- Test - lists.nanog.org

RE: Cisco cover up
by Olsen, Jason 28 Jul '05

28 Jul '05

From: James Baldwin > This had _nothing_ to do with the source code that was > stolen. I have dealt with Lynn professionally on many > occasions and he has shown himself to have more than a fair > share of integrity. It is uncalled for to take to disparate > events and place them together in a way which smudges the > name of a respected researcher. I don't see any smearing of anybody's name. What I do see is speculation, which is to say, "reasoning based on inconclusive evidence; conjecture or supposition." In otherwords, J offered a "guess" that the two might be related and certainly wasn't pointing fingers as if that was the definitive reason. It sometimes happens that seemingly disparate events are actually linked, so it was not an entirely illogical guess. -JFO Jason "Feren" Olsen DeVry, Inc. Senior Network Engineer One Tower Lane Em: jolsen(a)devry.com Oakbrook Terrace, IL 60181-4624 Ph: 630.645.1607 INOC-DBA: 19258*526 Fx: 630.382.2929

4 4

FrSIRT: Cisco IOS Unspecified Remote Heap Overflow Vulnerability
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

..and this showed up at FrSIRT/K-Otik: http://www.frsirt.com/english/advisories/2005/1248 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Backbone security contact at telefonica?
by Jonas Frey 28 Jul '05

28 Jul '05

Does anyone have a contact at telefonica regarding backbone security? Their address for this (seguridad.backbone(a)telefonica-wholesale.com) does no longer work. Regards, Jonas Frey

1 0

GSM gateways in the US?!?
by Network Fortius 28 Jul '05

28 Jul '05

$subj says it pretty much all :) Does anybody use anything like this in the US? The $1 mil/yr costs of our cellular telephony consists, almost exclusively, of calls made from cell phones, back into the company's various sites PBXs. I have seen such things advertised in Europe, with the extraordinary benefit of (by using a GSM gateway) making all calls appear "inside the GSM network", thus very low cost, or, sometimes, even free ... TIA, Stef

11 12

Re: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

If I were to venture a guess (and it would be just that, a guess), I'd say that you're probably spot on. I wonder who's having more fun this week? The folks at Black Hat, or the folks in The Netherlands at the "Politics of Psychedelic Research" or perhaps the "Fun and Mayhem with RFID" sessions at "What the Hack"? ;-) http://www.whatthehack.org/ - ferg -- Brett Frankenberger <rbf(a)rbfnet.com> wrote: On Thu, Jul 28, 2005 at 07:03:31AM -0700, Eric Rescorla wrote: > > Can you or someone else who was there or has some details describe > what the actual result is and what the fix was? Based on what I've > been reading, it sounds like Lynn's result was a method for exploiting > arbitrary new vulnerabilities. Are you saying that this method can't > be used in future IOS revs? As nearly as I can tell from reports (I wasn't there), he (1) talked about a general way to exploit a buffer overflow to cause arbitrary code execution (this would apply to buffer overflows generally, but would be completely useless if you didn't know of a buffer overflow to exploit), and (2) demonstrated his technique using a previosuly known buffer overflow vulnerability which Cisco has already patched. So Cisco is correct in saying that he didn't identifiy any new vulnerabilities, and Cisco is also correct in saying that the vulnerability he used in his presentation to demonstrate his technique has been patched. However, the same technique will be useful on the next buffer overflow vulnerability to be discovered. -- Brett -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Cisco IOS Exploit Cover Up
by Buhrmaster, Gary 28 Jul '05

