×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

January 28 is Data Privacy Day

timothy posted more than 2 years ago | from the national-brotherhood-week dept.

Facebook 50

An anonymous reader writes "A bit early, but just a reminder that January 28 is international Data Privacy Day in the U.S., Canada, and many European countries. Various events are being held around the globe: the head of the FTC opened a weekend forum on the topic by calling out Facebook and Google, the Ontario Privacy Commissioner is holding a symposium on 'Surveillance by Design', and of course Google recently announced they'll be tracking you more thoroughly in the future."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

50 comments

Does that mean no posting on slashdot? (1)

cshark (673578) | more than 2 years ago | (#38847139)

Darn

Re:Does that mean no posting on slashdot? (2, Funny)

Anonymous Coward | more than 2 years ago | (#38847187)

Not to worry. You can borrow my account.

January 28 is international Data Privacy Day (4, Funny)

Jeremiah Cornelius (137) | more than 2 years ago | (#38847253)

SSSHHH!! Don't tell anyone!

Re:January 28 is international Data Privacy Day (0)

Anonymous Coward | more than 2 years ago | (#38852795)

It was also Davros Day in the UK.

Re:Does that mean no posting on slashdot? (0)

Anonymous Coward | more than 2 years ago | (#38849261)

no, it means we should all be Anonymous Cowards!

Vote with your feet (0)

Anonymous Coward | more than 2 years ago | (#38847143)

Switching from Dropbox to SpiderOak to celebrate.

Re:Vote with your feet (1)

Anonymous Coward | more than 2 years ago | (#38847495)

Switching from Google to something like DuckDuckGo could also be worthy.

Re:Vote with your feet (1)

countertrolling (1585477) | more than 2 years ago | (#38847533)

Cut it out with that spamming shit... They're no different than anybody else.

Re:Vote with your feet (0)

Anonymous Coward | more than 2 years ago | (#38847783)

Have a better suggestion? Ixquick?

Re:Vote with your feet (1)

countertrolling (1585477) | more than 2 years ago | (#38850453)

Have a better suggestion?

The only trustworthy option is to run your own web crawler. And even then you can't trust your service provider not to spy on you. In light of this, short answer is 'no'.

Re:Vote with your feet (0)

Anonymous Coward | more than 2 years ago | (#38850687)

In your case, I wouldn't even bother using the Internet, as you are ALWAYS being watched at some point.

“On the Internet you have no privacy, get over it .” (CEO of Cisco Systems)

Re:Vote with your feet (1)

countertrolling (1585477) | more than 2 years ago | (#38850963)

Well, we might able to introduce privacy on the internet when we are able to cut ourselves free of AT&T's wire. For now sneakernet is the only way

Re:Vote with your feet (0)

Anonymous Coward | more than 2 years ago | (#38849409)

Yes they are!

DuckDuckGo has a mention of data privacy day on their frontpage

All Google could care about is 125th anniversary of the largest snowflake?!

Nuff said.

Re:Vote with your feet (1)

countertrolling (1585477) | more than 2 years ago | (#38850327)

DuckDuckGo has a mention of data privacy day on their frontpage...

And I have some beautiful Florida swampland for sale that's worth ten times any internet 'privacy' policy you can dredge up

Re:Vote with your feet (0)

Anonymous Coward | more than 2 years ago | (#38850635)

What are you going on about?

Re:Vote with your feet (1)

Anonymous Coward | more than 2 years ago | (#38848169)

I'll bite. They got free email, calendar, shared docs, office suite, photo album hosting, chat network, with my friends on it, mapping system and drive traffic to my site?

A momentous occasion (3, Insightful)

geminidomino (614729) | more than 2 years ago | (#38847149)

I'm sure it will be properly celebrated by the stakeholders at Google, Zynga, Apple, Facebook, and USGov sitting in their offices and giggling quietly to themselves throughout the day.

Re:A momentous occasion (1)

the eric conspiracy (20178) | more than 2 years ago | (#38847289)

Yes, pretty much. I've decided that since I'm going to be ass-raped in this fashion I might as well profit by it so I'm well invested in companies that exploit customer data to the max.

Can't wait for the Facebook IPO. Boo-Ya.

Re:A momentous occasion (0)

Anonymous Coward | more than 2 years ago | (#38847297)

Not sure why Apple is on that list. Again, Apple users are their customers, they don't sell your data as a source of revenue.

Stop it already. (1)

Stumbles (602007) | more than 2 years ago | (#38847201)

Just how many $TRUMPED_UP_LAME_ASS days do we need in any given year? If elected President of the USA I will sign an executive order making it illegal to declare anymore $TRUMPED_UP_LAME_ASS days.

Re:Stop it already. (3, Funny)

somersault (912633) | more than 2 years ago | (#38847217)

I declare January 29th, "No More Trumped Up Lame Ass Days Day". Also, it's my sister's birthday.

