Slashdot Mirror
A Fifth Undocumented Cisco Backdoor Has Been Discovered (bleepingcomputer.com)
Cisco released 25 security updates Wednesday, including a critical patch removing an undocumented password for "root" accounts of Cisco Policy Suite (sold to ISPs and large corporate clients). "The vulnerability received a rare severity score of 9.8 out of a maximum of 10 on the CVSSv3 scale," reports Bleeping Computer.
An anonymous reader quotes Tom's Hardware: Over the past few months, not one, not two, but five different backdoors joined the list of security flaws in Cisco routers.... In March, a hardcoded account with the username "cisco" was revealed. The backdoor would have allowed attackers to access over 8.5 million Cisco routers and switches remotely. That same month, another hardcoded password was found for Cisco's Prime Collaboration Provisioning software, which is used for remote installation of Cisco's video and voice products. Later this May, Cisco found another undocumented backdoor account in Cisco's Digital Network Architecture Center, used by enterprises for the provisioning of devices across a network. In June, yet another backdoor account was found in Cisco's Wide Area Application Services, a software tool for Wide Area Network traffic optimization...
Whether or not the backdoor accounts were created in error, Cisco will need to put an end to them before this lack of care for security starts to affect its business.
An anonymous reader quotes Tom's Hardware: Over the past few months, not one, not two, but five different backdoors joined the list of security flaws in Cisco routers.... In March, a hardcoded account with the username "cisco" was revealed. The backdoor would have allowed attackers to access over 8.5 million Cisco routers and switches remotely. That same month, another hardcoded password was found for Cisco's Prime Collaboration Provisioning software, which is used for remote installation of Cisco's video and voice products. Later this May, Cisco found another undocumented backdoor account in Cisco's Digital Network Architecture Center, used by enterprises for the provisioning of devices across a network. In June, yet another backdoor account was found in Cisco's Wide Area Application Services, a software tool for Wide Area Network traffic optimization...
Whether or not the backdoor accounts were created in error, Cisco will need to put an end to them before this lack of care for security starts to affect its business.
Phew...at least itâ(TM)s only a 9.8, you know it could have been a 10
How is it possible that Cisco gets away with this? $200 billion market cap.
Why would Cicso have to put an end to it? Nobody in their right mind would touch Cisco products anymore. Let 'em swing by their own backdoors.
...bwahahahahaha!!!! get y'all some more of them freedom fries...
How do you get a 10? No password?
... back across the border.
BUILD THAT (fire)Wall!!!
It little behooves the best of us to comment on the rest of us.
it's littered with back doors, and the manufacturer just pretends they have no idea how it got there, like they're fixing "bugs" and making it all better.
Fact of the matter is that there will always be back doors in Cisco, Juniper, Dell, etc. equipment, because that's the way Big Gov wants it.
If you purchase American comm equipment then you're letting their psychopath government into your systems.
Cisco's Password Collaboration Provisioning software
It must have been something you assimilated. . . .
Love you bb
And get the links to the advisories, not to your favourite crap copy/paste regurgitator.
Adding more links to your previous crap postings on slashdot doesn't help much. GET THE ORIGINALS.
We’re going to FIVE backdoors.
#DeleteChrome
Most of these came from a massive code review Cisco has been doing through their entire software codebase, which across all their products is truly massive. They found a good number of flaws, and honestly these backdoor accounts mostly look like debugging features left in inadvertently.
If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
The routers are 1st vector attack, after, the computers.
"God Bless America"
was invented from false and unknown prophet.
"America must bless Jesus, son of God and Mary"
is invented by me.
1) Cisco inherited the backdoors as they've bought product lines instead of creating them. Cisco is now in the merger business, not the engineering business
2) malicious actors inside or outside the company are exploiting a weak security environment
3) The competent cisco engineers left and now they really are just incompetent.
My guess is a combination of 1) and 3), but I sure wouldn't discount this as a deliberate campaign by a malicious state actor to gain control of the internet.
At some point you have to start wondering if CISCO is just incompetent to have all the flaws, or if they are left in there on purpose so that people (governments) can access all this infrastructure whenever they want.
