Nation state backdoor found in Cisco firewalls (again..?) [video] | Hacker News Reader

Nation state backdoor found in Cisco firewalls (again..?) [video]

youtube.com

43 pointschii17 comments

This guy is a cybersec clout chaser... just link to the article... https://blog.talosintelligence.com/arcanedoor-new-espionage-...

The trend of making dramatic videos around simple written facts should die. I'd much rather read a long page than have to listen to someone rant about it, and that's true from simple tutorials to things like security reports / CVE's.

What’s interesting is that the U.S. government, which was actually caught using Cisco’s backdoor, is now claiming that China used the backdoor.

Snowden: The NSA planted backdoors in Cisco products https://www.infoworld.com/article/2608141/snowden--the-nsa-p...

I suddenly thought of a possible evidence, that is, they met each other at the back door

> Nation state backdoor found in Cisco firewalls (again..?)

What do you mean "again" ?

Over and over again. But people still buy Cisco, so it is not a big problem.

I remember a previous incident where a paranoid admin was comparing the logs of his Cisco firewall with a Linux firewall. He noticed they diverged whenever he called Cisco support. He worked out that the Cisco firewall had essentially a back door in it with features that orgs like the NSA would want, and Cisco support were using for “their own convenience”. Feature like hiding from logs, disabling activity LEDs, pattern matching with Regexes, and compressed and encrypted data smuggled out over other protocols in “dead space” and the like.

I can’t quite find the specifics, but I remember that the “patch” just changed the password on the back door, but left it in place.

> “patch” just changed the password on the back door

so someone else malicious who knows about it has complete access to your router? That's almost as bad as leaving the default admin password unchanged.

do you have any sources/links about this? It sounds very terrifying.

I’ve worked for Cisco for 11 years (both TAC and R&D) and this anecdote is ridiculous.

There is no such special back door for TAC. It would be stupidly incompetent if NSA would allow Cisco to use their back door for their own convenience.

Also there is no back door visible in the source code. Again it would be stupid if there was since there are tens of thousands of engineers looking at the code that could decide to take advantage of it for their own benefit.

If there is an NSA back door only very few select people in Cisco know about it.

If there's an NSA backdoor, the NSA wouldn't let a corporation even know about it.

IIRC the documented incidents from the Snowden files were about hardware backdoors/additions added in transit. But they required CISCO to turn a blind eye, at the very least, I think.

Juniper included the back-doored EC-DRBG algorithm into their VPN products on the orders of the NSA, so this kind of behaviour is not without precedent.

Unless you're a very senior staff member, at the director level, you would not be privy to these kinds of orders. It would implemented without the knowledge of the vast majority of the staff.

Your ignorance of a backdoor is not evidence of its absence.

That was kinda their point. They weren't denying that one exists, just pointing out that the Cisco response that it was for support use was laughable.

Cisco never claimed it was for support use. It was more than some support techs knew about the back door, and were using it unofficially for their own convenience.

The official statement, if I remember correctly, was brief, vaguely worded, and amount to: "We can't say anything, every US vendor is in the same boat as us, stop asking".

Air-gapped, the only way to go.

https://www.welivesecurity.com/2021/12/01/jumping-air-gap-15...

There are still several vectors even with the top security clearance procedures. They routinely miss things at security checkpoints.

“Even a perfect air gap will be vulnerable to a variety of different attack vectors, including (but not limited to) the following:

Physical compromise: An adversary bypasses physical security and gains access directly to the air-gapped network devices. Physical access is by far the most effective and obvious technique.

Insider threats: Someone who is part of an organization and has access to air-gapped secure systems intentionally or unintentionally compromises a system.

Supply chain compromise: A vendor with legitimate access to air-gapped systems unwittingly is compromised and brings infected devices into a network.

Misconfiguration: Misconfiguration of access controls or permissions allows an attacker to access the air-gapped system through a separate device on the network.

Social engineering (media drop): If an attacker was able to successfully conduct a malicious USB/media drop and an employee was to use that media within the air-gapped system, the network could be compromised.

Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals, and magnetic fields are among a range of advanced tactics documented and demonstrated by researchers at Ben Gurion University. “

https://darktrace.com/blog/why-the-air-gap-is-not-enough

>Other advanced tactics: Thermal manipulation, covert surface vibrations, LEDs, ultrasonic transmissions, radio signals,

There's a pretty good video of a guy who drove a GPIO pin off of a microcontroller and successfully sent data via LoRA without a dedicated radio chipset or antenna.

https://github.com/cnlohr/lolra

More discussion:

https://news.ycombinator.com/item?id=40181896

Reply on news.ycombinator.com