Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Compare cell phone plans using Wirefly's innovative plan comparison tool ×
Security

Cisco Systems Will Be Auditing Their Code For Backdoors (cisco.com) 128

An anonymous reader writes: In the wake of the discovery of two backdoors on Juniper's NetScreen firewall devices, Cisco Systems has announced that they will be reviewing the software running on their devices, just in case. Anthony Grieco, a Senior Director of the Security and Trust Organization at Cisco, made sure to first point out that the popular networking equipment manufacturer has a "no backdoor" policy. According to Grieco, Although our normal practices should detect unauthorized software, we recognize that no process can eliminate all risk. Our additional review includes penetration testing and code reviews by engineers with deep networking and cryptography experience. The reviewers will be looking for backdoors, hardcoded or undocumented account credentials, covert communication channels and undocumented traffic diversions.
This discussion has been archived. No new comments can be posted.

Cisco Systems Will Be Auditing Their Code For Backdoors

Comments Filter:
  • You mean (Score:5, Insightful)

    by Anonymous Coward on Tuesday December 22, 2015 @12:00PM (#51165403)

    They havent been already?

    • I think this is what bothers me more than anything.

      • Re: (Score:3, Insightful)

        by davester666 ( 731373 )

        They also need to check if any the employee's with code change privileges have been getting outside bonus's from the NSA.

    • No, time and again their products have exploits that had fixes for a long time. No one should use cisco products, they aren't secure.

      • Re:You mean (Score:5, Insightful)

        by Anonymous Coward on Tuesday December 22, 2015 @04:35PM (#51167177)

        No, time and again their products have exploits that had fixes for a long time. No one should use cisco products, they aren't secure.

        You're an idiot. If you're a Carrier network or large Enterprise, you have two options- Juniper or Cisco. Nobody else makes hardware that even comes close when you're talking routing and switching. IF Cisco (or Juniper) were as insecure as you claim, the entire internet would have been completely owned long ago.

        Yes, there have been issues at times with various specific product lines. But neither Cisco's primary IOS nor Juniper's Junos have ever had a large-scale issue in regards to security, and what issues have shown up over the years have been simple to mitigate or render moot, and are fixed quickly... usually long before the media ever gets wind of it. Most of the problems show up in the crappier low-end product lines, or platforms that are already end of life.

        There's no good reason you should even have the device's management interface directly exposed to the public internet. Period. If you want to be able to remotely manage your equipment, you setup a VPN which will then give access to your internal, privately addressed (i.e. not publicly routable) management network, and access the equipment from the inside. You should ***NEVER*** be able to directly open a connection, either via SSH or any other method, from the 'wild' internet... it's just flat out stupid even if there are no flaws in your equipment.

        • by sphealey ( 2855 )

          = = = You're an idiot. If you're a Carrier network or large Enterprise, you have two options- Juniper or Cisco. Nobody else makes hardware that even comes close when you're talking routing and switching. = = =

          A bit of an exaggeration, but reasonably correct.

          = = =IF Cisco (or Juniper) were as insecure as you claim, the entire internet would have been completely owned long ago.= = =

          I think at this point we have to accept that the entire Internet being owned is a fact, and probably has been since the first

        • by AmiMoJo ( 196126 )

          A) Huwawei and a few others make similar equipment. Much of the backbone in Japan runs on NEC routers, for example.

          B) The internet was owned by the NSA/GCHQ exploiting zero day bugs and backdoors, or simply intercepting Cisco gear and installing malware before it got to the customer.

        • You are the idiot, you yourself mentioned one alternative to Cisco and there is more than Juniper

            plenty of remote exploits, non-management interface, have existed. google it and look at the massive volume of pages returned.

        • by xiux ( 1035790 )

          If you're a Carrier network or large Enterprise, you have two options- Juniper or Cisco. Nobody else makes hardware that even comes close when you're talking routing and switching.

          Cisco has the market in the enterprise, but the service provider space is a bit more competitive, simply because service providers generally don't like to single source major components to their core business. Many are now looking into white box configurations with SDN.

          There's no good reason you should even have the device's management interface directly exposed to the public internet.

          Many times the management interface of a routing device are not used in leu of a management IP address on a software loopback interface. This is so the device is reachable in the event of a link failure, because the management address is asso

      • by gweihir ( 88907 )

        There may often not be a choice. However, it is not smart to trust their hardware, so you need firewalls and/or passive monitoring equipment that you do trust. Sniffing passively for connections to your firewall that should not be there is not even hard. (Of course, only very few people do that, as it costs money...)