I wonder if any of these back doors were created at the Request of a TLA.
I wonder if a 'too good' security patch will blind them.
I just wonder about ALL those back doors.
They can't be that sloppy, can they?
If two people have consensual sex in private, then it's their business and no one else's.
user : NSA Password : password
As a person that works a provisioning, VPN, and remote setup, this really complicates my life. This was the last backdoor I had to all the CISCO gear. If anyone knows of another backdoor, could you please message me. What a pain, not customers are going to have to give me their password.
Undocumented my rear end... Now that it's known it's now DOCUMENTED!!!!
$100 on these back-doors were govt mandated access
A Fifth Undocumented Cisco Backdoor...
Cisco has been allowing undocumented immigrants into the country?! Oh my!
Incipiamus, fratres, servire Domino Deo, quia hucusque vix vel parum in nullo profecimus.
Cisco's stock isn't in the toilet for reasons which aren't immediately apparent.
Requiem for the American Dream
How the hell can a company that acts all serious have flaws like this?
I'm no conspiracy theorist, but IMHO the only way obvious things like these didn't get caught in code review or QA is that these backdoors are there on purpose.
Or can anyone come up with a legitimate excuse for this?
I've got more trust in Amazon than Cisco...
Then claim the janitor did the code.
OK, I'm not sure if some folks are serious here, or joking, but backdoors in software and firmware ALWAYS exist, and are quite necessary for troubleshooting; when you have gear deployed all over the world, and have to maintain/troubleshoot/update that gear you will in fact use backdoors for access. It's not practical or reasonable to be trying to obtain end user passwords, and god forbid local passwords run amock, you're damn glad you have backdoors available. However, the idea that a backdoor could ever be accidentally sleuthed is also silly; any backdoor I ever implemented was a multi-step sequence; far more than just a single username and password. I typically did a three-level sequence, including time delays and in some cases real-time clock coordination to validate and open a back-door entry. I'll stop there, but I was involved in both DOD and DOE software and firmware development and NEVER EVER NEVER put equipment in the field without a backdoor entry available. What I don't understand is why some flunkie source code reviewers decided to void these; although it also sounds like some of these backdoors were far too simplistic. For most hardware, we implemented backdoors that not only involved keyed entries, but also included hardware inputs, thus requiring someone with proper credentials to be co-located with the hardware.
So this is the code review that apparently led to releasing so many backdoors up to this point.
The only code review that means anything is the one that comes from the computer's owner or someone the computer owner trusts, not a proprietor's claim to users or media. The only way to implement what computer owners need is to use free software for all of their computer's software without exceptions.
Digital Citizen
How about we all stop kidding ourselves, the 'undocumented password' were put in therre at the behest of the NSA.
So why buy one????
- your friendly neighborhood terrorist
Its just pathetic to see what the userbase of /. has turned into over the years. Fuck trump, putin, politics on /., and you.
I've never been a fan of Cisco, Microsoft, or "corporate tech giants".
Most of the systems engineering people in my generation (the old guys) can build routers. Give them a PC or a chassis, Linux or BSD, and in an hour it will be a router with security features that can be used to keep data safe.
But corporate America seems to like appliances. I can understand it for multiport bridges (that's a switch for you young people). But for routing and security an appliance seems a bad idea because of planned obsolescence and closed nature of the architectures..
Plus... when you buy a security or routing appliance... you only know what the manufacturer tells you about it- and "certified" people only know how to configure it while sometimes having an alarming lack of understanding TCP/IP.
In my view trading knowledge for cost savings is a big issue. Sure there's a balance sheet advantage to buying appliances and perhaps using certified contractors to run them. But the cost comes up when a failure comes up requiring real know-how.
Heck- I know of one company that is on their third revision of warehouse WIFI because none of the people they brought in understand microwave radio in an environment with a great deal of RF reflective metal. They know to use LMR600 cabling because Cisco specs it. But they do not know why. And they do not analyze how the tech will actually be used. So every revision of the network design performs badly.
