and can pretty much bypass any "security" offered by Cisco.
Essentially Cisco did this shit on purpose, and you can bet at least some people knew damned well this was there.
Lost at C:>. Found at C.
I believe the problem here is that they thought they could get away including the "lawful interception" (i.e. "immoral and dangerous backdoor") key just by the ordinary mechanism instead of compiling it into the sshd binary.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Do you know how many times I thought about adding a back channel to a piece of software I wrote because it's easier than training users? Do you care to guess at how many times I have actually done this?
Lets ask that same question about smaller software companies. You won't find any that survive for long after people find out they have these kinds of security practices.
It's hard to say why this happens so frequently and massively with large companies/corporations. I'm sure it's partly Government pressure, probably pressure from other companies/corporations, and partly an ignorant executive demanding this gets done. I'm sure the latter can claim the first two are the problem. The latter however, should result in termination of the execs responsible. That last part does not happen, which makes me wonder how big the first two really are.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Considering that NSA definitely had the source code and configuration (otherwise they would not use Cisco stuff themselves) they knew about this shit. And leaving such a huge hole in nation's security while it's NSA's main responsibility is unacceptable. And after that recent data breach fiasco, one has to wonder, why the fuck we keep paying their salaries?!
And why was this?
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
liberum regnum is english - french - latin
free is germanic/PIE priya/friya/vri
certainly free rein was coined in the 1800s
but can...
more than that - queen in hindi is Rani?
and queen in french is reine?
i can see free rein being a mispelling
but are there older non english references to free queen ?
free reign
free rein.
Take your time and find out how much bandwidth all these NICs world require. It's not about the CPU. The PCI bus will "protect" the CPU... in a colossal traffic jam.
You can stack 10 low end Cisco switches and you will have 480 ports routing - pay attention- routing @100 Gb/s.
Poverty = ignorance. Have you ever touched anything not sold in Bestbuy?
Poverty = ignorance. Have you ever touched anything not sold in Bestbuy?
I think it's worse than that. He's a real life Nelson "Big Head" Bighetti. Makes himself look knowledgeable but is really just fucking worthless.
WSA, ESA and SMA all came from the Ironport acquisition. At that time, Ironport was considered the model for success, and their management team basically acquired Cisco security. As a result, their products never got the full inspection for vulnerabilities and this was simply missed. This was not an NSA trick, just human error.
Never attribute activity to nefarious government agencies to what can be more easily explained by clueless MBA PHBs demanding their own personal screendoor.
PGP was originally exported in a book for this same reason.
Behaviour (like the original article) has been going on for a long time. Any device/encryption method of any real use, exported from USA, is required by law to have a back door due to 'national security' aka perving.