Slashdot Mirror
Cisco Security Appliances Found To Have Default SSH Keys
Trailrunner7 writes: Many Cisco security appliances contain default, authorized SSH keys that can allow an attacker to connect to an appliance and take almost any action he chooses. The company said all of its Web Security Virtual Appliances, Email Security Virtual Appliances, and Content Security Management Virtual Appliances are affected by the vulnerability.
This bug is about as serious as they come for enterprises. An attacker who is able to discover the default SSH key would have virtually free reign on vulnerable boxes, which, given Cisco's market share and presence in the enterprise worldwide, is likely a high number. The default key apparently was inserted into the software for support reasons.
"The vulnerability is due to the presence of a default authorized SSH key that is shared across all the installations of WSAv, ESAv, and SMAv. An attacker could exploit this vulnerability by obtaining the SSH private key and using it to connect to any WSAv, ESAv, or SMAv. An exploit could allow the attacker to access the system with the privileges of the root user," Cisco said.
This bug is about as serious as they come for enterprises. An attacker who is able to discover the default SSH key would have virtually free reign on vulnerable boxes, which, given Cisco's market share and presence in the enterprise worldwide, is likely a high number. The default key apparently was inserted into the software for support reasons.
"The vulnerability is due to the presence of a default authorized SSH key that is shared across all the installations of WSAv, ESAv, and SMAv. An attacker could exploit this vulnerability by obtaining the SSH private key and using it to connect to any WSAv, ESAv, or SMAv. An exploit could allow the attacker to access the system with the privileges of the root user," Cisco said.
Was THIS the way you finally managed to get off ssh1, Cisco?
#DeleteChrome
This is the example of precisely how disciplined the 'appliances' you get from vendors are constructed.
This is a *security* focused appliance that made this goof from one of the more well regarded vendors in the market.
Think about that next time you save a few seconds of your time buying an appliance or even pulling down something from dockerhub instead of just installing the platform.
Of course the software industry has gone to town with appliances, meaning they spend no time properly packaging things anymore because an 'appliance' will take care of all of it.
XML is like violence. If it doesn't solve the problem, use more.
There might be reasons other than "support" for universal access SSH keys.
is this a bug?
default, authorized SSH keys
"If any question why we died, Tell them because our fathers lied."
https://techlib.barracuda.com/...
You can't change the keys, so if you want to use SSHFS to backup systems that aren't agent supported, you've potentially given root access to anyone who's extracted the private key from the appliance (and leaked it to the internet). I wouldn't be surprised if the agents used the same craptastic cryptographic fail.
"Why do you consent to live in ignorance and fear?" - Bad Religion
Cisco is very much a "configure it yourself" type of deal. In fact their whole certification track above the CCENT level revolves heavily around knowing the IOS command syntax.
You can substitute their routers for Linux, but NOT their layer 3 switches, unless you really don't give a shit about performance in an enterprise environment.
Are there even linux-based switches? I know the router front is doing good with Vyatta, etc, but never heard of linux switches. Doesn't make sense given how (relatively) cheap switches are.
Here's one, Cumulus Networks. A lot of Cisco switching gear is Linux underneath with a more familiar Cisco CLI.
http://cumulusnetworks.com/blo...
http://www.datacenterknowledge...
http://opennetlinux.org/
http://www.opencompute.org/
http://www.wired.com/2013/03/b...
Get with the times, the Big Iron Networking gear (like usead at Google and Facebook) are switches running Linux.
Just a Tuna in the Sea of Life
It's odd how companies like Microsoft get criticized a lot about their malice and monopoly position, but Cisco gets a free pass even when they are the dominant player in enterprise networking gear. Why is this? I'm sure that even this message goes through mountains of Cisco hardware when I send it.
A Cisco Nexus is pretty Linux.
No sir I dont like it.
How many home routers have default passwords that aren't forcibly changed when the router is first set up?
