Slashdot Mirror
Cisco Systems Will Be Auditing Their Code For Backdoors (cisco.com)
An anonymous reader writes: In the wake of the discovery of two backdoors on Juniper's NetScreen firewall devices, Cisco Systems has announced that they will be reviewing the software running on their devices, just in case. Anthony Grieco, a Senior Director of the Security and Trust Organization at Cisco, made sure to first point out that the popular networking equipment manufacturer has a "no backdoor" policy.
According to Grieco, Although our normal practices should detect unauthorized software, we recognize that no process can eliminate all risk. Our additional review includes penetration testing and code reviews by engineers with deep networking and cryptography experience. The reviewers will be looking for backdoors, hardcoded or undocumented account credentials, covert communication channels and undocumented traffic diversions.
They havent been already?
and say we did. It's apparent by now that Cisco will do what the NSA tell them to. This is just about saving face, and more importantly, saving that sweet revenue.
history repealing itself continues... https://www.youtube.com/watch?v=sjgRbI7yQCI ..read the teepeeleaks etchings,, we're the natives now...
For never ever putting an 'appliance' directly on the internet. Particularly when it comes to closed source. It's attractive to think you can get something ready to roll specific to your needs, but it also means putting a huge maintenance burden on the provider of that appliance, with a huge potential set of code that could be compromised, and a higher latency for getting fixes (some appliances need to wait for their image provider, who waits for a well-known distribution to publish, who might wait for upstream to have a fix, on their best days).
At least with software that pulls in only the parts that are truly unique to the use case, then a vendor only is responsible for their own mess, which is a bit easier.
Too bad the trend is appliance-ification for *production*, using a docker pull or download a canned VM, instead of managing an image directly. These are slick and cool ways to evaluate and stand up something quick in a 'trusted' isolated environment (though one should always be vigilant regardless of 'internal' or not, the risk/benefit is different). When you go to an internet facing service, more care should be exhibited.
XML is like violence. If it doesn't solve the problem, use more.
While it's nice they are stepping it up its sad it wasn't being done in the first place.
But what happens if they DO actually find something? Will they reveal it? I am guessing not.
My eyes reflect the stars and a smile lights up my face.
Get your popcorn and peanuts and sit down for some theatre.
https://wrgms.com/synologys-secret-telnet-password/
And can confirm they can protect your data just in case. You never know.
as well as genocidal bigotry.... phewww
Now they waste a lot of money for auditing, and if they really find something, I guess NSA will send them a gag order. Then cisco knows that they sell spyware, but what has changed for the customer? Nothing. Cisco will perhaps raise prices or deliver a less quality product because they wasted all that money with the audits. Well perhaps at least they will detect chinese backdoors if there are any. But my guess is that if china has placed backdoors, they place them in the silicon, because that's hard to detect or remove.
our skirts are clean so far as religious etc... promotion/demotion is concerned?
Can confirm, your wife is really easy to penetrate.
All our back doors are working fine!
I know, right? I found three security holes!
Does she have a "no backdoor" policy as well?
Cisco Systems Will Be Auditing Their Code For _Unexpected_ Backdoors
As one of the developers behind similar devices I can say we need access to the complete set of code and we don't have it. Even if Cisco does an audit they won't be able to ensure the complete set of code isn't back-doored. I work for a company that designs and manufactures routers, switches, and similar gear. There are at least a few bits which we don't have the complete sources for. For example all the devices with 802.11ac chips in them. If any one of these peices contain a backdoor we wouldn't know it. It is a major major security issue. Any number of parties besides the NSA might be backdooring *every* device and because there are nonly a very small handful of companies with the code for these pieces it is highly likely that all of our systems are backdoored. Desktops, laptops, tablets, and most routers. There are probably only a few exceptions to this where the complete set of sources are available. I'd suggest checking out www.librecmc.org for consumer routers as it's the only embedded distribution I can confirm is back-door free for those devices which are supported.
And will it make a difference?
"I don't know, therefore Aliens" Wafflebox1
If/when an American company is ordered to put a back-door in their software, they are also forbidden from discussing it.
So this effort will only report non-governmental back doors, not NSA/CIA ones.
eg: https://en.wikipedia.org/wiki/National_security_letter
Trust Us
I don't get it...
Isn't backdoor supposed to be something you did on purpose? Why would you even have to audit to know if there's a backdoor?
Even if Cisco does an audit they won't be able to ensure the complete set of code isn't back-doored.