    • by Nutria ( 679911 )

      Security analysis is a long and tedious process performed by specialists. Is it really any wonder that so few projects have it done?

      • by gweihir ( 88907 )

        In relation to the assets protected, it usually is peanuts. My guess is it is so rare because they do not want to look, as that could bring negative press, a need to "do something", and maybe (depending what agreements they have with the NSA, Russian intelligence, Chinese intelligence, GCHQ, etc.) even a need to hide a new set of backdoors a lot better.

        • by Nutria ( 679911 )

          In relation to the assets protected

          That requires long-term thinking.

          My guess is it is so rare because they do not ...

          want to spend the money. I've been in the computer world -- first as a programmer, and then as a DBA -- for 25+ years, mostly for Very Large Businesses, and there's one undeniable truth: bean counters rule the roost.

    • Allow me to translate:

      Cisco systems will pretend to audit their firmware for backdoors -- while simultaneously be reaching behind them for their NSA/CIA/FBI payout for their 'services to their Country'

      • Allow me to translate:

        Cisco systems will pretend to audit their firmware for backdoors -- while simultaneously be reaching behind them for their NSA/CIA/FBI payout for their 'services to their Country'

        EXACTLY what I came here to say.

        • Too true. I have no faith in the cert authorities either. Time will tell all.
        • by gweihir ( 88907 )

          That depends. If they think they can get away with it, they will have somebody corrupt do the audit. That is then one security company with a potential reputation problem. But exactly because of that effect, they may actually not be able to get anybody both reputable and corrupt.

          Of course, if they do it in-house, the worth of the results is exactly zero.

    • by LWATCDR ( 28044 )

      I am sure they have but now they have a pattern to look for.

    • Re:You mean (Score:4, Funny)

      by fizzer06 ( 1500649 ) on Tuesday December 22, 2015 @05:46PM (#51167581)
      Up until now, they have been auditing their backdoor for code.
    • by gweihir ( 88907 )

      Naaa, they may have found something. You know, like Juniper did. It is only now after Juniper did the right thing, that Cisco feels compelled to do so too. I am sure they would have avoided it if they saw some way to do that. I am also sure they will try hard to not find anything, if at all possible without breaking credibility completely.

  • by Anonymous Coward

    and say we did. It's apparent by now that Cisco will do what the NSA tell them to. This is just about saving face, and more importantly, saving that sweet revenue.

    • The same cisco that immediately changed their shipping routines after the NSA leaks? The same cisco that's setting up pentesting sites so customers can come analyze their devices before they deploy them? I think you said Cisco but meant to say Apple.
      • by epyT-R ( 613989 )

        Simple. To make it look like they're doing something about it. NSLs ensure backdoor cooperation.

        • by mysidia ( 191772 )

          A NSL can only require that you deliver information in their possession; if other demands are made, then they are unlawful.

          There is no law that allows compelling the manufacturer of a device to add any surveillance feature.

          • by sphealey ( 2855 )

            = = = if other demands are made, then they are unlawful = = =

            Tell that to the CEO of QWEST.

      • The same cisco that immediately changed their shipping routines after the NSA leaks? The same cisco that's setting up pentesting sites so customers can come analyze their devices before they deploy them? I think you said Cisco but meant to say Apple.

        Where is the proof that Apple has been in cahoots with the NSA/CIA, etc?

        I think you said Apple, but meant Lenovo and HP.

      • by cfalcon ( 779563 )

        The same Cisco that keeps getting pwned hard.

        Cisco hasn't rocked the boat on this. I don't know why you brought up Apple- what did they do wrong?

        The backdoors here are shocking. At this point, you're better off buying your network hardware from foreigners- or really, you're better off pushing everything through two or more stages, each under a different jurisdiction of manufacture, so that someone would have to know at least more than ONE backdoor.

        One this is certain- given how the Juniper patch just reen

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Sure, until the NSA hands the CIO a NSL prohibitting him from announcing the new backdoor they've been required to install. (and the same goes for Juniper and PaloAlto and anyone else with an office in the U.S.)

    • Don't you mean the *CSA* (ie, the Chinese Security Agency) and not the NSA? Juniper code was infected in China. Cisco has development in China also.

    • by jon3k ( 691256 )
      If that were true then the TAO wouldn't have had to intercept routers during shipment to backdoor them.
  • by Anonymous Coward

    history repealing itself continues... https://www.youtube.com/watch?v=sjgRbI7yQCI ..read the teepeeleaks etchings,, we're the natives now...