That's just one example. But it's rife in the industry. So much so that I moved into industrial programming because so few people are doing it and there's a high demand in my area. And they still care about "knowledge"... especially when it comes to programming old industrial systems with new safety controls.
So when I hear about back doors in commercial products, I ask the same question: does trading knowledge for appliances actually make a business work better?
Shouldn't the people running the network actually know how it works and what's on the network?
The MBAs say no.
Another consultant who stuck it out.
"We are the Priests, of the Temples of Syrinx..."
Since Cisco developed its first multiprotocol router it has had no fewer than 350 US-CERT vulnerablilities recorded against it for hard coded credentials. It hasn't learned anything in all this time and, sadly, it doesn't seem to have any real effect on its business.
If a root backdoor to such equipment merits a 9.8, what does a 10.0 entails? An ominous countdown and a BOOM?
... that the parents of the Southpark children wanted to get back so eagerly in https://en.wikipedia.org/wiki/... (it is called "Backdoor Sluts 9").
Just buy Huawai or ZTE, there, only the one backdoor from the chinese government is built-in.
The chinese shit has open FRONT DOORs. This American kit has a back door so much, much, much safer and perfectly fine if you know what you are doing and don't let chinese shit in your network. Buy AMERICAN to be safe. To remain safe. To alwaya be SAFE.
You know with German products that sort of thing would never happen...
Because people that are busy expressing themselves and their potential find no need to control or spy on others.
But the USA won the war so...
Ever since Cisco cut corners, make more money for their suit's(over lords), and just fuck everyone they could this crap has been popping up.
In inclusion of Indian Eyes and teeth, and Asian Ming Bai, is a clear indicator of this tom foolery at our expense the client, customer, consumer.
Grab the money and get out as quickly as possible. Hopefully the individuals covering this up or purporting this behavior are long gone, money in hand, laughing at the Bullshit that Cisco allowed them to do for the $
It's morons like you that perpetuate a lie. Did you forget ALL the collusion with the Clintons? Or the fact that she gave them 1/5th of our Uranium? Or that Bubba was doing speaking engagements for half a million dollars. Or let's not even look at "Nobody's President"...let's look at Obama, that spear-chuckin' Kenyan said, ON CAMERA that he was going to be doing more maneuvering for Russia in his second term. Until you can admit to the wrongs of that, yet provide ZERO evidence for Trump's wrong doings, just zip it. You are intellectually disingenuous.
There are 2 groups of people you can make fun of on the Internet without fear of attack. The illiterate, and the Amish.
and I agree with you. This /. has turned into a bunch of little ANTIFA wanna be's. Fuck Trump is easier to say than, "I'm really really really disappointed that Hillary won, because I'm a hardcore liberal and I have no defensible argument, so I'll spend the next 8 years throwing a fit"
There are 2 groups of people you can make fun of on the Internet without fear of attack. The illiterate, and the Amish.
Pot, meet kettle.
You let him have an epilepsy attack for 4 hours and didn't call for help. LOL.
A good lawyer could get you for manslaughter.
This is true information. Facts.
I went to a tech college and after graduating my next steps were to get my A+, MCSE and CCNA. That's when I started getting into Linux and open source software in general. I swayed from getting my certs (I'm an independent tech consultant now) and I'm really glad I did. I know there aren't many FOSS alternatives to Cisco/Juniper equipment but if I spent all that time learning the ins and outs of Cisco proprietary equipment, I would have felt it was a big waste of time knowing that, after all my trying to secure things, there's a fucking backdoor (x5) in their stuff. Makes me sick.
It is pitch black. You are likely to be eaten by a grue.
"Cisco will need to put an end to them before this lack of care for security starts to affect its business."
doesn't matter, it will not impact their business one bit. enterprises just don't care about this, cisco is not even the worst offender.
they're not going to sell one less router because of this. companies like ex. oracle screw you in the ass so many times, over and over again. they're still as strong as ever.
NSA compliant?
I'm studying for the CCNA and the IOS is designed by morons. Can't show anything while in config mode. Good on them for tab completion but no tab to show possible commands. It would be easy to overtake Cisco as the number one networking company because Cisco just does not care.