- Test - lists.nanog.org

RE: Cisco and the tobacco industry
by Jim McBurnett 31 Jul '05

31 Jul '05

QUOTE From: Ivan Groenewald [mailto:ivang@xtrahost.co.uk] IMHO IOS should be completely modular. ie SNMP/QOS/BGP etc should be a loadable module etc. In the event of you patching a service specific bug, you'd only upload the new modules and insmod them. I'd be very happy if the Cisco router fairy would write and backport such an IOS. That should end this idiotic router rebooting nonsense that the internet is plagued with, for the most part. /QUOTE If I remember correctly, This Exactly where Cisco has said they are going... With the IOS XR Just as the beginning.. Does anyone else remember this? Jim

5 4

More info on the Exploit from Black Hat conference
by Church, Chuck 31 Jul '05

31 Jul '05

http://www.tomsnetworking.com/Sections-article131.php Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation Team 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 864-266-3978 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D

5 4

Boing Boing: Mike Lynn presentation mirrors and legal fund
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

Over on Boing Boing: [snip] You-all have come through with many, many mirrors for Mike Lynn's controversial Black Hat presentation in which he quit his job, described critical vulnerabilities in Cisco equipment and got sued by his employer, the candyasses at ISS. See the end of the post for lots of links -- the paranoid among you can verify mirrors via this MD-5 hash: 559942447c88086fa1304c38f9d0242c. There's a legal-defense fund for Lynn that's gearing up now. Paypal your donations to Abaddon(a)IO.com. Money that is collected and not used will be donated to EFF. [snip] http://www.boingboing.net/2005/07/30/mike_lynn_presentati.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Boing Boing: Michael Lynn's controversial Cisco security presentation
by Todd Vierling 30 Jul '05

30 Jul '05

On Sat, 30 Jul 2005, Brad Knowles wrote: > BTW, the original slides are supposed to be at > <http://www.infowarrior.org/users/rforno/lynn-cisco.pdf>. However, what's > there now is currently a place-holder, although it does tell you that if > you're looking for the original PDF file that you can still access that at > <http://www.infowarrior.org/users/rforno/lynn-cisco1.pdf>. Which is now gone, but as we all know, the Internet equivalent of the barn door is made of tissue paper. Cursory glancing around different specialty networks reveals: freenet:CHK@gozyp6dB0-tdpU7nzL~tnh6MsZYLAwI,PcB5BAp7sdwSi1cycrbCfw/lynn-cisco.pdf ed2k://|file|lynn-cisco.pdf|1994295|8f9123fe1690ced5d71e8c61eff3557e|/ magnet:?xt=urn:bitprint:UEYAAJ42EZHDD5SDIJ7O37DVLCO6C45K.PIMEBPJG3G4ON4OWUPZYXRRKPNLTH55473DZLMQ&dn=lynn-cisco.pdf And there's probably a BT to it somewhere, and perhaps Entropy and Tor links, but I don't have easy access to those at the moment. Edited or not, it's still out there. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

1 0

Cisco IPv6 Exploit, was Re: 6to4 routes disappeared from most of North America
by John Neiberger 30 Jul '05

30 Jul '05

Someone on another list was wondering if this IPv6 exploit might have something to do with the NANOG thread from a few days ago titled "6to4 routes disappeared from most of North America". http://www.merit.edu/mail.archives/nanog/msg09747.html Is there any reason to think that these might be related, or do we already know for certain that they're completely unrelated? Regards, John

3 3

RE: Cisco IOS Exploit Cover Up
by Buhrmaster, Gary 30 Jul '05

30 Jul '05

The *best* exploit is the one alluded to in the presentation. Overwrite the nvram/firmware to prevent booting (or, perhaps, adjust the voltages to damaging levels and do a "smoke test"). If you could do it to all GSR linecards, think of the RMA costs to Cisco (not to mention the fact that Cisco could not possible replace all the cards in all the GSRs across the internet in an anywhere reasonable timeframe). *THAT* is what I suspect worries Cisco. But of course I am just conjecturing... Gary > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Janet Sullivan > Sent: Friday, July 29, 2005 12:44 PM > To: swm(a)emanon.com; nanog(a)merit.edu > Subject: Re: Cisco IOS Exploit Cover Up > > > Scott Morris wrote: > > And quite honestly, we can probably be pretty safe in > assuming they will not > > be running IPv6 (current exploit) or SNMP (older exploits) > or BGP (other > > exploits) or SSH (even other exploits) on that box. :) > (the 1601 or the > > 2500's) > > If a worm writer wanted to cause chaos, they wouldn't target > 2500s, but > 7200s, 7600s, GSRs, etc. > > The way I see it, all that's needed is two major exploits, > one known by > Cisco, one not. > > Exploit #1 will be made public. Cisco will released fixed > code. Good > service providers will upgrade. > > The upgraded code version will be the one targeted by the second, > unknown, exploit. > > A two-part worm can infect Windows boxen via any common > method, and then > use them to try the exploit against routers. A windows box can find > routers to attack easily enough by doing traceroutes to > various sites. > Then, the windows boxen can try a limited set of exploit variants on > each router. Not all routers will be affected, but some will. > > As for what the worm could do - well, it could report home to > the worm > creators that "Hey, you 0wn X number of routers", or it could do > something fun like erasing configs and locking out console ports. ;-) > > Honestly, I've been expecting something like that to happen for years > now. <shrug> > >

