- NANOG - lists.nanog.org

Re: Cisco cover up
by Scott Altman 28 Jul '05

28 Jul '05

On Thu, 28 Jul 2005, Mark Owen wrote: > Cisco had the exploit fixed in April and no longer offers the exploitable OS for download on their site. To summarize a couple points: 1. Cisco fixes exploit in April 2. IOS Simplification occurs in April, effectively removing all old versions of code from their website. 3. IOS Simplication is explained (in macro terms) as a way to help customers navigate available versions; in micro terms, they were helping their litigation issues around NetFlow Acceleration So... did IOS simplification also give them a convienent / coincidental method of patching the vuln. that Lynn used in his exploit presentation? Or to put in another way: What else got fixed with IOS Simplification that we don't know about. One could speculate that the events listed above lead you to a good stake in the ground as to whether or not your code is vulnerable, if it's currently downloadable... it must be good! <snicker> Another observation: Given the audience of Black Hat (well-connected network types with a penchant for distributing information ahead of the curve) why is there so little factual information about what was presented? - Scott

2 1

AT&T Internet service goes down in several Western states
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

Conspiracy theorists beware. Doesn't "...equipment that routes data over it's network" sure sounds like a router to me. Actually, the AP article does go onto to identify the source of the problem as a "problematic router". Via The Mercury News (obnoxious, but free, registration required), reports: [snip] Subscribers to AT&T Corp.'s DSL Internet service in several Western states lost their connections for several hours Thursday after the telecommunications company experienced a problem with equipment that routes data over its network. The service went down about before 7 a.m. PDT, and some customers were being restored about four hours later, said AT&T spokesman Andy Backover. The company confirmed homes and businesses in California and "a couple other Western states" were affected, but it would not confirm the total number of subscribers who lost service. Backover said AT&T has received about 1,000 reports of trouble. "We're working as hard as we can to restore the service," he said. "We're very apologetic to any customers who were inconvenienced." Backover added the problem stemmed from a problematic router that's been identified and was being repaired. But he did not know when all affected customers would be restored. The outage only affected Digital Subscriber Line, or DSL, customers, not the large data network that is maintained by the telecommunications company. [snip] http://www.mercurynews.com/mld/mercurynews/business/technology/12246752.htm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

For what ot's worth, this story is running in the popular trade press: "Cisco nixes conference session on hacking IOS router code" http://www.networkworld.com/news/2005/072705-cisco-ios.html - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > For those who like to keep abreast of security issues, there are > interesting developments happening at BlackHat with regards to Cisco > IOS and its vulnerability to arbitrary code executions. > > I apologize for the article itself being brief and lean on technical > details, but allow me to say that it does represent a real problem > (as in practical and confirmed): > > http://blogs.washingtonpost.com/securityfix/2005/07/mending_a_ > hole_.html > Yes, practical _and_ confirmed, but you'll never get $vendor to admit it, which is the problem to begin with. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

14 16

RE: Cisco IOS Exploit Cover Up
by Buhrmaster, Gary 28 Jul '05

28 Jul '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of James Baldwin > Sent: Thursday, July 28, 2005 10:36 AM > To: swm(a)emanon.com > Cc: nanog(a)merit.edu > Subject: Re: Cisco IOS Exploit Cover Up > > > > Lynn developed this information based on publicly available IOS > images. Well, there is this long legal license "agreement" you have to click to agree to before you download the images (and I think it is included with the hardware you unpack too). In there somewhere you do agree not to reverse engineer the images (I actually read it all once a long time ago). As to whether that is enforceable, that is for a court to decide. > There were no illegal acts committed in gaining this > information nor was any proprietary information provided for its > development. Reverse engineering, specifically for security testing > has an exemption from the DMCA (http://cyber.law.harvard.edu/openlaw/ > DVD/1201.html). As I understand it, it is still unsettled case law as to how that clause should be interpreted. It is generally considered a good idea to avoid being the test case for such lawsuits (unless you have deep pockets to afford the best lawyers money can buy, or at least better than what your opposition can buy). > That being said, what information is he not supposed to have? > All the > information he had is available to anyone with a > disassembler, an IOS > image, and an understanding of PPC assembly. Perhaps, as in at least some companies interpretations of the DMCA, these are software equivalent of the crime of "Possession of burglary tools"? The US legal system is not as clean nor clear as one might like to hope. But the process will be followed, and we will see what happens. And if the result is "bad", we can change the laws. Gary

2 1

RE: Cisco cover up
by Olsen, Jason 28 Jul '05

28 Jul '05

From: James Baldwin > This had _nothing_ to do with the source code that was > stolen. I have dealt with Lynn professionally on many > occasions and he has shown himself to have more than a fair > share of integrity. It is uncalled for to take to disparate > events and place them together in a way which smudges the > name of a respected researcher. I don't see any smearing of anybody's name. What I do see is speculation, which is to say, "reasoning based on inconclusive evidence; conjecture or supposition." In otherwords, J offered a "guess" that the two might be related and certainly wasn't pointing fingers as if that was the definitive reason. It sometimes happens that seemingly disparate events are actually linked, so it was not an entirely illogical guess. -JFO Jason "Feren" Olsen DeVry, Inc. Senior Network Engineer One Tower Lane Em: jolsen(a)devry.com Oakbrook Terrace, IL 60181-4624 Ph: 630.645.1607 INOC-DBA: 19258*526 Fx: 630.382.2929

