Slashdot Mirror
Cisco Patches 'ExtraBacon' Zero-day Exploit Leaked By NSA Hackers (dailydot.com)
Patrick O'Neill quotes a report from The Daily Dot: After a group of hackers stole and published a set of NSA cyberweapons earlier this week, the multibillion dollar tech firm Cisco is now updating its software to counter two potent leaked exploits that attack and take over crucial security software used to protect corporate and government networks. "Cisco immediately conducted a thorough investigation of the files released, and has identified two vulnerabilities affecting Cisco ASA devices that require customer attention," the company said in a statement. "On Aug. 17, 2016, we issued two Security Advisories, which deliver free software updates and workarounds where possible." The report adds: "An unknown group of hackers dubbed the Shadow Brokers posted cyberweapons stolen from the so-called Equation Group, the National Security Agency-linked outfit known as 'the most advanced' group of cyberwarriors in the internet's history. One of the cyberweapons posted was an exploit called ExtraBacon that can be used to attack Cisco Adaptive Security Appliance (ASA) software designed to protect corporate networks and data centers. 'ExtraBacon targets a particular firewall, Cisco ASA, running a particular version (8.x, up to 8.4), and you must have SNMP read access to it,' Khalil Sehnaoui, a Middle East-based cybersecurity specialist and founder of Krypton Security, told the Daily Dot. 'If run successfully, the exploit will enable the attacker to access the firewall without a valid username or password.' ExtraBacon was a zero-day exploit, Cisco confirmed. That means it was unknown to Cisco or its customers, leaving them open to attack by anyone who possessed the right tools."
In past posts on Slashdot, the idea that the government should have backdoors into various systems that would allegedly be used only for legitimate criminal investigations. The security experts poo-pooed the idea, saying that all manner of things would go wrong, and this appears to be the day of reckoning. The government of course claims that this would never be a problem.
Security researchers 1, NSA 0
Is anybody here really surprised?
Yes I do believe it. Snowden was no super spy. He was a mid level IT grunt and he took everything including their lunch money. That means that spies with real training and skills, like the FSB, are walking out with arm loads of top secret stuff every day.
that the data files are indeed genuine. Cisco may have known about this for years, maybe not, who cares? Fact is, Cisco has confirmed that the exploits relating to them are genuine.
This convinces me that Linus' rather blase' attitude towards security needs to be readdressed. Linux is the most widely-used Open Source OS for DIY and newcomer switch/router/firewall vendors. Linux can pretty much chown the market, if it can be reliably secured. OpenBSD is the next potential OS, but it's slower and the Book of PF simply doesn't go into the kind of details that Linux' Netfilter books do.
I can't begin to take people seriously who talk about security if they don't get the basic gist that in order to build a secure system you must release the complete set of corresponding source code. Security is not something you can just bolt on after the fact. You don't get security simply by releasing the code. But without it you can't design a secure system. This is why all Intel and AMD systems are fundamentally flawed. We don't have the complete set of source code to critical secondary processors which have complete access to everything else. And what does the code on these secondary processors do? They include a lot of bloat including remote control functionality. It's not a secret. It's a back door in plane sight. They make it really easy to write off the back door as a feature, but it's clearly not to anybody who has even a remote understanding of the dangers here. You can't disable it. You can't design a system without it. You're simply screwed if the a high legal intelligence agency wants access to your computer and they haven't got some other means of obtaining said monitoring. It's not something that is going to be used lightly- because they it would become apparent. No. They'll utilize other tools for mass-spying. But for those that actually utilize GPG and similar it's a serious security threat.
Does anyone here really believe this cyber bullshit?
Yes, yes I do.
Rationale being: "Government is inept at best and criminal at worst. A happy medium is they being criminally inept. NSA is a Government agency, ergo all the batshit insane ineptness that infects the Government also infects the NSA"
So yes, I believe the NSA got owned, and now begins the rearranging of deckchairs. A few people will be fired or otherwise disposed of, new techniques and tools will be developed, and life will be back to its nefarious normality again.
But for now, grab your bacon, popcorn and intoxicant of choice, sit back and watch! This may be the best damn show of our age!
(or it may be a brilliant piece of mis-direction, which would not make it any less real, just thornier and harder to decipher)
The "Civilized World" jumped the shark ca. 1973.
The auction is just to humiliate the US and the NSA. Looking at the file dates it seems likely this data was extracted back in 2013 and presumably the exploits have been in use since then. For political reasons they have decided to go public now.
The auction is just to give a bit of cover and extra embarrassment that common criminals in it for the money, rather than another nation state, were able to hack the NSA.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Because their network is working, they don't need new features and they either don't have time, care or requirements to check security notes when they are released? "If it isn't broken, don't fix it" can be a powerful drug.