4 4

Re: Boing Boing: Michael Lynn's controversial Cisco security presentation
by sthaug＠nethelp.no 30 Jul '05

30 Jul '05

> > I guess at this point ISS realizes their reputation is so deep in the > > shitter that nothing they do could make it worse. > > Give it a week. :) > > (It's obvious that the people calling the shots in this circus have either > never heard of "Skylarov", "deCSS", or "@Stake/Dan Geer", or have decided to > out-do those. In either case, I'm willing to bet a large pizza with everything > on it that Monday morning will bring a whole new set of PR miscues into play.. ;) It'll be interesting to see them trying to suppress all the downloads that have been made by people outside the U.S. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Boing Boing: Michael Lynn's controversial Cisco security presentation
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

Over on Boing Boing: [snip] Here's a PDF that purports to be Michael Lynn's presentation on Cisco's critical vulnerabilities ("The Holy Grail: Cisco IOS Shellcode And Exploitation Techniques"), delivered at last week's Black Hat conference. Lynn's employer, ISS, wouldn't let him deliver the talk (they'd been leant on by Cisco), so Lynn quit his job, walked onstage and delivered it anyway. (See yesterday's post and Scheneier's take for more). 1.9MB PDF Link [snip] http://www.boingboing.net/2005/07/29/michael_lynns_contro.html I think these guys better prepare for the "slashdot effect"... :-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

5 5

Re: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

One thing that bugs me, though, is the quote that is credited to Lynn: [snip] "I feel I had to do what's right for the country and the national infrastructure," he said. "It has been confirmed that bad people are working on this (compromising IOS). The right thing to do here is to make sure that everyone knows that it's vulnerable." [snip] http://www.securityfocus.com/news/11259 Lynn's statement would tend to make one believe that this is yet another example of a vulnerability that is awaiting an exploit, not one that has yet to be discovered -- a sort of Sword of Damocles, if you will... - ferg -- Brett Frankenberger <rbf(a)rbfnet.com> wrote: On Thu, Jul 28, 2005 at 07:03:31AM -0700, Eric Rescorla wrote: As nearly as I can tell from reports (I wasn't there), he (1) talked about a general way to exploit a buffer overflow to cause arbitrary code execution (this would apply to buffer overflows generally, but would be completely useless if you didn't know of a buffer overflow to exploit), and (2) demonstrated his technique using a previosuly known buffer overflow vulnerability which Cisco has already patched. So Cisco is correct in saying that he didn't identifiy any new vulnerabilities, and Cisco is also correct in saying that the vulnerability he used in his presentation to demonstrate his technique has been patched. However, the same technique will be useful on the next buffer overflow vulnerability to be discovered. -- Brett

15 17

Re: [Full-disclosure] <Cisco Message> Mike Lynn's controversial Cisco Security Presentation
by Valdis.Kletnieks＠vt.edu 30 Jul '05

30 Jul '05

On Fri, 29 Jul 2005 13:11:57 CDT, Russell Smoak said: > All, > > These recipients received an email from Austin Mckinley as Cisco Systems. > > This messasge was sent in complete error and includes intellectual > property of ISS and Cisco Systems. Please delete and do not distrbute > the information any further. Unfortunately, there has been a temporal discontinuity between the departure of the quadrupeds and the closing of the barn doors. There's only two ways to *effectively* deal with this one: a) Commence massive neural wipes of anybody who *might* have seen it. b) Obtain *and* *enforce* a permanent injunction banning anybody who's already seen it from meeting anybody who hasn't seen it in any establishment that serves Guiness. deCSS, anybody? ;)

1 0