Slashdot Mirror
How Cisco Is Trying To Prove It Can Keep NSA Spies Out of Its Gear (csoonline.com)
itwbennett writes: A now infamous photo [leaked by Edward Snowden] showed NSA employees around a box labeled Cisco during a so-called 'interdiction' operation, one of the spy agency's most productive programs,' writes Jeremy Kirk. 'Once that genie is out of the bottle, it's a hell of job to put it back in,' said Steve Durbin, managing director of the Information Security Forum in London. Yet that's just what Cisco is trying to do, and early next year, the company plans to open a facility in the Research Triangle Park in North Carolina where customers can test and inspect source code in a secure environment. But, considering that a Cisco router might have 30 million lines of code, proving a product hasn't been tampered with by spy agencies is like trying 'to prove the non-existence of god,' says Joe Skorupa, a networking and communications analyst with Gartner.
That is a lot of code, is that a realistic number for a router? I'm genuinely interested in knowing.
In a router??? Bullshit. Windows 10 don't have 30 million lines of code.
or it didn't happen...
They will break up in the very next episode.
What does this have to do with the cisco or the nsa again?
More like "the devil", in this case.
The descent of Big Bang Theory into the Friends zone is complete. Sad.
How can they convince anyone that they can keep the NSA out when the Law says they have to let the NSA in?
This might be useful only if I could bring my own compiler and could keep the resulting binary and I could install that myself on the hardware (never going to happen).
Even than, the Cisco products includes hardware with sophisticated packet processing capabilities they could just built it into that.
Maybe they should first find a way to ship the product in such a way that it can't be tampered with.
New things are always on the horizon
I didn't read the article (shocker), but how exactly does Cisco plan on convincing customers that after they spend a few months straight locked into their facility and validated their source code (which I'm assuming includes the whole build chain source code), that the binaries that end up on their hardware match what was produced by the source code? Oh and also that there is no hardware backdoor (or is that also part of the 30 million lines of code).
I'd be seriously surprised if Cisco itself had the process documented and validated to the point where they could convince themselves that they're all clear, let alone their customers.
Just like the documents showing Microsoft handing over their customers communication data to the NSA...once you've been fingered as a good "partner" with the U.S. intelligence apparatus your shelf life as a company has been time bombed...ignition is just waiting on an alternative supplier that can be reasonably trusted (IMHO this could take some years, but its coming...the market is too big and valuable...if given a true choice nobody wants to buy gear from companies that were shown to be stooges for government snooping).
If this is true, this is just mind-boggling.
I think the biggest project I ever worked on came in just under 500K lines of C, not counting whitespace, and this was a project that spanned the greater part of 7 years.
I doubt Windows 10 is anywhere near 30 million lines of code, but I might be wrong ??.
"But, considering that a Cisco router might have 30 million lines of code, "
Hash your firmware image, make a fingerprint. If hash(image) == fingerprint then you're good.
If you're having problems controlling your images then I'd advise you stop producing ambiguously configured OSS hackware and get started with an actual software process. Y'know, like those clueless 40 year old neckbeards used to.
It's guaranteed that cisco is compromised by NSLs. Until this law is fixed, no big vendor can be trusted.
I will create it on Java multicore.
The NSA was supposedly loading code onto hardware. Cisco is a pretty closed environment if they pown the bootloader just exactly how are you going to detect this? You can review all the code you want if your can not trust the hardware it does you no good.
No sir I dont like it.
How about stop making and delivering interdicted custom gear for the NSA/CIA?
I know, I have seen the equipment hooked into AT&Ts network.
It isn't a joke what is happening. In the end we all know why this spying is happening and it is not to make you safer.
It really is all about industrial espionage and taxes, all in pursuit of western bogeymen, they create.
As long as they keep the bogeymen well funded expect more countries shredding freedom and liberty, and all of those that died before us to have given their lives in vain.
I mean look at what they are doing, France wants to rewrite it constitution. For what? Why?
Got Geometrodynamics? Awe, too hard to figure out? Too bad.
Back in March , in a related story, one of Cisco's VPs for security, John Stewart, was quoted in the press as saying that Cisco would ship to decoy addresses to circumvent interception by the Government. Supposedly, this was at a roundtable discussion during the Cisco-Live conference in Melbourne, but there is no video of the discussion on the Cisco-live website.
I've heard he was misquoted and they don't actually do it. Does anybody have link to actual video of this discussion? Are they still doing this? Has anybody used that service?
The original slashdot article is http://hardware.slashdot.org/s...
Seen enough YouTube videos from cameras packed in shipments for the obvious answer...
These boxes are costly enough to justify packaging it with some device that will record GPS, video, and sound. Make sure there is some good cryptographic signature on the device. Attach it to the router, and put a nasty anti-tamper dye spray to boot. (Although might have some regulatory issues with the explosive device for that, hmmm...).
Give the customer a rebate for returning the tracking device. (After unlocking, of course.)
Of course, the tracking device will need solid cryptographic signature/protection, but would have a lot fewer millions of lines of code than the router!
Then the guy you see stumbling out of the FedEx office covered in dye... he's not with FedEx.
The best the spys can do, then, is to "lose" the device in shipment, pay off the carrier's insurance company (otherwise, insurance rates will go sky-high), and then try to sell the router in the black market to spy on somebody other than the original target.
I'm humbeled that I've exceeded this number. However, I think the shuttle had four redudant computers running off a common code base, and a fifth computer that had software developed independenty from the original four. The shuttle probably had somthing like 1M lines of code at the end of the day. After the glass-cockpit retrofits, I wouldn't be surprised if this number jumped passed 3M lines, easily).
