Cisco coughs up baker’s dozen of vulnerabilities and other security nasties

> open a case and get access [...] if you reference a vulnerability that’s affecting your current hardware.

Ok, but that's bullshit, isn't it? Not all customers are going to be proactive/attentive enough to know their hardware is vulnerable. Cisco knows there is vulnerable gear in the wild, knows there is a fix, but withholds the fix until people come begging? Almost feels like the sort of thing that should be illegal (or at least on the losing end of a civil suit).

"I'm not holding you hostage and demanding $20k, you can instead just give me your first born child!"

Holy crap does anybody actually think that's remotely acceptable behavior? I get better support on discounted Chinese routers I've bought in back alleys - they at least put out their patches for free.

Really? So my cisco home modem messing up DNS and appending Utopia.net, burned in hardware by cisco will get a new firmware if I just ask for it?

Please go on and let me know where I can open this case.

I am not sarcastic, I really need that fixed.

That's ridiculous.

Most security-critical devices are moving in the direction of auto-updating. I'm not super into that, but I see the justification. You're telling me that Cisco is so far in the opposite direction that if I want to patch a device, I can't download the firmware myself, I have to open a service request saying, "I'd like the latest security patches", and then answer the question, "Why? What specifically are you worried about?"

That is not the setup of a company that cares about security.

Putting firmware patches behind any kind of account authentication is mind-boggling to me. I wouldn't have guessed that there's a hardware company that does that.

The kernel will patch the microcode well before any untrusted code is run too.

Whilst I think it would be useful, you're not teaching the more general lessons (such as not relying solely on security by obscurity).

I suspect the kind of person who left in that backdoor would, after going through the course, simply make a slightly harder-to-find backdoor. (If anything, they might be more likely because they think they've taken into account THE vulnerability, when it is only a vulnerability).

If software with backdoors in it makes it past QA there is something fundamentally wrong with the processes in the company.

It used to be that buying from the likes of Cisco, IBM, hp, etc was simply referred to as buying the worlds largest diaper so that when the proverbial shite hit the fan, you could simply ask the vendor to take the blame... This isn't true as much anymore and if it's still applicable in your firm, you may want to re-evaluate if this really where you want stay and grow.

This makes me wonder if this is how Stuxnet was birthed, very interesting.

>> A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is?

> Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-g...

Though, it's worth noting that the NSA actually two roles: 1) ensuring the security of US Government communications systems and 2) conducting signals intelligence against other foreign communications systems. People focus so much on the former that they often forget the latter.

Given their defensive role, being "done" with these exploits may mean simply having patched/secured all their systems against them.

I don’t follow. In most cases, you still have to develop exploits to “exploit” vulnerabilities. Very few of them just offer you a login prompt over the internet.