It's the same principle, with the only difference being it is something that has to be discovered by someone, once, rather than guessed like so many easy-to-guess default passwords ("admin", "password", etc.).
The other difference is that one should expect better from a device that is specifically marketed as a security device. But that's a social issue not a technical one.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Yeah, pretty much all of Ubiquiti's gear is. Edgeswitch, in particular, in this case.
I had a sucky sig.
This class of bug is unknown in the free software world because your project will forked.
All corporations are subject to enormous pressure from corporations, and therefore can not be trusted, even if the management wanted to play it straight.
All populations, including the U.S'es are targets of information warfare by the NSA and GCHQ.
There is no security without the source code.
Do you drag every conversation you hear down with this pedantic garbage every time you hear a figure of speech? You must be a blast at parties.
You mean like everyone who had to replace their Debian-generated SSL keys due to bad (practically nonexistent) PRNG seeding?
Juniper's OS is based on freebsd.
Just out of curiosity, what do you think the proper homonym phrase is for this?
"City hall" in German is "Rathaus" Kinda explains a few things......
This isn't a bug.
This is crap security by design.
And you can probably bet that the NSA and the Chinese have these keys, and can pretty much bypass any "security" offered by Cisco.
Essentially Cisco did this shit on purpose, and you can bet at least some people knew damned well this was there.
Lost at C:>. Found at C.
It should be "free rein". It refers to the reins used to direct the travel of a horse similarly to the way "steering wheels" were used to direct the motion of automobiles before Google acquired a majority stake on the US Supreme court and self-driving cars became mandatory.
Anyway, If you were to release your grip on the reins, then the horse may theorectically feel free to travel in any direction. In practice the horse generally returned to the barn after scraping the rider off on the nearest tree.
Just out of curiosity, what do you think the proper homonym phrase is for this?
From grammarist.com it should be "free rein" as in a horse being able to do what they want because the reins are free. "reign" is a recent misspelling that is being used more often.
The correct figure of speech is "free rain." Nobody alive remembers when rain fell freely where I'm living, so this has corrupted over the years into horses and monarchs and whatnot.
Man, you really need that seminar!
A layer 3 switch is a fucking router. It's called a layer 3 switch because it's a fucking shitty router.
Switches are layer 2.
I believe the problem here is that they thought they could get away including the "lawful interception" (i.e. "immoral and dangerous backdoor") key just by the ordinary mechanism instead of compiling it into the sshd binary.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
There are lots of switches running linux. Of course, linux isn't the thing doing the switching.
The question to ask is can you get to the OS and/or ssh configuration to remove whatever the vendor may have installed? (i.e. remove whatever ssh backdoor keys they left there.) In most cases, the answer is "Hell. No."
The correct figure of speech is "free rain."
Nope, the correct figure of speech is "Free Ryan.":
From Wikipedia: "In September 2013, the first book about the Ryan Ferguson case was released: Free Ryan Ferguson: 101 Reasons Why Ryan Ferguson Should Be Released, by Brian D'Ambrosio."
We need a "+1 -- nice sig" moderation.
Do you know how many times I thought about adding a back channel to a piece of software I wrote because it's easier than training users? Do you care to guess at how many times I have actually done this?
Lets ask that same question about smaller software companies. You won't find any that survive for long after people find out they have these kinds of security practices.
It's hard to say why this happens so frequently and massively with large companies/corporations. I'm sure it's partly Government pressure, probably pressure from other companies/corporations, and partly an ignorant executive demanding this gets done. I'm sure the latter can claim the first two are the problem. The latter however, should result in termination of the execs responsible. That last part does not happen, which makes me wonder how big the first two really are.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Considering that NSA definitely had the source code and configuration (otherwise they would not use Cisco stuff themselves) they knew about this shit. And leaving such a huge hole in nation's security while it's NSA's main responsibility is unacceptable. And after that recent data breach fiasco, one has to wonder, why the fuck we keep paying their salaries?!
And why was this?
