Cisco Systems Will Be Auditing Their Code For Backdoors (cisco.com) 128
An anonymous reader writes: In the wake of the discovery of two backdoors on Juniper's NetScreen firewall devices, Cisco Systems has announced that they will be reviewing the software running on their devices, just in case. Anthony Grieco, a Senior Director of the Security and Trust Organization at Cisco, made sure to first point out that the popular networking equipment manufacturer has a "no backdoor" policy.
According to Grieco, Although our normal practices should detect unauthorized software, we recognize that no process can eliminate all risk. Our additional review includes penetration testing and code reviews by engineers with deep networking and cryptography experience. The reviewers will be looking for backdoors, hardcoded or undocumented account credentials, covert communication channels and undocumented traffic diversions.
You mean (Score:5, Insightful)
They havent been already?
Re: (Score:3)
I think this is what bothers me more than anything.
Re: (Score:3, Insightful)
They also need to check if any the employee's with code change privileges have been getting outside bonus's from the NSA.
Re: (Score:2)
No, time and again their products have exploits that had fixes for a long time. No one should use cisco products, they aren't secure.
Re:You mean (Score:5, Insightful)
No, time and again their products have exploits that had fixes for a long time. No one should use cisco products, they aren't secure.
You're an idiot. If you're a Carrier network or large Enterprise, you have two options- Juniper or Cisco. Nobody else makes hardware that even comes close when you're talking routing and switching. IF Cisco (or Juniper) were as insecure as you claim, the entire internet would have been completely owned long ago.
Yes, there have been issues at times with various specific product lines. But neither Cisco's primary IOS nor Juniper's Junos have ever had a large-scale issue in regards to security, and what issues have shown up over the years have been simple to mitigate or render moot, and are fixed quickly... usually long before the media ever gets wind of it. Most of the problems show up in the crappier low-end product lines, or platforms that are already end of life.
There's no good reason you should even have the device's management interface directly exposed to the public internet. Period. If you want to be able to remotely manage your equipment, you setup a VPN which will then give access to your internal, privately addressed (i.e. not publicly routable) management network, and access the equipment from the inside. You should ***NEVER*** be able to directly open a connection, either via SSH or any other method, from the 'wild' internet... it's just flat out stupid even if there are no flaws in your equipment.
Re: (Score:3)
A bit of an exaggeration, but reasonably correct.
I think at this point we have to accept that the entire Internet being owned is a fact, and probably has been since the first
Re: You mean (Score:1)
Re: (Score:2)
A) Huwawei and a few others make similar equipment. Much of the backbone in Japan runs on NEC routers, for example.
B) The internet was owned by the NSA/GCHQ exploiting zero day bugs and backdoors, or simply intercepting Cisco gear and installing malware before it got to the customer.
Re: (Score:2)
You are the idiot, you yourself mentioned one alternative to Cisco and there is more than Juniper
plenty of remote exploits, non-management interface, have existed. google it and look at the massive volume of pages returned.
Re: (Score:1)
If you're a Carrier network or large Enterprise, you have two options- Juniper or Cisco. Nobody else makes hardware that even comes close when you're talking routing and switching.
Cisco has the market in the enterprise, but the service provider space is a bit more competitive, simply because service providers generally don't like to single source major components to their core business. Many are now looking into white box configurations with SDN.
There's no good reason you should even have the device's management interface directly exposed to the public internet.
Many times the management interface of a routing device are not used in leu of a management IP address on a software loopback interface. This is so the device is reachable in the event of a link failure, because the management address is asso
Re: (Score:2)
There may often not be a choice. However, it is not smart to trust their hardware, so you need firewalls and/or passive monitoring equipment that you do trust. Sniffing passively for connections to your firewall that should not be there is not even hard. (Of course, only very few people do that, as it costs money...)
Re: (Score:3)
Security analysis is a long and tedious process performed by specialists. Is it really any wonder that so few projects have it done?
Re: (Score:2)
In relation to the assets protected, it usually is peanuts. My guess is it is so rare because they do not want to look, as that could bring negative press, a need to "do something", and maybe (depending what agreements they have with the NSA, Russian intelligence, Chinese intelligence, GCHQ, etc.) even a need to hide a new set of backdoors a lot better.
Re: (Score:3)
In relation to the assets protected
That requires long-term thinking.
My guess is it is so rare because they do not ...
want to spend the money. I've been in the computer world -- first as a programmer, and then as a DBA -- for 25+ years, mostly for Very Large Businesses, and there's one undeniable truth: bean counters rule the roost.
