Slashdot Mirror
How Cisco Fixed An Undocumented SSH Support Tunnel In Umbrella (umbrella.com)
"Vulnerability due to always-on SSH Tunnel -- RESOLVED" reads a Cisco service update. An anonymous reader writes:
Described by a recent security blog post, Cisco hid a SSH backdoor in its Cisco Umbrella product, which they were using for support. Affected organizations can install version 2.1.0 of their virtual appliance which has the backdoor removed.
Cisco has described Umbrella as "the first Secure Internet Gateway in the cloud," though the now-closed tunnel "auto-initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters." Cisco adds that it "did not require explicit customer approval before establishment." Access to the terminating server required valid keys and was provided only to privileged support personnel within the Cisco Umbrella network space. Customers could prevent this tunnel from getting established by blocking the relevant firewall ports. However, in the case of customers who allowed establishment of the tunnel, an attacker who obtained access to the internal Cisco terminating server could use the SSH tunnel as a backdoor to obtain full control of the VA device at the customer's premises...
It is our policy that any undocumented methods of entry into your network devices be considered a vulnerability due to the potential risk of an attacker leveraging this tunnel to gain access to your network. While Cisco has NO indications that our remote support SSH hubs have ever been compromised, Cisco has made significant changes to the behavior of the remote support tunnel capability to further secure the feature...
To address this vulnerability, the Umbrella Virtual Appliance version 2.1.0 now requires explicit customer approval before an SSH tunnel from the VA to the Cisco terminating server can be established... . For additional security, customer is required to provide tunnel configuration parameters out-of-band to the Cisco support personnel before tunnel establishment.
Cisco has described Umbrella as "the first Secure Internet Gateway in the cloud," though the now-closed tunnel "auto-initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters." Cisco adds that it "did not require explicit customer approval before establishment." Access to the terminating server required valid keys and was provided only to privileged support personnel within the Cisco Umbrella network space. Customers could prevent this tunnel from getting established by blocking the relevant firewall ports. However, in the case of customers who allowed establishment of the tunnel, an attacker who obtained access to the internal Cisco terminating server could use the SSH tunnel as a backdoor to obtain full control of the VA device at the customer's premises...
It is our policy that any undocumented methods of entry into your network devices be considered a vulnerability due to the potential risk of an attacker leveraging this tunnel to gain access to your network. While Cisco has NO indications that our remote support SSH hubs have ever been compromised, Cisco has made significant changes to the behavior of the remote support tunnel capability to further secure the feature...
To address this vulnerability, the Umbrella Virtual Appliance version 2.1.0 now requires explicit customer approval before an SSH tunnel from the VA to the Cisco terminating server can be established... . For additional security, customer is required to provide tunnel configuration parameters out-of-band to the Cisco support personnel before tunnel establishment.
Don't worry, they will leave the undocumented NSA backdoor open!
Presumably the programmers who work there wrote a patch and applied it?
In the 'Resident Evil' movies, the big evil corporation that was responsible for destroying the world was called The Umbrella Corp.
Coincidence?
I think not.
before it's discovered and we're rightly accused of still inserting backdoors into our products. Do you care about the security of your networks? Then don't use American hardware and services.
So why do people keep trusting cisco for their security? Ive sat in some of their demo presentation and while their communication applications are fancy, they still have a track record of abusing their customers trust that just screams insecure.
fuck tones of people do it
I bet 70% of all support teams use dubious methods like this all the time.
but hey Has Cisco fixed the exploitable hardware issues with the c3000 series chips, which was reported here some time ago
"It is our policy that any undocumented methods of entry into your network devices be considered a vulnerability due to the potential risk of an attacker leveraging this tunnel to gain access to your network."
No, not a vulnerability. A failure of your product. Any further inclusion of it is a failure of your management.
... build a wall?
I think most of the world has stopped trusting Cisco, and America's dispicable nature for many months now.
As an outsider, it's still sad to see a once great country decend to the level of other despotic states like Nork, Russia, and Iran - but that's all America is now.
How did they do it? They took advantage of someone's desire for convenience over software freedom (and the practical security benefits one gains from software freedom) to sell them products and services with at least one backdoor.
Naturally, nobody should trust anything from Cisco regardless of how much they paid for it unless that program is free software (free to run, inspect, share, and modify) because that means one's software freedom is respected. But Cisco isn't the only problem organization here, all software proprietors are just as untrustworthy. I know I've posted a lot about this, but blame /. for pointing readers to the same theme of story again and again: Proprietary software (such as Cisco's Umbrella product) simply can't be trusted. Neither can anything configured in them or output from proprietary software. Logs, filters, anti-malware code, etc. are all untrusted once you know they come from a non-free program precisely because you don't know what that program is doing while it ostensibly does what it's advertised to do. When you don't know how much information is left out, and you are not permitted to inspect or modify the program to do what you want it to do, you are at the mercy of those who know its true power (the proprietor) just as Cisco's clients were subject to Cisco's use of this backdoor (and anyone else Cisco decided to let in on the backdoor).
This untrustworthiness extends to the announced "resolution" ("Vulnerability due to always-on SSH Tunnel -- RESOLVED") as well. For all we know a newer more stealthy vulnerability was introduced to replace the old one. Thus the functionality this tunnel provided isn't really gone, it's just changed. And the untrustworthiness remains.
Digital Citizen
to exploit the potential exploit. If the device is a tunnel initiator only (can't be connected to), then taking advantage of it requires hacking into Cisco and taking over one of their terminating servers. If you can get that far into Cisco, why stop at waiting for Umbrellas to connect?