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
Anyone that doesn't think the NSA was involved is extremely gullible. Cisco is the biggest networking company in the world. They serve governments and large corporations around the planet which all expect transparency and security. Cisco's management, engineers, programmers and it their cats could speak.... all know beyond a shadow of a doubt you don't insert secret default backdoors into enterprise hardware. Code review would have detected such a glaringly obvious "bug" long before it was inserted into the firmware of billions of dollars of enterprise hardware effecting billions of users and trillions of dollars of commerce. There is no way this was done accidentally. Zero chance. Nada. Zilch.
A layer 3 switch is in many ways better than a router because it makes forwarding decisions in hardware. Meanwhile dedicated routers don't offer any big advantages over a layer 3 switch unless you happen to be using old shit like frame relay where you need special WICs and can't use ordinary ethernet or SFP adapters.
Quite a difference between using any old Linux server as a router, and using an actual device that is purpose built for that which includes an ASIC to make faster and more efficient forwarding decisions.
It is a router that can *route* packets among all interfaces at full speed. Get a Linux box with 16 NICs and flood them with traffic. See it sizzling, smoking and crashing.
Oh fuck off with that bullshit. Routing packets takes minimal CPU, so fuck off with your sizzling and smoking horse shit. Full fledged routers are much more capable than "layer 3 switches".
A "layer 3 switch" has minimal routing features and is only a "great router" if you don't need to do much routing and thus don't want to spend money on an actual router.
Dedicated routers offer same-or-better performance and capacity of a "layer 3 switch", and give you FULL layer 3 traffic control, not the half-assed firewalling, prioritization, etc. that "layer 3 switches" provide (at slow fucking speed).
"Layer 3 Switch" is a marketing term for "half-assed router", and nothing more. If they were as capable as routers they'd be called routers because they'd fucking be routers. It's just like "smart managed switch", which means you get a semi-functional web interface (and maybe a semi-functional serial interface), good enough to do basic filtering, authentication, and VLANing, but it's no where near as capable as a true managed switch.
Saying a layer 3 switch is better than a router is like saying a spork is better than a spoon, fork, and knife.
Except the 'security appliance' line does not run IOS. These are servers (originally re-badged Dell PowerEdge, but now Cisco UCS C-class rack-mounts) running AsyncOS (a proprietary FreeBSD-based platform), which used to be branded as Ironport.
It doesn't seem to affect any IOS flavour (IOS, IOS-XE which is Linux-based, IOS-XR) or the Nexus NX-OS (Linux-based).
Wow. Not only is everything you said way wrong (way way way WAY wrong,) but it's also approaching retardation.
In fact, I strongly recommend there be a restraining order to prevent you from going anywhere within a mile of any enterprise grade network. You're of those guys who talks down to other employees at IT shops while always being the biggest cause of down time. 100% Dunning-Kruger.
Poverty = ignorance. Have you ever touched anything not sold in Bestbuy?
I think it's worse than that. He's a real life Nelson "Big Head" Bighetti. Makes himself look knowledgeable but is really just fucking worthless.
I've forgotten the name of the company now, but there was a presentation at the Linux conference last year (two years ago, maybe?) in New Orleans that talked about this very topic, and they (or someone else that approached me afterward because I asked a question about it) said that their company was making switching hardware that did stuff in kernel-space, maybe with a proprietary module. This is key here... you can stuff a bunch of NICs in a box and use brtables or whatever and make a switch, but that's going to be dog-slow. ASICs are needed, and at least that one Linux company is making them.
Need a Linux consultant in New Orleans?
WSA, ESA and SMA all came from the Ironport acquisition. At that time, Ironport was considered the model for success, and their management team basically acquired Cisco security. As a result, their products never got the full inspection for vulnerabilities and this was simply missed. This was not an NSA trick, just human error.
Never attribute activity to nefarious government agencies to what can be more easily explained by clueless MBA PHBs demanding their own personal screendoor.