While this is true, is that as big of a security risk? (yes, I realize that any security breach is a big deal, but I'm looking at the big picture here) If the chipmaker for the 802.11ac chips has a backdoor in it, then what can they gain access to? Can they control the entire device, or just that subset of the device? They might have access to the encrypted network traffic, but can they do anything with it? Also, wouldn't finding the dump of the data out of the network, or into the network be relatively easy to spot?
Since I'm a sysadmin and not a hardware designer I'll wait for some answers here. Should be a good discussion.
"A plan fiendishly clever in its intricacies"- Homer Simpson
That's all they're looking for?
- The Kessel run is for nerf herders. I can circumnavigate the entire Central Finite Curve in a lot less than 12 parse
If you control a network interface, you can generally control the entire system, because those chipsets have DMA access to the internal memory of the rest of the computer. You may have to do some work to figure out how to find and corrupt the OS data structures, but you have access to everything.
If the owner of the system is very lucky, there'll be an IOMMU (without a back door) and the OS will have programmed that IOMMU to do something useful. But you can't rely on either, especially in embedded devices.
Also, the driver for that chip is very unlikely to be hardened against the chip sending back exploits. The driver will distrust the network data (and won't process them very much anyhow), but it's going to assume that, say, an offset in a chip register is a valid value.
Considering Cisco makes its own ASICs, I'm fairly certain they have the schematics, including its wifi chipsets.
YOU can't audit the entire thing. That doesn't mean ${COMPANY} can't.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
I think you misunderstand the concept of "failed penetration testing".
No. They don't. At least not any more and not wireless. Way back in the dark ages they may have been making their own ethernet and backplane chips, but when was the last time you heard about their fab plant? Remember the big retooling to get their fab scale down to compete with cheap SoCs or the patent cases against them by broadcom and qualcomm et al? No, none of that? Because they aren't making their own wireless ASICs.
I can assure you, no matter what you think you know. NO ONE has a clean end-to-end picture of WTF is going on under the hood any more.
Cisco's code definitely includes back doors for legally authorized interception.
???
or have they?
What will their auditing standards be?
> Back doors should appear to be standard coding errors
> Find some obscure behavior in old and insecure crypto libraries, tie functions to that, use as excuse to not use up to date libraries
> Ensure random numbers use a predictable method in some NSA-known number of dimensions
> Use some Chinese words to make it look like we're the victims when the backdoor is discovered
> Implement hardware protection using chips that are not subject to less than multi million dollar analysis, claim to protect trade secrets
> Allow remote updates with 3G, or wireless, or just the wild internet- anything that responds to a private key. Because private keys are never stolen ever.
> Don't have any method of verifying the firmware to a particular image or version
> Avoid a write protect switch to firmware- firmware should be anything but firm!
> Under no circumstances use open source code, or ensure a proprietary part holds the real keys
With standards such as these, Cisco hopes to bring you better quality backdoors in the future!
What about: paloalto, fortinet, fireeye, pfsense, cyberroam, etc?
"There are at least a few bits which we don't have the complete sources for. For example all the devices with 802.11ac chips in them."
But you know how those bits interact with the rest of the router. What kind of permissions does the radio firmware have that could be used for nefarious purposes? Serious question. Would nefarious firmware be able to leak AES keys or wifi passwords? Or read/write memory in the router OS?
Avantslash: low-bandwidth mobile slashdot.
So does my Girlfriend :(
This is all High Theatre,
Good show old boy!
Yes AC thats the only way to escape the NSA and its traditional, generational relationships deep into the US brands.
Nations have to buy their own domestic products, code on them and then work out cpu power, cooling, power needs and their own software.
Importing US installed trapdoors and backdoors over every generation of hardware and software is not going to help with any nations competitiveness or security.
5 eye + nations get a look into any network by default as shipped is not the best way to do computing.
Domestic spying is now "Benign Information Gathering"
Good luck fuckers! I use an abacus!
Excellent point. The only way besides full source and HW spec access I see, is treating things like the 802.11ac components as "hostile, likely compromised" in the system design. That makes things more expensive, of course.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
If you're a big enough partner or pay enough for the SDK, you get the source. Sounds like you're not a big enough fish.
Government does not even remotely care. I've worked for a 3 letter agency for decades as an engineer. I am tempest certified and work with secure workstations, encryption devices and I can tell you that they ALL have foreign manufactured parts. We used to have Compaq workstations that came from China ffs. I'm sure nothing was compromised in any of those of course... especially as they were only spot checked for operation and emissions... Nothing else.
Thank you for your insight. It is appreciated.
"A plan fiendishly clever in its intricacies"- Homer Simpson