Re: (Score:3)
Cisco systems will pretend to audit their firmware for backdoors -- while simultaneously be reaching behind them for their NSA/CIA/FBI payout for their 'services to their Country'
Re: (Score:1)
Allow me to translate:
Cisco systems will pretend to audit their firmware for backdoors -- while simultaneously be reaching behind them for their NSA/CIA/FBI payout for their 'services to their Country'
EXACTLY what I came here to say.
Re: You mean (Score:1)
Re: (Score:2)
That depends. If they think they can get away with it, they will have somebody corrupt do the audit. That is then one security company with a potential reputation problem. But exactly because of that effect, they may actually not be able to get anybody both reputable and corrupt.
Of course, if they do it in-house, the worth of the results is exactly zero.
Re: (Score:1)
What, precisely, DO they have to do before you're satisfied?
Well, they can start with that tongue thing between my nutsack and inner thigh and we'll figure it out from there.
Err... I have some bad memories associated with Cisco. Then I found Juniper. Now, I don't do jack shit any more but Juniper was pretty good for my company. Cisco kit was like twice as expensive - or more. I was able to sell the used kit and make back much of what I'd spent on the *upgrade* to Juniper.
So yeah, Cisco and lick my taint too, seeing as they're down there.
Hmm... I need to see a therap
Re: (Score:2)
What, precisely, DO they have to do before you're satisfied?
No one likely will see this, but I'll say it anyway: They could go completely open-source with their firmware, allowing anyone and everyone to examine it, and compile it, compare the resulting binary to what's shipped on a device, and allowing the meticulous, cautious types to compile and upload the resulting binaries to their devices, ensuring that there aren't any backdoors in the code. It would also allow 3rd parties to fix any bugs themselves, if they so choose, to their own satisfaction. In a word: Tra
Re: (Score:2)
I am sure they have but now they have a pattern to look for.
Re:You mean (Score:4, Funny)
Re: (Score:2)
Naaa, they may have found something. You know, like Juniper did. It is only now after Juniper did the right thing, that Cisco feels compelled to do so too. I am sure they would have avoided it if they saw some way to do that. I am also sure they will try hard to not find anything, if at all possible without breaking credibility completely.
Let's not (Score:1)
and say we did. It's apparent by now that Cisco will do what the NSA tell them to. This is just about saving face, and more importantly, saving that sweet revenue.
Re: (Score:2)
Re: (Score:2)
Simple. To make it look like they're doing something about it. NSLs ensure backdoor cooperation.
Re: (Score:2)
A NSL can only require that you deliver information in their possession; if other demands are made, then they are unlawful.
There is no law that allows compelling the manufacturer of a device to add any surveillance feature.
Re: (Score:2)
Tell that to the CEO of QWEST.
Re: (Score:1)
The same cisco that immediately changed their shipping routines after the NSA leaks? The same cisco that's setting up pentesting sites so customers can come analyze their devices before they deploy them? I think you said Cisco but meant to say Apple.
Where is the proof that Apple has been in cahoots with the NSA/CIA, etc?
I think you said Apple, but meant Lenovo and HP.
Re: (Score:2)
The same Cisco that keeps getting pwned hard.
Cisco hasn't rocked the boat on this. I don't know why you brought up Apple- what did they do wrong?
The backdoors here are shocking. At this point, you're better off buying your network hardware from foreigners- or really, you're better off pushing everything through two or more stages, each under a different jurisdiction of manufacture, so that someone would have to know at least more than ONE backdoor.
One this is certain- given how the Juniper patch just reen
Re: (Score:2)
As opposed to a what? A muslim run corporation? An atheist one? Belief in the supernatural has little to do with corporate behavior.
Re: (Score:2)
Belief in crazy shit rarely makes things better.
Re: (Score:2)
i think testing cisco equipment for surreptitious traffic when you have only cisco equipment (in a cisco lab) listening down the line will yield no results. a few bits here and there to tag the nsa traffic and the backdoored firmware in routers down the line will simply not increase any counters.
the way to do it is to have a chain of cisco/juniper and huawei routers. huawei will notice traffic headed for nsa, cisco/juniper will notice the chinese backdoor. unless the two are in bed with each other.
Re: (Score:2, Insightful)
Sure, until the NSA hands the CIO a NSL prohibitting him from announcing the new backdoor they've been required to install. (and the same goes for Juniper and PaloAlto and anyone else with an office in the U.S.)
Re: (Score:2)
Don't you mean the *CSA* (ie, the Chinese Security Agency) and not the NSA? Juniper code was infected in China. Cisco has development in China also.
Re: (Score:2)
Sure: http://www.theregister.co.uk/2... [theregister.co.uk]
Just as reliable a source as all those who attribute the code to the NSA.
More reliable IMHO. NetScreen founded by Chinese nationals, sustaining engineering has been done in China.
Re: (Score:2)
looking up 2nd opinions on alphabet.com (Score:1)
history repealing itself continues... https://www.youtube.com/watch?v=sjgRbI7yQCI ..read the teepeeleaks etchings,, we're the natives now...
Makes a good case... (Score:2)
For never ever putting an 'appliance' directly on the internet. Particularly when it comes to closed source. It's attractive to think you can get something ready to roll specific to your needs, but it also means putting a huge maintenance burden on the provider of that appliance, with a huge potential set of code that could be compromised, and a higher latency for getting fixes (some appliances need to wait for their image provider, who waits for a well-known distribution to publish, who might wait for u
Good PR I suppose (Score:5, Insightful)
But what happens if they DO actually find something? Will they reveal it? I am guessing not.
Re: Good PR I suppose (Score:2)
Re: (Score:2)
Yeah, Cisco would be one of the last companies I would trust, simply *because* their equipment is so ubiquitous. I am sure that three letter agencies have long ago co-opted Cisco.
This whole code audit thing is so much PR BS. Why make a big deal out of it? Shouldn't it be a standard internal practice that would normally never make anyone bat an eye?
It's like saying, "Oh hey, hello world! We are now implementing a policy review of our employee coffee service! Aren't you all amazed and astounded by how much we
Re: (Score:2)
Juniper revealed. Why should't Cisco?
Re: (Score:1)
Agreed. Stock prices would dip and shareholders would sue. This is nothing more than bullshit posturing. I'd even be willing to bet that whoever issued this statement has already been given walking papers. Just for the simple fact that the statement is implying due diligence and QC has not been done.
So what (Score:3)
Now they waste a lot of money for auditing, and if they really find something, I guess NSA will send them a gag order. Then cisco knows that they sell spyware, but what has changed for the customer? Nothing. Cisco will perhaps raise prices or deliver a less quality product because they wasted all that money with the audits. Well perhaps at least they will detect chinese backdoors if there are any. But my guess is that if china has placed backdoors, they place them in the silicon, because that's hard to detect or remove.
Re: (Score:2)
and if they really find something, I guess NSA will send them a gag order.
No need. They are only auditing for unauthorised code.
Thank goodness... (Score:5, Funny)
There, fixed that (Score:1)
Cisco Systems Will Be Auditing Their Code For _Unexpected_ Backdoors
Why we need access to the *complete* set of code (Score:5, Informative)
As one of the developers behind similar devices I can say we need access to the complete set of code and we don't have it. Even if Cisco does an audit they won't be able to ensure the complete set of code isn't back-doored. I work for a company that designs and manufactures routers, switches, and similar gear. There are at least a few bits which we don't have the complete sources for. For example all the devices with 802.11ac chips in them. If any one of these peices contain a backdoor we wouldn't know it. It is a major major security issue. Any number of parties besides the NSA might be backdooring *every* device and because there are nonly a very small handful of companies with the code for these pieces it is highly likely that all of our systems are backdoored. Desktops, laptops, tablets, and most routers. There are probably only a few exceptions to this where the complete set of sources are available. I'd suggest checking out www.librecmc.org for consumer routers as it's the only embedded distribution I can confirm is back-door free for those devices which are supported.
Re: (Score:2)
Even if Cisco does an audit they won't be able to ensure the complete set of code isn't back-doored.
While this is true, is that as big of a security risk? (yes, I realize that any security breach is a big deal, but I'm looking at the big picture here) If the chipmaker for the 802.11ac chips has a backdoor in it, then what can they gain access to? Can they control the entire device, or just that subset of the device? They might have access to the encrypted network traffic, but can they do anything with it? Also, wouldn't finding the dump of the data out of the network, or into the network be relatively
Re: (Score:2)
If you control a network interface, you can generally control the entire system, because those chipsets have DMA access to the internal memory of the rest of the computer. You may have to do some work to figure out how to find and corrupt the OS data structures, but you have access to everything.
If the owner of the system is very lucky, there'll be an IOMMU (without a back door) and the OS will have programmed that IOMMU to do something useful. But you can't rely on either, especially in embedded devices.
Al
Re: (Score:2)
Thank you for your insight. It is appreciated.
Re: (Score:2)
Considering Cisco makes its own ASICs, I'm fairly certain they have the schematics, including its wifi chipsets.
YOU can't audit the entire thing. That doesn't mean ${COMPANY} can't.
