Slashdot Mirror
Cisco Systems Will Be Auditing Their Code For Backdoors (cisco.com)
An anonymous reader writes: In the wake of the discovery of two backdoors on Juniper's NetScreen firewall devices, Cisco Systems has announced that they will be reviewing the software running on their devices, just in case. Anthony Grieco, a Senior Director of the Security and Trust Organization at Cisco, made sure to first point out that the popular networking equipment manufacturer has a "no backdoor" policy.
According to Grieco, Although our normal practices should detect unauthorized software, we recognize that no process can eliminate all risk. Our additional review includes penetration testing and code reviews by engineers with deep networking and cryptography experience. The reviewers will be looking for backdoors, hardcoded or undocumented account credentials, covert communication channels and undocumented traffic diversions.
They havent been already?
and say we did. It's apparent by now that Cisco will do what the NSA tell them to. This is just about saving face, and more importantly, saving that sweet revenue.
history repealing itself continues... https://www.youtube.com/watch?v=sjgRbI7yQCI ..read the teepeeleaks etchings,, we're the natives now...
For never ever putting an 'appliance' directly on the internet. Particularly when it comes to closed source. It's attractive to think you can get something ready to roll specific to your needs, but it also means putting a huge maintenance burden on the provider of that appliance, with a huge potential set of code that could be compromised, and a higher latency for getting fixes (some appliances need to wait for their image provider, who waits for a well-known distribution to publish, who might wait for upstream to have a fix, on their best days).
At least with software that pulls in only the parts that are truly unique to the use case, then a vendor only is responsible for their own mess, which is a bit easier.
Too bad the trend is appliance-ification for *production*, using a docker pull or download a canned VM, instead of managing an image directly. These are slick and cool ways to evaluate and stand up something quick in a 'trusted' isolated environment (though one should always be vigilant regardless of 'internal' or not, the risk/benefit is different). When you go to an internet facing service, more care should be exhibited.
XML is like violence. If it doesn't solve the problem, use more.
But what happens if they DO actually find something? Will they reveal it? I am guessing not.
My eyes reflect the stars and a smile lights up my face.
Now they waste a lot of money for auditing, and if they really find something, I guess NSA will send them a gag order. Then cisco knows that they sell spyware, but what has changed for the customer? Nothing. Cisco will perhaps raise prices or deliver a less quality product because they wasted all that money with the audits. Well perhaps at least they will detect chinese backdoors if there are any. But my guess is that if china has placed backdoors, they place them in the silicon, because that's hard to detect or remove.
All our back doors are working fine!
Cisco Systems Will Be Auditing Their Code For _Unexpected_ Backdoors
As one of the developers behind similar devices I can say we need access to the complete set of code and we don't have it. Even if Cisco does an audit they won't be able to ensure the complete set of code isn't back-doored. I work for a company that designs and manufactures routers, switches, and similar gear. There are at least a few bits which we don't have the complete sources for. For example all the devices with 802.11ac chips in them. If any one of these peices contain a backdoor we wouldn't know it. It is a major major security issue. Any number of parties besides the NSA might be backdooring *every* device and because there are nonly a very small handful of companies with the code for these pieces it is highly likely that all of our systems are backdoored. Desktops, laptops, tablets, and most routers. There are probably only a few exceptions to this where the complete set of sources are available. I'd suggest checking out www.librecmc.org for consumer routers as it's the only embedded distribution I can confirm is back-door free for those devices which are supported.
And will it make a difference?
"I don't know, therefore Aliens" Wafflebox1
Trust Us
I don't get it...
Isn't backdoor supposed to be something you did on purpose? Why would you even have to audit to know if there's a backdoor?
Even if Cisco does an audit they won't be able to ensure the complete set of code isn't back-doored.
While this is true, is that as big of a security risk? (yes, I realize that any security breach is a big deal, but I'm looking at the big picture here) If the chipmaker for the 802.11ac chips has a backdoor in it, then what can they gain access to? Can they control the entire device, or just that subset of the device? They might have access to the encrypted network traffic, but can they do anything with it? Also, wouldn't finding the dump of the data out of the network, or into the network be relatively easy to spot?
Since I'm a sysadmin and not a hardware designer I'll wait for some answers here. Should be a good discussion.
"A plan fiendishly clever in its intricacies"- Homer Simpson
That's all they're looking for?
- The Kessel run is for nerf herders. I can circumnavigate the entire Central Finite Curve in a lot less than 12 parse
If you control a network interface, you can generally control the entire system, because those chipsets have DMA access to the internal memory of the rest of the computer. You may have to do some work to figure out how to find and corrupt the OS data structures, but you have access to everything.
If the owner of the system is very lucky, there'll be an IOMMU (without a back door) and the OS will have programmed that IOMMU to do something useful. But you can't rely on either, especially in embedded devices.
Also, the driver for that chip is very unlikely to be hardened against the chip sending back exploits. The driver will distrust the network data (and won't process them very much anyhow), but it's going to assume that, say, an offset in a chip register is a valid value.
Considering Cisco makes its own ASICs, I'm fairly certain they have the schematics, including its wifi chipsets.
YOU can't audit the entire thing. That doesn't mean ${COMPANY} can't.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Cisco's code definitely includes back doors for legally authorized interception.
What will their auditing standards be?
> Back doors should appear to be standard coding errors
> Find some obscure behavior in old and insecure crypto libraries, tie functions to that, use as excuse to not use up to date libraries
> Ensure random numbers use a predictable method in some NSA-known number of dimensions
> Use some Chinese words to make it look like we're the victims when the backdoor is discovered
> Implement hardware protection using chips that are not subject to less than multi million dollar analysis, claim to protect trade secrets
> Allow remote updates with 3G, or wireless, or just the wild internet- anything that responds to a private key. Because private keys are never stolen ever.
> Don't have any method of verifying the firmware to a particular image or version
> Avoid a write protect switch to firmware- firmware should be anything but firm!
> Under no circumstances use open source code, or ensure a proprietary part holds the real keys
With standards such as these, Cisco hopes to bring you better quality backdoors in the future!
"There are at least a few bits which we don't have the complete sources for. For example all the devices with 802.11ac chips in them."
But you know how those bits interact with the rest of the router. What kind of permissions does the radio firmware have that could be used for nefarious purposes? Serious question. Would nefarious firmware be able to leak AES keys or wifi passwords? Or read/write memory in the router OS?
Avantslash: low-bandwidth mobile slashdot.
Yes AC thats the only way to escape the NSA and its traditional, generational relationships deep into the US brands.
Nations have to buy their own domestic products, code on them and then work out cpu power, cooling, power needs and their own software.
Importing US installed trapdoors and backdoors over every generation of hardware and software is not going to help with any nations competitiveness or security.
5 eye + nations get a look into any network by default as shipped is not the best way to do computing.
Domestic spying is now "Benign Information Gathering"
> This is all High Theatre,
> Good show old boy!
I don't think so. But I will say that such cynicism and paranoia was unthinkable five years ago, possible as a cautionary issue a year ago, and now seems unlikely but by no means crazy talk. Lame and scary.
Excellent point. The only way besides full source and HW spec access I see, is treating things like the 802.11ac components as "hostile, likely compromised" in the system design. That makes things more expensive, of course.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Thank you for your insight. It is appreciated.
"A plan fiendishly clever in its intricacies"- Homer Simpson