[Clips] All your routers are belong to us

[R.A. Hettinga]

--- begin forwarded text


 Delivered-To: clips at philodox.com
 Date: Wed, 27 Jul 2005 22:57:32 -0400
 To: "Philodox Clips List" <clips at philodox.com>
 From: "R.A. Hettinga" <rah at shipwright.com>
 Subject: [Clips] All your routers are belong to us
 Reply-To: rah at philodox.com
 Sender: clips-bounces at philodox.com


 --- begin forwarded text


  Date: Wed, 27 Jul 2005 18:49:47 -0700
  From: "Major Variola (ret)" <mv at cdc.gov>
  Organization: GLODO PSYOPS
  To: "cypherpunks at al-qaeda.net" <cypherpunks at jfet.org>
  Subject: All your routers are belong to us
  Sender: owner-cypherpunks at jfet.org

  Take da subway, its da bomb




  LAS VEGAS--Cisco Systems has taken legal action to keep a researcher
  from further discussing a hack into its
  router software.

  The networking giant and Internet Security Systems jointly filed a
  request Wednesday for a temporary restraining order
  against Michael Lynn and the organizers of the Black Hat security
  conference. The motion came after Lynn showed in a
  presentation how attackers could take over Cisco routers--a problem that
  he said could bring the Internet to its knees.

  The filing in U.S. District Court for the Northern District of
  California asks the court to prevent Lynn and Black Hat from
  "further disclosing proprietary information belonging to Cisco and ISS,"
  said John Noh, a Cisco spokesman.

  "It is our belief that the information that Lynn presented at Black Hat
  this morning is information that was illegally obtained
  and violated our intellectual property rights," Noh added.

  Lynn decompiled Cisco's software for his research and by doing so
  violated the company's rights, Noh said.

  The legal moves came Wednesday afternoon, only hours after Lynn gave the
  talk at the Black Hat security conference here.
  Lynn told the audience that he had quit his job as a researcher at ISS
  to deliver the presentation, after ISS had decided to pull
  the session. Notes on the vulnerability and the talk, "The Holy Grail:
  Cisco IOS Shellcode and Remote Execution," were
  removed from the conference proceedings, leaving a gap in the thick
  book.

  Lynn outlined how to run attack code on Cisco's Internetwork Operating
  System by exploiting a known security flaw in IOS.
  The software runs on Cisco routers, which make up the infrastructure of
  the Internet. A widespread attack could badly hurt
  the Internet, he said.

  The actual flaw he exploited for his attack was reported to Cisco and
  has been fixed in recent releases of IOS, experts
  attending Black Hat said.

  The ISS research team, including Lynn, on Monday decided to cancel the
  presentation, Chris Rouland, chief technology
  officer at ISS, said in an interview. "It wasn't ready yet," he said.
  Lynn resigned from ISS on Wednesday morning and
  delivered the presentation anyway, Rouland added.

  Lynn presented ISS research while he was no longer an employee, Rouland
  said.

  Adding to the controversy, a source close to the Black Hat organization
  said that it wasn't ISS and Lynn who wanted to
  cancel the presentation, but Cisco. Lynn was asked to give a different
  talk, one on Voice over Internet Protocol security, the
  source said.

  But ISS' Rouland said there "was never a VoIP presentation" and that
  Wednesday's session was supposed to be cancelled
  altogether.

  "The research is very important, and the underlying work is important,
  but we need to work with Cisco to determine the full
  impact," Rouland said.






  Previous Next

  Cisco was involved in pulling the presentation, a source close to the
  company said. The networking giant had discussions
  with ISS and they mutually agreed that the research was not yet fully
  baked, the source said.

  The demonstration on Wednesday showed an attack on a directly connected
  router, not a remote attack over the Internet.
  "You could bring down your own router, but not a remote one," Rouland
  said.

  One Black Hat attendee said he was impressed with Lynn's presentation.
  "He got a shell really easy and showed a basic
  outline how to do it. A lot of folks have said this could not be done,
  and he sat up there and did it," said Darryl Taylor, a
  security researcher. "Shell" is a command prompt that gives control over
  the operating system.

  Noh said that Lynn's presentation did not disclose information about a
  new security vulnerability or new security flaws. "His
  research explored possible ways to expand the exploitation of existing
  vulnerabilities affecting routers," the Cisco spokesman
  said.

  Cisco has patched several flaws in IOS over the past year. Last year,
  the San Jose, Calif., networking giant said that part of
  the IOS source code had been stolen, raising fears of more security bugs
  being found.

  On Wednesday, Noh reiterated the company's usual advice that customers
  upgrade their software to the latest versions to
  mitigate vulnerabilities.

  Following his presentation, Lynn displayed his resume to the audience
  and announced he was looking for a job. Lynn was not
  available for comment. Representatives of the Black Hat organization
  said the researcher was meeting with lawyers.

 --- end forwarded text


 --
 -----------------
 R. A. Hettinga <mailto: rah at ibuc.com>
 The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
 44 Farquhar Street, Boston, MA 02131 USA
 "... however it may deserve respect for its usefulness and antiquity,
 [predicting the end of the world] has not been found agreeable to
 experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
 _______________________________________________
 Clips mailing list
 Clips at philodox.com
 http://www.philodox.com/mailman/listinfo/clips

--- end forwarded text


-- 
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"...they throw in three words of truth, and a dozen pages of
weaseling.  The net result of the weaseling is that anyone can be a
certified weasel." -- Adam Shostack

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com