Re: (Score:2)
"There are at least a few bits which we don't have the complete sources for. For example all the devices with 802.11ac chips in them."
But you know how those bits interact with the rest of the router. What kind of permissions does the radio firmware have that could be used for nefarious purposes? Serious question. Would nefarious firmware be able to leak AES keys or wifi passwords? Or read/write memory in the router OS?
Re: (Score:2)
Nations have to buy their own domestic products, code on them and then work out cpu power, cooling, power needs and their own software.
Importing US installed trapdoors and backdoors over every generation of hardware and software is not going to help with any nations competitiveness or security.
5 eye + nations get a look into any network by default as shipped is not the best way to do compu
Re: (Score:2)
Excellent point. The only way besides full source and HW spec access I see, is treating things like the 802.11ac components as "hostile, likely compromised" in the system design. That makes things more expensive, of course.
But will they analyze the C compiler? (Score:4, Insightful)
And will it make a difference? [win.tue.nl]
Re: (Score:2)
Oh please. There's no reason to believe that anyone in their right mind would go to the effort of executing this attack when quite frankly it is demonstrably possible to infiltrate organisations, people and agencies using far easier means.
If CISCO software has backdoors it is probably hiding in plain sight with a procedure name like NSA_backdoor(); //don't forget comment me out.
Or maybe it was a bit hidden and called debug_testinterface();
Or at the very least if someone has made an effort to hide it it will
Re: (Score:3)
Or maybe it was a bit hidden and called debug_testinterface(); //don't forget comment me out.
That's exactly how the Juniper backdoor was compromised. The argument to the strcmp call is ..., which is the backdoor password, and was presumably chosen so that it would be mistaken for one of the many other debug format strings in the code.
Why would anyone go to the effort of compromising a compiler?
The NSA doesn't do HUMINT. Backdooring the C compiler is exactly the kind of thing they'ed do when these other channels of operation are closed.
Re: (Score:2)
exactly the kind of thing they'ed do when these other channels of operation are closed.
My exact point was that these channels of operations are not closed, not to the NSA, not to some rogue employee, not to some idiot who "forgets to disable debugging code" and as history has shown, not to some internet hackers who do it for the lulz.
Re: (Score:2)
Old news and outdated. The compiler backdoors can now be prevented: http://www.dwheeler.com/trusti... [dwheeler.com]
Re: (Score:2)
The compiler backdoors can now be prevented
Great. But is that technique actually implemented in the compiler(s) that Cisco uses?
Re: (Score:2)
Very, very unlikely. I am just pointing out that they could be secure against that threat if they chose so. Of course that costs money, hence they will not. In real-world capitalism, companies will produce the shoddiest quality they can get away with.
Re: (Score:2)
In real-world everywhere, companies will produce the shoddiest quality they can get away with.
Do you really think that communist Russia was or workers' paradise Cuba is that thorough with all their work?
Re: (Score:2)
Are you really dumb enough to assume anybody criticizing capitalism wants that version of socialism as alternative? That requires a really, really limited view of the world.
Re: (Score:2)
that version of socialism
What other kinds of socialism are there? Small, Homogeneous European Socialist Pseudo-utopias don't really scale up that well.
Re: (Score:2)
I rest my case regarding your stupidity.
Hint: There are other models for society. It takes a minumum of actual education to see that though.
We're auditing our code (Score:2)
Doesn't make sense.... (Score:1)
Isn't backdoor supposed to be something you did on purpose? Why would you even have to audit to know if there's a backdoor?
Re: (Score:2)
If there is such a thing, someone did it on purpose.
But it may well not have been Cisco.
Juniper found out it had backdoors they say they didn't put in. If you make a product which holds the keys to a lot of the internet, people are motivated to latch onto that.
That's it? (Score:2)
That's all they're looking for?
No *unauthorized* backdoor policy maybe (Score:1)
Cisco's code definitely includes back doors for legally authorized interception.
Auditing standards (Score:2)
What will their auditing standards be?
> Back doors should appear to be standard coding errors
> Find some obscure behavior in old and insecure crypto libraries, tie functions to that, use as excuse to not use up to date libraries
> Ensure random numbers use a predictable method in some NSA-known number of dimensions
> Use some Chinese words to make it look like we're the victims when the backdoor is discovered
> Implement hardware protection using chips that are not subject to less than multi mil
Re: (Score:2)
> This is all High Theatre,
> Good show old boy!
I don't think so. But I will say that such cynicism and paranoia was unthinkable five years ago, possible as a cautionary issue a year ago, and now seems unlikely but by no means crazy talk. Lame and scary.