28 Jul '05

The video *might* be available on the Washington Post later today. >From http://netsec.blogspot.com/ "Michael Lynn's "The Holy Grail: Cisco Shellcode and Remote Execution" presentation blew the doors off of Caesar's Palace Today with a full shell code exec capabilities for nearly ANY Cisco vulnerability. If your organization hasn't updated any Cisco IOS-based devices lately, the devices may be under someone else's control. The story from Michael Lynn proceed like this: He discovered clues that there was an issue being exploited when reading translated Chinese hacker sites that alluded to the issue. It was likely discovered after the theft of the Cisco Source code in May 2004 which was itself part of a larger series of intrusions. Upon further research leading to the development of working proo-of-concept code, he and his former employer ISS notified Cisco. Cisco patched the issue silently in April but never issued an advisory as to the seriousness of the issue. Cisco has since pulled all older, vulnerable versions of IOS from it's web site. After discovering that ISS was allow Lynn to present on the issue, Cisco CEO John Chambers attempted to censor the issue. When ISS stood it's ground, John Chambers requested that the US Government intervene as a matter of national security to no apparent avail. The popular press is starting to pick up on the issue now and I hear rumour that Michael's presentation MIGHT be made available in video via the Washington Post web site tomorrow." > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Network Fortius > Sent: Wednesday, July 27, 2005 6:39 PM > To: nanog(a)merit.edu > Subject: Re: Cisco IOS Exploit Cover Up > > > I have been searching the net since this morning, for "The Holy > Grail: Cisco IOS Shellcode Remote Execution", or variations of such. > This seems to be - at the moment - the most thought after torrent ... > > Stef > Network Fortius, LLC > > On Jul 27, 2005, at 8:13 PM, Daniel Golding wrote: > > > > > > > Since the talk was actually delivered - does anyone have a > > transcript or a > > torrent for audio/video? > > > > - Dan > > > > On 7/27/05 8:10 PM, "Jeff Kell" <jeff-kell(a)utc.edu> wrote: > > > > > >> > >> Cisco's response thus far: > >> > >> http://www.cisco.com/en/US/about/security/intelligence/ > >> MySDN_CiscoIOS.html > >> > >> Jeff > >> > > > > > > > > > >

1 0

Mozilla Implements TLD Whitelist for Firefox in Response to IDN Homogr aphs Spoofing
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

Not sure if anyone has seen this, or not... Via CircleID: [snip] Mozilla Foundation has announced changes to Firefox concerning Internationalized Domain Names (IDN) to deal with homograph spoofing attacks. According to the organization, "Mozilla Foundation products now only display IDNs in a whitelist of TLDs, which have policies stating what characters are permitted, and procedures for making sure that no homographic domains are registered to two different entities." [snip] http://www.circleid.com/article/1148_0_1_0_C/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

RE: Cisco IOS Exploit Cover Up
by Hank Nussbacher 28 Jul '05

28 Jul '05

At 12:22 AM 28-07-05 -0400, Hannigan, Martin wrote: > > ..and of course: > > > > "Cisco Denies Router Vulnerability Claims" > > > > [snip] > > >Of course. That's how a broken vuln system works. :-) > >The major flaw is that the vendor decides who gets to know >about a vulnerability. Or 3com: http://www.networkworld.com/news/2005/072505-3com.html -Hank

1 0

RE: Cisco IOS Exploit Cover Up
by Hannigan, Martin 28 Jul '05

28 Jul '05

> ..and of course: > > "Cisco Denies Router Vulnerability Claims" > > [snip] Of course. That's how a broken vuln system works. :-) The major flaw is that the vendor decides who gets to know about a vulnerability. This causes an insecurity in "the system" because $vendor is dealing with people usually more qualified than themselves to make a decision on who needs to know and make one independant of revenue<-- . $vendor is probably not the best person to decide who gets on the secret-15 lists et. al. -M<

1 0

RE: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

...and Wired News is running this story: "Cisco Security Hole a Whopper" Excerpt: [snip] A bug discovered in an operating system that runs the majority of the world's computer networks would, if exploited, allow an attacker to bring down the nation's critical infrastructure, a computer security researcher said Wednesday against threat of a lawsuit. Michael Lynn, a former research analyst with Internet Security Solutions, quit his job at ISS Tuesday morning before disclosing the flaw at Black Hat Briefings, a conference for computer security professionals held annually here. [snip] http://www.wired.com/news/privacy/0,1848,68328,00.html - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: For what ot's worth, this story is running in the popular trade press: "Cisco nixes conference session on hacking IOS router code" http://www.networkworld.com/news/2005/072705-cisco-ios.html - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > For those who like to keep abreast of security issues, there are > interesting developments happening at BlackHat with regards to Cisco > IOS and its vulnerability to arbitrary code executions. > > I apologize for the article itself being brief and lean on technical > details, but allow me to say that it does represent a real problem > (as in practical and confirmed): > > http://blogs.washingtonpost.com/securityfix/2005/07/mending_a_ > hole_.html > Yes, practical _and_ confirmed, but you'll never get $vendor to admit it, which is the problem to begin with. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1