And that number is what is on the actual spacecraft. I'm willing to bet the computers in Florida and Texas had equal, if not more complexity represented than what was on the actual orbiter.
Step 2) Hacker understands how it works and notices a security issue, but does not reveal it.
Step 3) Return to private home where they design an exploit of that issue.
Frankly, their attempts to keep their security secret just make it harder for the white hats to detect the issues, without significantly affecting the black hats.
excitingthingstodo.blogspot.com
I don't know what those particular routers are running. Here is just me listing a few packages off the top of my head that could be in there:
There are 12 million LOC in the kernel alone (linux?)
Another million for libc
2 millions for web server
2 millions for php or whatever they use.
6 million for java.
I have not even included anything cisco might write themselves.
As you can see, it would not be too hard to get to the 30 million LOC mark. The backdoors can be installed in any of these packages not only in the stuff Cisco wrote.
I seriously doubt cisco wrote 30 million LOC for their routers, but once you start counting all the 3rd party software that runs inside those routers 30 million does not seem too far fetched.
it may not work for those who need serious power. ThinkPenguin sells a 100% free software friendly router you can flash a distribution called libreCMC on. The complete sources are available for everything including bootloader, wifi chipset, CPU, etc.
What good is checking the source code when the NSA is shown to be modifying the gear after it leaves Cisco? You're checking the code that ships from Cisco before the NSA gets it, not what you receive. And what if the NSA isn't touching something in the code but putting in a piece of their own hardware?
Which means that they will be subject to all sorts of pressures to be 'helpful' about it. Let's be clear ladies and gentlemen, boys and girls, trusting any US produced hardware or software is a mistake if you want to be SECURE. That the tech firms haven't used this as excuse to move their domicile to somewhere with lower taxes as the real excuse for moving remains a surprise...
Did they move their operations from the US and fire all their US developers and only hire ones from countries with the strongest data protection laws and the weakest spy agencies?
No? Then they are NSA compromised. Here is a letter from the DOJ ordering you to cooperate with the NSA or go to jail. You can't show the letter to anyone or you go to jail. If you want to contest it you will first go to jail and then you will have to contest it in a special court where you can't get any evidence that is in your favour. So you stay in jail.
If companies like Siemens are using Cisco equipment then they are fools.
Thank your government for the fact that no one in their right mind is ever going to trust any hardware coming out of the U.S. ever again. Ain't no putting that genie back in the bottle.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Many people can't tell the difference between fake Chinese Cisco routers and the real thing.
Nuff said.
...Interdiction is where it's at: https://www.techdirt.com/artic...
Or maybe use IPSec / SSH with DH Group 19 - that's not looking too clever either: https://weakdh.org/imperfect-f...
All in all, if your threat model includes the NSA then reviewing 30m LOC may seem like a good place to start but in practice.....
"Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
And I wonder if the NSA root kit will wipe out the Chinese one?
http://saveie6.com/
In all honesty what good is reviewing the code. How do you know the code you are viewing is what was put in the device. Unless you can get the code and compile independently then verify some hash or check sum.
No.
Look, an out of control surveillance regime which can't even stop terrorists from getting 1000 weapons in the US will spy because they can, no matter what they say.
There's your budget deficit.
-- Tigger warning: This post may contain tiggers! --
The CIA and NSA specialize in intercepting items in transit, modifying them, carefully repacking them to hide any sign of tampering and sending them on to the end recipient.
None of that is impacted in the slightest bit if customers are coming to a warehouse in NC to test it. So it tests clean and they sign off on it. And what happens next? It gets shipped. And if they want to intercept it, they will. And what has been accomplished? Nothing.
And of course this is separate from the OTHER big Cisco issue of counterfeit fake Cisco products dropping into the channel from unclear origins in China. Nobody knows for sure what the hell is in that gear. Is it firmware with malware in it, or malware made to act like firmware? Keyloggers or full blown remote access? Nobody knows. But a lot of businesses have bought that stuff as genuine and installed it and trusted it. The truth is, all bets are off.
Sig for hire.
then it is compromised, either at manufacturing, or after being intercepted by NSA while in early transit, period.
We already have "did this package get dropped" sensors. So take that to the next level.
Vacume seal an interior bag. Place a module inside the bag with:
1. Internal Battery
2. Sensor package including light and air pressure/composition sensors
3. A small amount of memory
4. A running program which will erase the memory if any of the sensors detect a change
5. a small transmitter, capable of answering a challenge.
Customer/Cisco generate a key using a key exchange protocol, key is loaded into box gaurdian module. Box is shipped. Customer uses an RF device to query the package to see if it has been tampered with, customer informs cisco for an immediate RMA, but accepts delivery, so as to be sure the box can be returned in tact for analysis.
"I opened my eyes, and everything went dark again"
Suppose I told you about my comedy where a group of black friends get into all kinds of comical hijinks trying to interact with white people, interspersed with light-hearted comedy about how they're tired together by their love of purple drank, fried chicken, and watermelon?
That's about what BBT is to me, as a scientist: A show where "funny" is the socially retarded scientists trying to interact with normal people, mixed with stuff about what strange things those weird scientists do, and isn't it hilarious how stupid they are when they aren't doing scientisty-type things!
So what do you mean by "descent?" Dropping the faux-nerds angle and becoming a generic rom-com would be an improvement, but there's less competition in the nerd-blackface segment.
You may not survive. Sign me up!
God's name is spelled with a capital G. Of course, the godless people of today probably didn't know that.