Used Routers Often Come Loaded with Corporate Secrets

I've bought a lot of used network gear over the years. Virtually all of it came with it's last config intact. I got a stack of Cisco switches just before Covid that had clearly been the conference room switches for a municipal government, private keys and type 5 passwords included (wiped immediately; Covid unlikely to be a factor in the oversight). The only folks who seemed to regularly wipe them are the larger VARs (e.g. Cisco gold partners) who apparently have a "wipe and load latest IOS image" processes before they go on eBay.

From my perspective in IT, information security is often just an afterthought at large organizations. This is a known problem, and has been for decades.

Even at the big pharamceutical companies you see these issues, often because either they don't hire the right people, or organizational management is so fragmented nothing can ever get done unless it has a clear and present danger and even then rarely.

I knew this guy who was the security guy, where security was his sole responsibility, and when asked why they don't fix a vulnerable DH group configuration on a VPN that a good number of people used (as a review item), the answer was we have a third-party monitoring service for the important stuff.

Seemed completely asnine to me at the time, I'm a generalist , but these things really aren't that complicated. Allowing pre-computation attacks on long-running encrypted connections just seems like a really bad idea.

A lot of folks that are hired for security are not all that suited for the job. The reality is there probably aren’t enough people out there that really are, so what you get is a lot of off the shelf security products stacked on top of one another to create security theater, but mostly just slow systems and processes down without actually doing much of anything. At the same time real vulnerabilities are left open because it would require some actual thought to fix.

I've definitely gotten private keys and full configs from Cisco and Arista gear that hadn't been properly wiped. What's annoying about Arista is that while they don't post EOS versions for download, they don't even post SHA sums. It would be super easy to buy, backdoor, and resell Arista gear without any way for an end user to verify their EOS version.

On the flip side they could also come preloaded with malware.

For those who are always paywalled by Wired even though you never read their articles.

https://archive.ph/W3pwu