Slashdot Mirror
Cisco Patches 'ExtraBacon' Zero-day Exploit Leaked By NSA Hackers (dailydot.com)
Patrick O'Neill quotes a report from The Daily Dot: After a group of hackers stole and published a set of NSA cyberweapons earlier this week, the multibillion dollar tech firm Cisco is now updating its software to counter two potent leaked exploits that attack and take over crucial security software used to protect corporate and government networks. "Cisco immediately conducted a thorough investigation of the files released, and has identified two vulnerabilities affecting Cisco ASA devices that require customer attention," the company said in a statement. "On Aug. 17, 2016, we issued two Security Advisories, which deliver free software updates and workarounds where possible." The report adds: "An unknown group of hackers dubbed the Shadow Brokers posted cyberweapons stolen from the so-called Equation Group, the National Security Agency-linked outfit known as 'the most advanced' group of cyberwarriors in the internet's history. One of the cyberweapons posted was an exploit called ExtraBacon that can be used to attack Cisco Adaptive Security Appliance (ASA) software designed to protect corporate networks and data centers. 'ExtraBacon targets a particular firewall, Cisco ASA, running a particular version (8.x, up to 8.4), and you must have SNMP read access to it,' Khalil Sehnaoui, a Middle East-based cybersecurity specialist and founder of Krypton Security, told the Daily Dot. 'If run successfully, the exploit will enable the attacker to access the firewall without a valid username or password.' ExtraBacon was a zero-day exploit, Cisco confirmed. That means it was unknown to Cisco or its customers, leaving them open to attack by anyone who possessed the right tools."
Yeah, sure, because Cisco has never co-operated with any of the TLAs in the past.
But I support anything related to bacon
Lovely timing with their earnings report. Hope they don't need those 14K/20% of workforce employees now...
Seriously: Fuck Cisco. I hope their stock value plummets. I'm tired of this fucking fuckery.
I will take my damn extra bacon though, cause bacon.
In past posts on Slashdot, the idea that the government should have backdoors into various systems that would allegedly be used only for legitimate criminal investigations. The security experts poo-pooed the idea, saying that all manner of things would go wrong, and this appears to be the day of reckoning. The government of course claims that this would never be a problem.
Security researchers 1, NSA 0
Is anybody here really surprised?
Yes I do believe it. Snowden was no super spy. He was a mid level IT grunt and he took everything including their lunch money. That means that spies with real training and skills, like the FSB, are walking out with arm loads of top secret stuff every day.
NSA _and_ Russians had access to to all thus firewalled networks for 3 years... Should Cisco and it's customers start lawyering up?
that the data files are indeed genuine. Cisco may have known about this for years, maybe not, who cares? Fact is, Cisco has confirmed that the exploits relating to them are genuine.
This convinces me that Linus' rather blase' attitude towards security needs to be readdressed. Linux is the most widely-used Open Source OS for DIY and newcomer switch/router/firewall vendors. Linux can pretty much chown the market, if it can be reliably secured. OpenBSD is the next potential OS, but it's slower and the Book of PF simply doesn't go into the kind of details that Linux' Netfilter books do.
I can't begin to take people seriously who talk about security if they don't get the basic gist that in order to build a secure system you must release the complete set of corresponding source code. Security is not something you can just bolt on after the fact. You don't get security simply by releasing the code. But without it you can't design a secure system. This is why all Intel and AMD systems are fundamentally flawed. We don't have the complete set of source code to critical secondary processors which have complete access to everything else. And what does the code on these secondary processors do? They include a lot of bloat including remote control functionality. It's not a secret. It's a back door in plane sight. They make it really easy to write off the back door as a feature, but it's clearly not to anybody who has even a remote understanding of the dangers here. You can't disable it. You can't design a system without it. You're simply screwed if the a high legal intelligence agency wants access to your computer and they haven't got some other means of obtaining said monitoring. It's not something that is going to be used lightly- because they it would become apparent. No. They'll utilize other tools for mass-spying. But for those that actually utilize GPG and similar it's a serious security threat.
Does anyone here really believe this cyber bullshit?
Yes, yes I do.
Rationale being: "Government is inept at best and criminal at worst. A happy medium is they being criminally inept. NSA is a Government agency, ergo all the batshit insane ineptness that infects the Government also infects the NSA"
So yes, I believe the NSA got owned, and now begins the rearranging of deckchairs. A few people will be fired or otherwise disposed of, new techniques and tools will be developed, and life will be back to its nefarious normality again.
But for now, grab your bacon, popcorn and intoxicant of choice, sit back and watch! This may be the best damn show of our age!
(or it may be a brilliant piece of mis-direction, which would not make it any less real, just thornier and harder to decipher)
The "Civilized World" jumped the shark ca. 1973.
Does anybody know what's going on with that auction? Because it seems now that those crazy hackers do have some serious goods on them...
It's funny how fast this can become this.
This thing of the government being inept, have you seen private bureaucracies at work?
Big corporate bureaucracies are as inept most of the time as state bureaucracies. The moment you have an organization with more than 100 people and company policies or laws start to encroach and accumulate to prevent abuses or set preferred policies then as time goes by you'll see a mismatch between desired outcomes and real outcomes.
Now, the problem is that at this point incremental improvements in productivity, technology or administration require ever more resources to be accomplished, this means that big bureaucratic tend to be the norm in both private and state organizations.
The exploit is specific to ASA software versions 8.0 - 8.4
8.5 was released in March of 2012.
The current version of ASA software is 9.6
http://www.cisco.com/c/en/us/t...
Why would anybody still be running 8.0 - 8.4 ??
"Who but the NSA or possibly GCHQ would produce this" How about the FSB, Mossad, MSS, ISI, or DSG for starters?
Interesting note: There are no frontpage articles about NSA hack among major American news outlets. It is/was on BBC, Guardian, etc. But not on CNN, WSJ, NYtimes...
Hmmm....