Apologies for continuing the top posting. I totally agree but you’re just describing late stage capitalism combined with the underlying attitude that’s pervaded IT forever. It seems that everytime a company gets breached its share price always return to the same or higher value within a 6 month period. Accordingly, as public companies are entirely beholden to their shareholders, the only “proper” way of operating is to ignore all security considerations if they add any extra cost or friction of any kind. The recent hilarity of the last few years of enterprises being repeatedly owned by terribad “security” appliances is one obvious example. The other being *every* telco in countries of potential interest being multiply owned for decades is another. Or just the SS7 protocol… And yes. A motivated individual or team can potentially own anything (eg Qualys’s work on OpenSSH or the amazing work that the North Koreans are doing in the cryptocurrency space) but until there is an actual financial penalty that can significantly impact on a company to the point where the company becomes non-viable or a criminal penalty so that C-level execs get to go to jail for a bit we are doomed to being owned in completely trivial ways. A good operator can minimise the risk to the point where only national states can routinely waltz in with ease until the poc for the 0day pre-auth RCE that *all* your kit *definitely* contains appears but until the vendors are made to care, even the best among us are going to be helplessly and endlessly playing whack-a-mole. The main point is that the majority of the criminals causing havoc in our bailiwick aren’t hackers and don’t have technical talent. They are just criminals doing crimes with computers because it pays really well and they can do it with ease mainly because of the shoddy state of the industry. That’s all of our faults and it’s always been this way. I remember people being all excited about TEMPEST four decades ago when cisco/cisco was all you needed to be in 90% of routers you came across or folk illegally accessing bank mainframes with just the correct phone number and a 4 digit, brute-forceable PIN until surprisingly late in the 80’s -I do wonder if any of those 1200/1200 modems are still connected… I had hoped that the SEC might have been allowed to jail the solarwinds board member who submitted the usual “oh yeah, we totally care about security” boilerplate statement to their shareholders pour encourager les autres but alas it wasn’t to be. /mike
On 15 Mar 2025, at 08:28, Saku Ytti via NANOG <nanog@lists.nanog.org> wrote:
I'm skeptical. Companies with massive financial incentive to deliver secure devices, who control hardware and software and have infinite budgets fail, and produce devices hobbyists own to show their skills.
Router vendors are significantly worse positioned. We accidentally regularly find crashing bugs while receiving BGP updates or just packet-of-death which crashes the NPU ucode, which probably could be developed into a remote attack.
It would be reasonable to assume that any motivated attacker can own any network device, regardless of the operator's care. And operator care is trivial, I've not seen one properly written lo0 filter, much less ddos-policer config, while Juniper is arguably the best vendor here, most others don't even have a way to protect control-plane.
Yet, realised risks out of worst outcomes are trivial costs, especially to the providers. We have a lot of anecdotes of massive infosec failures, and it rarely has any significant financial impact. Heck, when crowstrike had a mistake (fair mistake, impossible to deliver a solution like that for infinite time without making a mistake like that once and a while) I knew it's going to be great for their business, and it was, it not only recovered in share price, but outperformed the market. Because there was a lot of media attention, and infosec leaders who weren't aware of end-point-security were rushing to procure one, since all the big names seemed to be running one, on account of being down.
We have a strategic problem in infosec, and we keep treating it as a tactical problem, that one more fix and it's solved. It is not working, and investing specifically to infosec is bad investment. Sure, do things safely and right when it doesn't add cost and is generally best practice. I don't know if the strategic problem can be solved or how to even improve the situation, but what we are doing is new age/faith work, it's not working, and hasn't been working. And it might be, if not fundamentally, commercially impossible to do anything secure, due to the massive leverage the attacker has over the defender.
On Sat, 15 Mar 2025 at 02:44, Justin Streiner via NANOG <nanog@lists.nanog.org> wrote:
This underscores the importance of proper security around out-of-band management/console networks and proper security of console ports to the extent that devices offer it.
Thank you jms
On Thu, Mar 13, 2025 at 1:29 PM Bryan Fields via NANOG < nanog@lists.nanog.org> wrote:
On 3/13/25 12:22 PM, Eric Kuhnke via NANOG wrote:
PDF file:
https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069...
From reading this there was no known remote exploit, they needed user level shell access to exploit another local vulnerability which got them root and then installed this exploit. While this isn't great, if someone has unaudited login user level access to your routers, you've already lost. Basic ACL's go a long way to filtering this from outside a logged network too. Security is best when it's a multilayered approach.
This said, I've been greeted with a login prompt telnetting to carrier's upstream router in the last 6 months. They seemed outright confused why I cared about it and closed the ticket. 🤦♂️
-- Bryan Fields
727-409-1194 - Voice http://bryanfields.net _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/2UEVTAIT...
NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/YM3RDKBI...
-- ++ytti _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/OPCWW5ED...