Hacker News Reader

Comment by stuff4ben | Hacker News Reader

> boils down to there being a "hidden command in the affected software", according to Cisco itself.

It always amazes me that we continually release software with these backdoors in them. What is the thought process that's going on? Do they think security by obscurity really works? They must or else they wouldn't keep doing this. Cisco isn't a small company, they have the people-power, processes, and money to not do this. It literally saves no time or money when you figure in the cost to fixing the issue. US government conspiracy theories aside, I'm guessing it's just lazy developers, incompetent managers, or potentially intentional maliciousness from foreign governments or competitors.

View on HN

I feel like software reverse engineering should be done in more curriculums so developers can see just how easy it is to find backdoors as a relatively unskilled attacker.

Whilst I think it would be useful, you're not teaching the more general lessons (such as not relying solely on security by obscurity).

I suspect the kind of person who left in that backdoor would, after going through the course, simply make a slightly harder-to-find backdoor. (If anything, they might be more likely because they think they've taken into account THE vulnerability, when it is only a vulnerability).

For Cisco there's really not a great deal of incentive.

I've seen the networking gear sales world.

A huge % of customers just buy Cisco ... just because. It's a matter of fact. So if you're Cisco, there's no incentive. "Nobody ever got fired for buying IBM" is as much "Nobody ever got fired for buying Cisco".

It used to be that buying from the likes of Cisco, IBM, hp, etc was simply referred to as buying the worlds largest diaper so that when the proverbial shite hit the fan, you could simply ask the vendor to take the blame... This isn't true as much anymore and if it's still applicable in your firm, you may want to re-evaluate if this really where you want stay and grow.

I don't think those sayings are really about blame as much as just tendencies by the buyer to do what they think of as playing it safe.

I've admittedly not worked on a project team as large as the ones you'll find at Cisco, but a lot of the time it comes down to deadlines and a team biting off more than they can chew rather than active maliciousness. Never attribute to malice what can adequately be explained by stupidity, and all that.

If software with backdoors in it makes it past QA there is something fundamentally wrong with the processes in the company.

Not so. The company processes are responding to a marketplace which allows products to ship with minimal security effort, thereby translating poor security into profit thanks to a more or less uninterested public. Nothing will change until legislation. For many kinds of companies they in fact cannot change until legislation.

"There are two things I am sure of after all these years: there is a growing societal need for high assurance software, and market forces are never going to provide it." - Earl Boebert

Ross Anderson has a good reply to your statement in the 7th chapter of his book, 'Security Engineering'. [1]

[1] https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c07.pdf

Reply on news.ycombinator.com