Slashdot Mirror
Cisco Removes Backdoor Account, Fourth Incident in the Last Four Months (bleepingcomputer.com)
For the fourth time this year, Cisco has removed hardcoded credentials that were left inside one of its products, which an attacker could have exploited to gain access to devices and inherently to customer networks. From a report: This time around, the hardcoded password was found in Cisco's Wide Area Application Services (WAAS), which is a software package that runs on Cisco hardware that can optimize WAN traffic management. This backdoor mechanism (CVE-2018-0329) was in the form of a hardcoded, read-only SNMP community string in the configuration file of the SNMP daemon. SNMP stands for Simple Network Management Protocol, an Internet protocol for collecting data about and from remote devices. The community string was there so SNMP servers knowing the string's value could connect to the remote Cisco device and gather statistics and system information about it.
...fool me four times, I still won't get fired for buying Cisco?
Ezekiel 23:20
They aren't an excuse for eating bagels.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
The string is probably "public."
Don't worry, I'm sure they added two more pursuant to the direction of The Man, with authority under an order issued by the [REDACTED] Court (which totally doesn't exist, promise).
Cisco RedRoof Inn, "We'll always leave the backdoor in for ya."
Certainly these types of things would be picked up by the rigorous and extensive code audit that all firmware at Cisco must undergo before being RTM right?
Is it good that there were backdoors in the products? Of course not. But a rash of these sort of incidents being reported in a short time isn't a bad thing, it means someone is reviewing, cleaning house, and being transparent about it which is actually a good sign going forward. This kind of thing isn't a reason to dump a company or service it's more like six months ago you should have dumped them and didn't know it but now they are actually stepping up and whoever you switch to might be hiding all kinds of skeletons.
I thought everything had an open read-only account for getting SNMP data. I've used them on all kinds of equipment and didn't think it was a problem.
Cisco needs to get serious about making its hardcoded back doors less easy to find.
I'll see your senator, and I'll raise you two judges.
Backdoors are for friends and family.
Crooks need a hardcoded window entrance.
I learned backdoor are stupids ~20 years ago when Id Software put a backdoor in Quake. http://insecure.org/sploits/qu...
probably seineeWerAsreenignErepinuJ
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
We don't need Russian or Chinese companies to open Americans' devices to foreign governments, Cisco is doing a good job by themselves.
Two wrongs don't make a right, but 3 lefts do - Lew of GO magazine
or their statements on cyber-security investigations where they claim Russia, China or North Korea hacked someone, or any of their hardware.
They don't just "forget" credentials and doors in their products, they put them all in there to give Gov access, and whenever they're caught they just remove one door, and put in another.
And yet it is Kaspersky that is banned?
All I hear is developers use the same defense as the Nazis did. "Nein! I vas just following mein orders."
It was a poor excuse then, and it's a poor excuse now.
I have already quit my job instead of doing something unethical (and was almost blackballed). What's your excuse, you pathetic, cowardly developers?
PS. Your Yiddish/German is horrible. It's "spiel", not "schpeel". Of course, since you are a self-professed developer (and probably a goyishe kop) this is to be expected..
That's exactly the problem. They are laying off good engineers and keeping developers.
Maybe that's why the Government Lab I work at switched to Juniper a few years ago.