  • For never ever putting an 'appliance' directly on the internet. Particularly when it comes to closed source. It's attractive to think you can get something ready to roll specific to your needs, but it also means putting a huge maintenance burden on the provider of that appliance, with a huge potential set of code that could be compromised, and a higher latency for getting fixes (some appliances need to wait for their image provider, who waits for a well-known distribution to publish, who might wait for u

  • Good PR I suppose (Score:5, Insightful)

    by The-Ixian ( 168184 ) on Tuesday December 22, 2015 @12:12PM (#51165471)

    But what happens if they DO actually find something? Will they reveal it? I am guessing not.

    • ãSpãI would think, if they wish to survive, if they found an anomaly, the would have to disclose it at this point. ãS/pã ãSpãIf they fail to do so, and someone else finds it, Cisco may as well throw in the towel. The idea being they're either incompetent or intentionally snuggling up to the three letter agencies. Neither of which are useful in securing trust for your products.ãS/pã ãSpãEspecially after making it public they're doing a security audit of th
      • Yeah, Cisco would be one of the last companies I would trust, simply *because* their equipment is so ubiquitous. I am sure that three letter agencies have long ago co-opted Cisco.

        This whole code audit thing is so much PR BS. Why make a big deal out of it? Shouldn't it be a standard internal practice that would normally never make anyone bat an eye?

        It's like saying, "Oh hey, hello world! We are now implementing a policy review of our employee coffee service! Aren't you all amazed and astounded by how much we

    • by Nutria ( 679911 )

      Juniper revealed. Why should't Cisco?

    • Agreed. Stock prices would dip and shareholders would sue. This is nothing more than bullshit posturing. I'd even be willing to bet that whoever issued this statement has already been given walking papers. Just for the simple fact that the statement is implying due diligence and QC has not been done.

  • by NotInHere ( 3654617 ) on Tuesday December 22, 2015 @12:29PM (#51165569)

    Now they waste a lot of money for auditing, and if they really find something, I guess NSA will send them a gag order. Then cisco knows that they sell spyware, but what has changed for the customer? Nothing. Cisco will perhaps raise prices or deliver a less quality product because they wasted all that money with the audits. Well perhaps at least they will detect chinese backdoors if there are any. But my guess is that if china has placed backdoors, they place them in the silicon, because that's hard to detect or remove.

    • and if they really find something, I guess NSA will send them a gag order.

      No need. They are only auditing for unauthorised code.

  • by krashnburn200 ( 1031132 ) on Tuesday December 22, 2015 @12:40PM (#51165635)
    All our back doors are working fine!
  • by Anonymous Coward

    Cisco Systems Will Be Auditing Their Code For _Unexpected_ Backdoors

  • by Anonymous Coward on Tuesday December 22, 2015 @01:22PM (#51165895)

    As one of the developers behind similar devices I can say we need access to the complete set of code and we don't have it. Even if Cisco does an audit they won't be able to ensure the complete set of code isn't back-doored. I work for a company that designs and manufactures routers, switches, and similar gear. There are at least a few bits which we don't have the complete sources for. For example all the devices with 802.11ac chips in them. If any one of these peices contain a backdoor we wouldn't know it. It is a major major security issue. Any number of parties besides the NSA might be backdooring *every* device and because there are nonly a very small handful of companies with the code for these pieces it is highly likely that all of our systems are backdoored. Desktops, laptops, tablets, and most routers. There are probably only a few exceptions to this where the complete set of sources are available. I'd suggest checking out www.librecmc.org for consumer routers as it's the only embedded distribution I can confirm is back-door free for those devices which are supported.

    • Even if Cisco does an audit they won't be able to ensure the complete set of code isn't back-doored.

      While this is true, is that as big of a security risk? (yes, I realize that any security breach is a big deal, but I'm looking at the big picture here) If the chipmaker for the 802.11ac chips has a backdoor in it, then what can they gain access to? Can they control the entire device, or just that subset of the device? They might have access to the encrypted network traffic, but can they do anything with it? Also, wouldn't finding the dump of the data out of the network, or into the network be relatively

      • by Hizonner ( 38491 )

        If you control a network interface, you can generally control the entire system, because those chipsets have DMA access to the internal memory of the rest of the computer. You may have to do some work to figure out how to find and corrupt the OS data structures, but you have access to everything.

        If the owner of the system is very lucky, there'll be an IOMMU (without a back door) and the OS will have programmed that IOMMU to do something useful. But you can't rely on either, especially in embedded devices.

        Al

    • Considering Cisco makes its own ASICs, I'm fairly certain they have the schematics, including its wifi chipsets.

      YOU can't audit the entire thing. That doesn't mean ${COMPANY} can't.

