News for hackers. Stuff that matters.
Re:Hardcoded Password Found in Cisco Software by DarronWyke on Friday March 09, 2018 @10:38AM (#16552436)
"Cisco" and "security issue" go together like peanut butter and chocolate. Knowing this, and with the knowledge that IOS is some form of arcane torture, leads me to wonder: why hasn't Cisco been completely obsoleted by Juniper or other providers?
Re:Hardcoded Password Found in Cisco Software by helper on Friday March 09, 2018 @10:47AM (#16552506)
Nobody gets fired for buying cisco.
Re:Hardcoded Password Found in Cisco Software by braderhart on Friday March 09, 2018 @11:46AM (#16552957)
Actually they do, but those sales people will make sure payoffs are part of the purchase, and even if you get fired for calling out the conflict of interests, it is usually harder for an honest employee to fight a multi-billion dollar company that has professional propaganda departments.
Re:Hardcoded Password Found in Cisco Software by haloux on Friday March 09, 2018 @10:49PM (#16556988)
The responses to this comment really elicit a lot about the average age of the typical HN reader.
Re:Hardcoded Password Found in Cisco Software by Cuuugi on Friday March 09, 2018 @11:13AM (#16552733)
Maybe they should? Blind faith in brands only causes trouble imo.
Re:Hardcoded Password Found in Cisco Software by gberger on Friday March 09, 2018 @11:15AM (#16552750)
Soon they will.
Re:Hardcoded Password Found in Cisco Software by mtgx on Friday March 09, 2018 @11:06AM (#16552670)
Maybe because Juniper loves those Cisco backdoors, too.

Back in 2015 they pretended to be shocked that the Dual_EC algorithm, of which people warned it may contain a backdoor since 2007, and then it was confirmed by Snowden's documents in 2013, could actually be exploited by the baddies.

Re:Hardcoded Password Found in Cisco Software by mysterypie on Friday March 09, 2018 @11:23AM (#16552797)
> Back in 2015 Juniper pretended to be shocked that the Dual_EC algorithm

To complete your point:

Security researchers solved the mystery around a sophisticated backdoor embedded in Juniper firewalls. Juniper Networks announced on [Dec. 17, 2015] that it had discovered two unauthorized backdoors in its firewalls, including one that allows the attackers to decrypt protected traffic passing through Juniper's devices. The NSA may be responsible for that backdoor. Even if the NSA did not plant the backdoor in the company's source code, the spy agency may in fact be indirectly responsible [due to] weaknesses the NSA allegedly placed in a government-approved encryption algorithm known as Dual_EC. The Juniper backdoor is a textbook example of how someone can exploit the existing weaknesses in the Dual_EC algorithm the security community warned about back in 2007.[1]

[1] Paraphrased from https://www.wired.com/2015/12/researchers-solve-the-juniper-...

Re:Hardcoded Password Found in Cisco Software by foobiekr on Friday March 09, 2018 @11:49AM (#16552985)
IMHO, the dual EC thing, as bad as it was, is completely different than the sloppy crap like a litany of hard coded passwords. One of these things has political complications, albeit ones that should not matter, and the other is an issue of basic engineering competence.
Re:Hardcoded Password Found in Cisco Software by michaelcampbell on Friday March 09, 2018 @12:59PM (#16553530)
https://duckduckgo.com/?q=juniper+flaw&ia=web

Because Cisco is a unique snowflake in having issues? /s

Re:Hardcoded Password Found in Cisco Software by AnIdiotOnTheNet on Friday March 09, 2018 @11:12AM (#16552721)
They still enjoy name recognition from the era when they were pretty much the only player in high-performance enterprise-grade networking equipment. That era is long since over, but there are still a lot of networking people who came out of and are still coming out of Cisco's Netacad and aren't familiar with other vendor options.
Re:Hardcoded Password Found in Cisco Software by user5994461 on Friday March 09, 2018 @03:10PM (#16554585)
There is also a generation of networking people who went to the "cheap" DELL and HP equipment only to realize they didn't have all the advertised features.

Juniper and Force 10 were nice, if only they could be bought outside of the USA and by non English speakers.

That's what I recall from a decade ago. Can you name the options that were so great?

Re:Hardcoded Password Found in Cisco Software by gnbfulbvgjbvv on Friday March 09, 2018 @10:46AM (#16552496)
S/iOS/IOS
Re:Hardcoded Password Found in Cisco Software by yorwba on Friday March 09, 2018 @10:52AM (#16552548)
s/^S/s
Re:Hardcoded Password Found in Cisco Software by CiPHPerCoder on Friday March 09, 2018 @11:05AM (#16552660)
s/$/\//
Re:Hardcoded Password Found in Cisco Software by BenjiWiebe on Friday March 09, 2018 @11:09AM (#16552696)
You'd think no one actually uses sed any more...
Re:Hardcoded Password Found in Cisco Software by saghm on Friday March 09, 2018 @12:02PM (#16553080)
Lots of people use vim, which all of these examples would also work in

EDIT: except for the missing trailing "/"

Re:Hardcoded Password Found in Cisco Software by yorwba on Friday March 09, 2018 @11:19AM (#16552768)
I use ed occasionally, just for fun. It's perfectly happy with s commands not being terminated by the separator.
Re:Hardcoded Password Found in Cisco Software by GlitchMr on Friday March 09, 2018 @01:03PM (#16553550)
It can also be Perl, as Perl supports `s///` syntax.
Re:Hardcoded Password Found in Cisco Software by laumars on Friday March 09, 2018 @04:57PM (#16555388)
Doesn't need to be forward slashes (in either Perl or sed).

In fact that last example I might write as either of the two following ways:

    s,$,/,
    s{$}{/}    # this is supported in Perl but not sed
to avoid having to escape the replacing character.
Re:Hardcoded Password Found in Cisco Software by magnetic on Friday March 09, 2018 @11:21AM (#16552783)
What are the alternatives?
Re:Hardcoded Password Found in Cisco Software by wglb on Friday March 09, 2018 @12:13PM (#16553154)
I've seen folks use awk for some of those tasks, and another four letter programming language that i won't name.
Re:Hardcoded Password Found in Cisco Software by kubbity on Friday March 09, 2018 @12:34PM (#16553330)
I don't know if it's what you want, but it's what you get. [0]

It' all magic! [1]

[0]https://groups.google.com/forum/m/?hl=en#!msg/comp.lang.perl... [1]https://groups.google.com/forum/m/?hl=en#!msg/comp.lang.perl...

Re:Hardcoded Password Found in Cisco Software by wglb on Friday March 09, 2018 @12:41PM (#16553390)
I'm going to release the safety on my browning.
Re:Hardcoded Password Found in Cisco Software by zwp on Friday March 09, 2018 @12:35PM (#16553347)
Ruby isn't that bad.
Re:Hardcoded Password Found in Cisco Software by wglb on Friday March 09, 2018 @12:40PM (#16553384)
Ruby is great, and is not what I was thinking of. But I should have included it as well as AWK.
Re:Hardcoded Password Found in Cisco Software by DarronWyke on Friday March 09, 2018 @11:09AM (#16552698)
Correct, I'm too damn used to dealing with Apple stuff. It's also like another form of cancer, but a lot less pervasive and far more noticeable.
Re:Hardcoded Password Found in Cisco Software by foobiekr on Friday March 09, 2018 @11:21AM (#16552785)
The reality is that like most very large software organizations mediocrity is the default. Based on the hires I personally know of recently, even Google is quite obviously and visibly well underway in the process of mediocre-ization.

Fill your company with mass hires to get "area under the curve." Make vanity hires. Slant compensation to the top 10%. Hire only the desperate who couldn't find work elsewhere when doing school recruiting but consider yourselves "successful" in college recruiting. Have people who are so institutionalized they not just mostly have never worked outside, they wouldn't be able to. Congratulate Foo for 22 Years at XXXX!

Hire tons of low cost contractors. Be that company where teams of inexpensive contractors don't just "help out" on projects by making everything harder, they go on to work for the company for 16 years. Build out in lower cost locations without imposing a bar - after all, engineering hours are fungible and even if the quality is lower you can do 3:1 - and they'll have mentoring from the Valley engineers assigned to turn them into successful teams. It's just engineering.

It turns out that mediocrity in coding is very, very bad.