July 2005 - NANOG - lists.nanog.org

Boing Boing: Mike Lynn presentation mirrors and legal fund
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

Over on Boing Boing: [snip] You-all have come through with many, many mirrors for Mike Lynn's controversial Black Hat presentation in which he quit his job, described critical vulnerabilities in Cisco equipment and got sued by his employer, the candyasses at ISS. See the end of the post for lots of links -- the paranoid among you can verify mirrors via this MD-5 hash: 559942447c88086fa1304c38f9d0242c. There's a legal-defense fund for Lynn that's gearing up now. Paypal your donations to Abaddon(a)IO.com. Money that is collected and not used will be donated to EFF. [snip] http://www.boingboing.net/2005/07/30/mike_lynn_presentati.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Boing Boing: Michael Lynn's controversial Cisco security presentation
by Todd Vierling 30 Jul '05

30 Jul '05

On Sat, 30 Jul 2005, Brad Knowles wrote: > BTW, the original slides are supposed to be at > <http://www.infowarrior.org/users/rforno/lynn-cisco.pdf>. However, what's > there now is currently a place-holder, although it does tell you that if > you're looking for the original PDF file that you can still access that at > <http://www.infowarrior.org/users/rforno/lynn-cisco1.pdf>. Which is now gone, but as we all know, the Internet equivalent of the barn door is made of tissue paper. Cursory glancing around different specialty networks reveals: freenet:CHK@gozyp6dB0-tdpU7nzL~tnh6MsZYLAwI,PcB5BAp7sdwSi1cycrbCfw/lynn-cisco.pdf ed2k://|file|lynn-cisco.pdf|1994295|8f9123fe1690ced5d71e8c61eff3557e|/ magnet:?xt=urn:bitprint:UEYAAJ42EZHDD5SDIJ7O37DVLCO6C45K.PIMEBPJG3G4ON4OWUPZYXRRKPNLTH55473DZLMQ&dn=lynn-cisco.pdf And there's probably a BT to it somewhere, and perhaps Entropy and Tor links, but I don't have easy access to those at the moment. Edited or not, it's still out there. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

1 0

Cisco IPv6 Exploit, was Re: 6to4 routes disappeared from most of North America
by John Neiberger 30 Jul '05

30 Jul '05

Someone on another list was wondering if this IPv6 exploit might have something to do with the NANOG thread from a few days ago titled "6to4 routes disappeared from most of North America". http://www.merit.edu/mail.archives/nanog/msg09747.html Is there any reason to think that these might be related, or do we already know for certain that they're completely unrelated? Regards, John

3 3

RE: Cisco IOS Exploit Cover Up
by Buhrmaster, Gary 30 Jul '05

30 Jul '05

The *best* exploit is the one alluded to in the presentation. Overwrite the nvram/firmware to prevent booting (or, perhaps, adjust the voltages to damaging levels and do a "smoke test"). If you could do it to all GSR linecards, think of the RMA costs to Cisco (not to mention the fact that Cisco could not possible replace all the cards in all the GSRs across the internet in an anywhere reasonable timeframe). *THAT* is what I suspect worries Cisco. But of course I am just conjecturing... Gary > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Janet Sullivan > Sent: Friday, July 29, 2005 12:44 PM > To: swm(a)emanon.com; nanog(a)merit.edu > Subject: Re: Cisco IOS Exploit Cover Up > > > Scott Morris wrote: > > And quite honestly, we can probably be pretty safe in > assuming they will not > > be running IPv6 (current exploit) or SNMP (older exploits) > or BGP (other > > exploits) or SSH (even other exploits) on that box. :) > (the 1601 or the > > 2500's) > > If a worm writer wanted to cause chaos, they wouldn't target > 2500s, but > 7200s, 7600s, GSRs, etc. > > The way I see it, all that's needed is two major exploits, > one known by > Cisco, one not. > > Exploit #1 will be made public. Cisco will released fixed > code. Good > service providers will upgrade. > > The upgraded code version will be the one targeted by the second, > unknown, exploit. > > A two-part worm can infect Windows boxen via any common > method, and then > use them to try the exploit against routers. A windows box can find > routers to attack easily enough by doing traceroutes to > various sites. > Then, the windows boxen can try a limited set of exploit variants on > each router. Not all routers will be affected, but some will. > > As for what the worm could do - well, it could report home to > the worm > creators that "Hey, you 0wn X number of routers", or it could do > something fun like erasing configs and locking out console ports. ;-) > > Honestly, I've been expecting something like that to happen for years > now. <shrug> > >

4 4

Re: Boing Boing: Michael Lynn's controversial Cisco security presentation
by sthaug＠nethelp.no 30 Jul '05

30 Jul '05

> > I guess at this point ISS realizes their reputation is so deep in the > > shitter that nothing they do could make it worse. > > Give it a week. :) > > (It's obvious that the people calling the shots in this circus have either > never heard of "Skylarov", "deCSS", or "@Stake/Dan Geer", or have decided to > out-do those. In either case, I'm willing to bet a large pizza with everything > on it that Monday morning will bring a whole new set of PR miscues into play.. ;) It'll be interesting to see them trying to suppress all the downloads that have been made by people outside the U.S. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Boing Boing: Michael Lynn's controversial Cisco security presentation
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