    • "There are at least a few bits which we don't have the complete sources for. For example all the devices with 802.11ac chips in them."

      But you know how those bits interact with the rest of the router. What kind of permissions does the radio firmware have that could be used for nefarious purposes? Serious question. Would nefarious firmware be able to leak AES keys or wifi passwords? Or read/write memory in the router OS?

    • by AHuxley ( 892839 )
      Yes AC thats the only way to escape the NSA and its traditional, generational relationships deep into the US brands.
      Nations have to buy their own domestic products, code on them and then work out cpu power, cooling, power needs and their own software.
      Importing US installed trapdoors and backdoors over every generation of hardware and software is not going to help with any nations competitiveness or security.
      5 eye + nations get a look into any network by default as shipped is not the best way to do compu
    • by gweihir ( 88907 )

      Excellent point. The only way besides full source and HW spec access I see, is treating things like the 802.11ac components as "hostile, likely compromised" in the system design. That makes things more expensive, of course.

  • by Nutria ( 679911 ) on Tuesday December 22, 2015 @01:30PM (#51165947)
    • Oh please. There's no reason to believe that anyone in their right mind would go to the effort of executing this attack when quite frankly it is demonstrably possible to infiltrate organisations, people and agencies using far easier means.

      If CISCO software has backdoors it is probably hiding in plain sight with a procedure name like NSA_backdoor();
      Or maybe it was a bit hidden and called debug_testinterface(); //don't forget comment me out.
      Or at the very least if someone has made an effort to hide it it will

      • by Nutria ( 679911 )

        Or maybe it was a bit hidden and called debug_testinterface(); //don't forget comment me out.

        That's exactly how the Juniper backdoor was compromised. The argument to the strcmp call is ..., which is the backdoor password, and was presumably chosen so that it would be mistaken for one of the many other debug format strings in the code.

        Why would anyone go to the effort of compromising a compiler?

        The NSA doesn't do HUMINT. Backdooring the C compiler is exactly the kind of thing they'ed do when these other channels of operation are closed.

        • exactly the kind of thing they'ed do when these other channels of operation are closed.

          My exact point was that these channels of operations are not closed, not to the NSA, not to some rogue employee, not to some idiot who "forgets to disable debugging code" and as history has shown, not to some internet hackers who do it for the lulz.

    • by gweihir ( 88907 )

      Old news and outdated. The compiler backdoors can now be prevented: http://www.dwheeler.com/trusti... [dwheeler.com]

      • by Nutria ( 679911 )

        The compiler backdoors can now be prevented

        Great. But is that technique actually implemented in the compiler(s) that Cisco uses?

        • by gweihir ( 88907 )

          Very, very unlikely. I am just pointing out that they could be secure against that threat if they chose so. Of course that costs money, hence they will not. In real-world capitalism, companies will produce the shoddiest quality they can get away with.

          • by Nutria ( 679911 )

            In real-world everywhere, companies will produce the shoddiest quality they can get away with.

            Do you really think that communist Russia was or workers' paradise Cuba is that thorough with all their work?

            • by gweihir ( 88907 )

              Are you really dumb enough to assume anybody criticizing capitalism wants that version of socialism as alternative? That requires a really, really limited view of the world.

              • by Nutria ( 679911 )

                that version of socialism

                What other kinds of socialism are there? Small, Homogeneous European Socialist Pseudo-utopias don't really scale up that well.

                • by gweihir ( 88907 )

                  I rest my case regarding your stupidity.

                  Hint: There are other models for society. It takes a minumum of actual education to see that though.

  • I don't get it...

    Isn't backdoor supposed to be something you did on purpose? Why would you even have to audit to know if there's a backdoor?
    • Isn't backdoor supposed to be something you did on purpose?

      If there is such a thing, someone did it on purpose.

      But it may well not have been Cisco.

      Juniper found out it had backdoors they say they didn't put in. If you make a product which holds the keys to a lot of the internet, people are motivated to latch onto that.

  • That's all they're looking for?

  • Cisco's code definitely includes back doors for legally authorized interception.

  • What will their auditing standards be?

    > Back doors should appear to be standard coding errors
    > Find some obscure behavior in old and insecure crypto libraries, tie functions to that, use as excuse to not use up to date libraries
    > Ensure random numbers use a predictable method in some NSA-known number of dimensions
    > Use some Chinese words to make it look like we're the victims when the backdoor is discovered
    > Implement hardware protection using chips that are not subject to less than multi mil

How many surrealists does it take to screw in a lightbulb? One to hold the giraffe and one to fill the bathtub with brightly colored power tools.

Working...