Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Cisco is not less vulnerable

Cisco is not less vulnerable

by Nikola Strahija on July 28th, 2005 The controversial conference presentation on flaws in Cisco's router software went ahead as planned, despite an earlier agreement to pull it, after Michael Lynn, the lead researcher quit the company.


It is now believed that Cisco and ISS have filed a restraining order against the management of the Black Hat Conference and Lynn.
Lynn said he felt compelled to quit his job so that he could give the talk because the Cisco security issues are of vital importance to the Internet's health. -This is the right thing to do, he said to applauding Black Hat attendees. -When you attack the router, you gain control of the network.’

Lynn described a flaw, which is now patched, in the Internetwork Operating System (IOS) software used to power Cisco's routers, and the steps he used to gain control of a router. Although Cisco was informed of the flaw by ISS, and patched its firmware in April, users running older versions of the company's software are at risk, he said.

By giving his presentation, Lynn said he hoped to clear up the misconception that Cisco's products are somehow less vulnerable to the kinds of attacks that frequently affect widely used software like the Windows operating system. -IOS is the Windows XP of the Internet, he said.

After six months of research work, Lynn discovered a way to shut down a Cisco router so that it could not be restarted. A recent decision to include a technical feature called "virtual processes", in upcoming versions of IOS would make it easier to create a "routing worm that breaks every router in the world," he said

Show organisers had literally ripped out the 31 pages containing Lynn's talk from the 1,200 page book of Black Hat presentations handed out to attendees this week. During his presentation, Lynn said he understood how ISS might have had a hard time allowing the talk, given Cisco's objections. -They had to do what was right for their shareholders, he said. -But I had to do what was right for the country and the national infrastructure.’


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »