News for hackers. Stuff that matters.

A comment on Cisco Nexus 9000 Switches Allow SSH As Root. Parent comment

Re:Cisco Nexus 9000 Switches Allow SSH As Root by fungi on Tuesday May 14, 2019 @07:30PM (#19914877)
If it was a genuine "backdoor" why would you want use a publicly available key?
[ Parent | on HN ]
Re:Cisco Nexus 9000 Switches Allow SSH As Root by MaulingMonkey on Tuesday May 14, 2019 @08:10PM (#19915136)
Being the only keyholder reduces plausable deniability, so maybe.
[ Parent | on HN ]
Re:Cisco Nexus 9000 Switches Allow SSH As Root by RL_Quine on Tuesday May 14, 2019 @08:40PM (#19915317)
The private key is on the shipped devices, from my reading.
[ Parent | on HN ]
Re:Cisco Nexus 9000 Switches Allow SSH As Root by MaulingMonkey on Tuesday May 14, 2019 @09:11PM (#19915481)
Agreed.

I'm hypothesizing that you might do this, even with keys intended to be used as a back door, by shipping it on devices, you vastly increase the number of potential suspects for any backdoor abuse.

Continuing this train of thought - a hardcoded password is classic example of a backdoor, and just as "public" as including a private key.

[ Parent | on HN ]
Re:Cisco Nexus 9000 Switches Allow SSH As Root by anxman on Tuesday May 14, 2019 @07:41PM (#19914949)
This isn't a backdoor but it is a major vulnerability.
[ Parent | on HN ]