Cisco and ISS' secrecy ploy is all too revealing
Connecting state and local government leaders
Internet Security Systems Inc. researcher Michael Lynn disappointed his Black Hat Briefings audience in Las Vegas last month by announcing that instead of his expected talk on a vulnerability in Cisco routers, he would be discussing a flaw in voice over IP.
Internet Security Systems Inc. researcher Michael Lynn disappointed his Black Hat Briefings audience in Las Vegas last month by announcing that instead of his expected talk on a vulnerability in Cisco routers, he would be discussing a flaw in voice over IP.As the crowd began grumbling and leaving their seats, Lynn took a quick voice vote. How many wanted to hear about Cisco's Internetwork Operating System? Cheers. How many wanted to hear about VOIP? Boos.Lynn said that although he faced possible lawsuits from Cisco Systems Inc. and ISS, he was resigning his job and would give his scheduled presentation. Hundreds of hackers and security professionals crowded back into the ballroom to watch an exploit of an IOS vulnerability.After initially working with Lynn on the presentation, Cisco and ISS had done an abrupt about-face days before the conference and forbidden him to give the talk. Cisco already had cut 20 pages containing Lynn's presentation out of the bound conference materials, and CDs of the proceedings had been reburned without the offending material. But Lynn gave his talk, and within hours Cisco and ISS filed for an injunction against Lynn and Black Hat in federal court, alleging misappropriation of trade secrets, copyright violations and breach of contract.Haggard conference organizer Jeff Moss said the next day that the legal dispute had been settled with a minimum of damage.'All they wanted was the video' of the session, Moss said. 'That's no problem. I can hit the eject button.'Lynn also agreed to turn over his research materials and stop talking about the vulnerability.But the real damage already had been done:At the very least, Cisco's statements about the incident send mixed messages.'Cisco's actions ... were not based on the fact that a flaw was identified, rather that they chose to address the issue outside of established business practices,' the company said the next day. Yet Lynn and ISS had followed those practices, notifying Cisco of the problem well in advance of its public release. Cisco fixed it with an IOS upgrade months ago but did not notify customers of the problem until after Lynn's presentation.The company said it does not release security notices 'until enough information exists to allow customers to make a reasonable determination as to whether or not they are at risk.' But the company said one day earlier that the presentation 'was not a disclosure of a new vulnerability or a flaw with Cisco IOS software. The research presented explores possible ways to expand exploitation of known security vulnerabilities.'So which is it? An 'irresponsible disclosure' that was 'not in the best interest of protecting the Internet,' or simply a rehash of known vulnerabilities? Cisco is trying to have it both ways while leaving its customers out of the loop.Lynn defended his action by saying that the vulnerability, though not easy to exploit, is serious because hackers already knew about it and Cisco equipment is so widely used. He said his talk included only about five percent of the information needed to actually perform an exploit, but that it alerted users to the seriousness of the threat.Cisco has an interest in controlling its intellectual property, but that interest may not coincide with that of its customers or millions of others who depend indirectly on Cisco equipment. Despite the company's best efforts, the information escaped, as information almost always does, and customers have to wonder how committed the company is to their welfare.
Mixed messages
William Jackson is a GCN senior writer. E-mail him at wjackson@postnewsweektech.com.
Cyber Eye: William Jackson
- To Cisco and ISS because the companies cast themselves as villains, more interested in secrecy than customers' security
- To Black Hat because the feisty conference so readily allowed its sessions to be bowdlerized
- To security professionals because discussion of vulnerabilities lays them open to judicial assault.
Mixed messages
William Jackson is a GCN senior writer. E-mail him at wjackson@postnewsweektech.com.