4 4

FrSIRT: Cisco IOS Unspecified Remote Heap Overflow Vulnerability
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

..and this showed up at FrSIRT/K-Otik: http://www.frsirt.com/english/advisories/2005/1248 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Backbone security contact at telefonica?
by Jonas Frey 28 Jul '05

28 Jul '05

Does anyone have a contact at telefonica regarding backbone security? Their address for this (seguridad.backbone(a)telefonica-wholesale.com) does no longer work. Regards, Jonas Frey

1 0

GSM gateways in the US?!?
by Network Fortius 28 Jul '05

28 Jul '05

$subj says it pretty much all :) Does anybody use anything like this in the US? The $1 mil/yr costs of our cellular telephony consists, almost exclusively, of calls made from cell phones, back into the company's various sites PBXs. I have seen such things advertised in Europe, with the extraordinary benefit of (by using a GSM gateway) making all calls appear "inside the GSM network", thus very low cost, or, sometimes, even free ... TIA, Stef

11 12

Re: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

If I were to venture a guess (and it would be just that, a guess), I'd say that you're probably spot on. I wonder who's having more fun this week? The folks at Black Hat, or the folks in The Netherlands at the "Politics of Psychedelic Research" or perhaps the "Fun and Mayhem with RFID" sessions at "What the Hack"? ;-) http://www.whatthehack.org/ - ferg -- Brett Frankenberger <rbf(a)rbfnet.com> wrote: On Thu, Jul 28, 2005 at 07:03:31AM -0700, Eric Rescorla wrote: > > Can you or someone else who was there or has some details describe > what the actual result is and what the fix was? Based on what I've > been reading, it sounds like Lynn's result was a method for exploiting > arbitrary new vulnerabilities. Are you saying that this method can't > be used in future IOS revs? As nearly as I can tell from reports (I wasn't there), he (1) talked about a general way to exploit a buffer overflow to cause arbitrary code execution (this would apply to buffer overflows generally, but would be completely useless if you didn't know of a buffer overflow to exploit), and (2) demonstrated his technique using a previosuly known buffer overflow vulnerability which Cisco has already patched. So Cisco is correct in saying that he didn't identifiy any new vulnerabilities, and Cisco is also correct in saying that the vulnerability he used in his presentation to demonstrate his technique has been patched. However, the same technique will be useful on the next buffer overflow vulnerability to be discovered. -- Brett -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Cisco IOS Exploit Cover Up
by Buhrmaster, Gary 28 Jul '05

28 Jul '05

The video *might* be available on the Washington Post later today. >From http://netsec.blogspot.com/ "Michael Lynn's "The Holy Grail: Cisco Shellcode and Remote Execution" presentation blew the doors off of Caesar's Palace Today with a full shell code exec capabilities for nearly ANY Cisco vulnerability. If your organization hasn't updated any Cisco IOS-based devices lately, the devices may be under someone else's control. The story from Michael Lynn proceed like this: He discovered clues that there was an issue being exploited when reading translated Chinese hacker sites that alluded to the issue. It was likely discovered after the theft of the Cisco Source code in May 2004 which was itself part of a larger series of intrusions. Upon further research leading to the development of working proo-of-concept code, he and his former employer ISS notified Cisco. Cisco patched the issue silently in April but never issued an advisory as to the seriousness of the issue. Cisco has since pulled all older, vulnerable versions of IOS from it's web site. After discovering that ISS was allow Lynn to present on the issue, Cisco CEO John Chambers attempted to censor the issue. When ISS stood it's ground, John Chambers requested that the US Government intervene as a matter of national security to no apparent avail. The popular press is starting to pick up on the issue now and I hear rumour that Michael's presentation MIGHT be made available in video via the Washington Post web site tomorrow." > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Network Fortius > Sent: Wednesday, July 27, 2005 6:39 PM > To: nanog(a)merit.edu > Subject: Re: Cisco IOS Exploit Cover Up > > > I have been searching the net since this morning, for "The Holy > Grail: Cisco IOS Shellcode Remote Execution", or variations of such. > This seems to be - at the moment - the most thought after torrent ... > > Stef > Network Fortius, LLC > > On Jul 27, 2005, at 8:13 PM, Daniel Golding wrote: > > > > > > > Since the talk was actually delivered - does anyone have a > > transcript or a > > torrent for audio/video? > > > > - Dan > > > > On 7/27/05 8:10 PM, "Jeff Kell" <jeff-kell(a)utc.edu> wrote: > > > > > >> > >> Cisco's response thus far: > >> > >> http://www.cisco.com/en/US/about/security/intelligence/ > >> MySDN_CiscoIOS.html > >> > >> Jeff > >> > > > > > > > > > >

1 0