Over on Boing Boing: [snip] Here's a PDF that purports to be Michael Lynn's presentation on Cisco's critical vulnerabilities ("The Holy Grail: Cisco IOS Shellcode And Exploitation Techniques"), delivered at last week's Black Hat conference. Lynn's employer, ISS, wouldn't let him deliver the talk (they'd been leant on by Cisco), so Lynn quit his job, walked onstage and delivered it anyway. (See yesterday's post and Scheneier's take for more). 1.9MB PDF Link [snip] http://www.boingboing.net/2005/07/29/michael_lynns_contro.html I think these guys better prepare for the "slashdot effect"... :-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

5 5

Re: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

One thing that bugs me, though, is the quote that is credited to Lynn: [snip] "I feel I had to do what's right for the country and the national infrastructure," he said. "It has been confirmed that bad people are working on this (compromising IOS). The right thing to do here is to make sure that everyone knows that it's vulnerable." [snip] http://www.securityfocus.com/news/11259 Lynn's statement would tend to make one believe that this is yet another example of a vulnerability that is awaiting an exploit, not one that has yet to be discovered -- a sort of Sword of Damocles, if you will... - ferg -- Brett Frankenberger <rbf(a)rbfnet.com> wrote: On Thu, Jul 28, 2005 at 07:03:31AM -0700, Eric Rescorla wrote: As nearly as I can tell from reports (I wasn't there), he (1) talked about a general way to exploit a buffer overflow to cause arbitrary code execution (this would apply to buffer overflows generally, but would be completely useless if you didn't know of a buffer overflow to exploit), and (2) demonstrated his technique using a previosuly known buffer overflow vulnerability which Cisco has already patched. So Cisco is correct in saying that he didn't identifiy any new vulnerabilities, and Cisco is also correct in saying that the vulnerability he used in his presentation to demonstrate his technique has been patched. However, the same technique will be useful on the next buffer overflow vulnerability to be discovered. -- Brett

15 17

Re: [Full-disclosure] <Cisco Message> Mike Lynn's controversial Cisco Security Presentation
by Valdis.Kletnieks＠vt.edu 30 Jul '05

30 Jul '05

On Fri, 29 Jul 2005 13:11:57 CDT, Russell Smoak said: > All, > > These recipients received an email from Austin Mckinley as Cisco Systems. > > This messasge was sent in complete error and includes intellectual > property of ISS and Cisco Systems. Please delete and do not distrbute > the information any further. Unfortunately, there has been a temporal discontinuity between the departure of the quadrupeds and the closing of the barn doors. There's only two ways to *effectively* deal with this one: a) Commence massive neural wipes of anybody who *might* have seen it. b) Obtain *and* *enforce* a permanent injunction banning anybody who's already seen it from meeting anybody who hasn't seen it in any establishment that serves Guiness. deCSS, anybody? ;)

1 0

Re: eWeek: Cisco Comes Clean on Extent of IOS Flaw
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

As an aside, I like John Murrell's headline in "Good Morning, Silicon Valley" best of all -- "Cisco patches security researcher vulnerability" http://blogs.siliconvalley.com/gmsv/2005/07/cisco_patches_s.html ;-) - ferg -- Saku Ytti <saku+nanog(a)ytti.fi> wrote: I guess someone has to yell wolf every now and then to interest people in maintaining their systems. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: Cisco IOS Exploit Cover Up
by Guru (Gurumurthy) Yeleswarapu 29 Jul '05

29 Jul '05

I just happened to see this : Last month, a company called Internet Security Systems (ISS) issued an alert to warn users that Cisco's VoIP offering had a security flaw that would allow just that. According to the company, this implementation flaw in Cisco's Call Manager, which handles call signaling and routing, could allow a buffer overflow that would grant an intruder access to the system to listen in on all calls routed through it. This is one scenario described by ISS and other vendors focused on selling technology to plug the security holes in VoIP, a method for sending voice traffic over IP that many say was not designed with security in mind. ISS and its competitors, which come to this new field largely from the VoIP management and IP security markets, forecast big risks for companies that don't take VoIP security seriously, and undoubtedly look forward to formidable revenue streams generated by those that do. Guru -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Janet Sullivan Sent: Friday, July 29, 2005 12:44 PM To: swm(a)emanon.com; nanog(a)merit.edu Subject: Re: Cisco IOS Exploit Cover Up Scott Morris wrote: > And quite honestly, we can probably be pretty safe in assuming they > will not be running IPv6 (current exploit) or SNMP (older exploits) or > BGP (other > exploits) or SSH (even other exploits) on that box. :) (the 1601 or > the > 2500's) If a worm writer wanted to cause chaos, they wouldn't target 2500s, but 7200s, 7600s, GSRs, etc. The way I see it, all that's needed is two major exploits, one known by Cisco, one not. Exploit #1 will be made public. Cisco will released fixed code. Good service providers will upgrade. The upgraded code version will be the one targeted by the second, unknown, exploit. A two-part worm can infect Windows boxen via any common method, and then use them to try the exploit against routers. A windows box can find routers to attack easily enough by doing traceroutes to various sites. Then, the windows boxen can try a limited set of exploit variants on each router. Not all routers will be affected, but some will. As for what the worm could do - well, it could report home to the worm creators that "Hey, you 0wn X number of routers", or it could do something fun like erasing configs and locking out console ports. ;-) Honestly, I've been expecting something like that to happen for years now. <shrug>

1 0