Hacker News Reader

Comment by willvarfar | Hacker News Reader

Are there any recent ones found by others?

From the article:

> Let's not criticize Cisco

> The company discovered these flaws following as part of its massive series of internal audits it started back in December 2015.

> At the time, security researchers found a backdoor account in Juniper software that could decrypt VPN traffic, and Cisco decided to hunt and root out any similar backdoors before attackers found them first.

> The company discovered many backdoors and hardcoded accounts in the past two years as part of internal audits and has received some pretty unfair criticism for its efforts.

> The most recent backdoors Cisco discovered was in March, when the company's engineers discovered two —one in Cisco's Prime Collaboration Provisioning (PCP) platform, and one in the IOS XE operating system.

View on HN

The question is who put them there... and more interestingly, do the updates replace the backdoors with different, more hidden ones?

To put it bluntly, even backdoor accounts need their credentials changed once in a while.

Most backdoors in commercial software are due to stupidity, not ill intent: software engineers putting a debug access point "I will remove it later before it goes into production" or business side having weird ideas "it would be so much simpler if we could log in and fix/reconfigure it for consumers".

Finding those only to replace them with a more elaborate bug seems to be ill intent and unlikely for me. The bigger problem IMO is that the mentality above is still prevalent: for every two backdoors found a new one may be put in by another do-gooder.

Cisco is the Oracle of the networking world.

I'm sure it is mostly incompetence, with only the occasional state-actor poisoning the well. But I see little evidence Cisco gives a damn or has any intention of actually attempting to regain some of the squandered trust.

Which is fine, from my perspective; for the most part I like other vendors' kit quite a bit more anyway.

I do think product liability law needs to kick in somewhere. If you have some Tourettes-like inability to stop writing back doors in security products, there should be some outside pressure to maybe get some help.

Is Cisco as evil as Oracle? Because ouch. Oracle is just plain evil. I have no reason to compare Cisco to Oracle yet. I usually prefer TP Link since they're usually effective and affordable to boot.

Absolutely not.

> has received some pretty unfair criticism for its efforts.

Ha, sure, one could say that the effort itself is commendable (internal audits and exploit hunts), but why does it feel it's a little like applauding a hitman for cleaning up the bloody mess they made in someones house?

Reply on news.ycombinator.com