Re:Stop it already. (-1)

Anonymous Coward | more than 2 years ago | (#38847293)

I know. I always treat her to anal on her birthday.

Re:Stop it already. (1)

godrik (1287354) | more than 2 years ago | (#38847305)

I, hereby, declare january 29th "birthday of somersault's sister day"!
At least we will have a "something-day" one person gives shit about.

President? (-1)

Anonymous Coward | more than 2 years ago | (#38847525)

I acknowledge you my liege, lord and King.

Re:Stop it already. (1)

countertrolling (1585477) | more than 2 years ago | (#38847565)

Just how many $TRUMPED_UP_LAME_ASS days do we need in any given year?

Happy Love Day, everyone!

Re:Stop it already. (0)

Anonymous Coward | more than 2 years ago | (#38848623)

Happy Love Day, everyone!

But I want Free-love day!

NB. Apparently there was a tribe in Brazil with a 'free love' day. It essentially meant 50 men mounting the prettiest woman in the tribe.

Re:Stop it already. (2)

VortexCortex (1117377) | more than 2 years ago | (#38848467)

Those donkeys deserve some respect, despite any recent injury. I believe the correct question is: "How many ~8.7 day increments in a year can be devoid of all but one holiday?" As you might suspect... the answer has already been derived.

rev.3 - Spook Backdoors in Cisco Routers (-1)

Anonymous Coward | more than 2 years ago | (#38847231)

Spook BackDoors In Cisco Routers (continued - revision 3)
- Older news, but still relevant!!
    Please save this story and repost it everywhere
    Especially in Security Discussion Forum Sites
- You should use OpenBSD or a hardened Linux distro
    For a router, NOT these blackboxes offered with
    proprietary hardware & firmware!

"More on Cisco Building Surveillance into Routers"
http://hardware.slashdot.org/story/03/04/22/1656215/more-on-cisco-building-surveillance-into-routers [slashdot.org]

PDF: http://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-wp.pdf [blackhat.com]

PDF2: http://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-slides.pdf [blackhat.com]

Is Apparent US Conspiracy with Cisco about Wiretapping?
By: emptywheel Monday June 6, 2011 2:52 pm
http://emptywheel.firedoglake.com/2011/06/06/it-is-simply-not-done-in-a-civilized-jurisdiction-that-is-bound-by-the-rule-of-law/ [firedoglake.com]

Canada has just discovered how much corporations own our legal system, how our legal system criminalizes whistleblowers, and our utter and total disdain for the rule of law.

At issue is the apparent conspiracy between Cisco and the US government to respond to an anti-trust lawsuit launched by Peter Alfred Adekeye, a former Cisco employee. He sued because of the way Cisco forced customers to buy a maintenance contract for things like bug fixes.

        This lawsuit is about Ciscoâ(TM)s deliberate and continuing attempt to monopolize for itself (and its âoepartnersâ (Cisco-authorized resellers of Cisco equipment and services nationwide) with which it does not significantly compete) the service and maintenance of Cisco enterprise (Cisco networking equipment for all segments (e.g., internet service providers, government, academia, small, medium and large business, etc.) with the exception of home networking equipment) hardware, principally routers, switches and firewalls. Cisco possesses a market share of approximately 70% in the networking equipment industry.

        [snip]

        To protect its over $6 billion yearly stream of service and maintenance revenue, Cisco has cleverly and uniquely conditioned the provision of its software âoeupdatesâ on the customerâ(TM)s purchase of a hardware maintenance service agreement called âoeSMARTnet,â

        [snip]

        The effect of this leveraging of monopoly power and unlawful tie-in and/or bundling is to effectively preclude any non-Cisco affiliated Independent Service Organization (âoeISOâ) from competing for the business of servicing Cisco networking hardware, thus preserving for itself all but a pittance of that line of commerce which is separate and distinct from the âoeupdatesâ of its software.

In response, Cisco counter-sued, accusing Adekeye of illegally accessing Cisco services. And Cisco either lied persuasively or got DOJ to conspire in the intimidation campaign, because DOJ then charged Adekeye with 97 violations thatâ"the Canadian judge who just blew this up suggestedâ"should have only amounted to one single violation.

The US also refused to allow Adekeye to enter the US after 2008, meaning he couldnâ(TM)t testify in the litigation. Finally, in 2010, he flew to Canada to testify. At that point, the US had him arrested by the Mounties, based on false claims (among other things) that he was a shady Nigerian. He was held for four weeks, and then made to stay in Canada on restrictive bail conditions ever since as the US tried to have him extradited.

        Justice [Ronald] McKinnon thought this case met the test and was flabbergasted by Adekeyeâ(TM)s âoeshockingâ arrest during a judicial proceeding: âoeIt is simply not done in a civilized jurisdiction that is bound by the rule of law.â

        This was an egregious abuse of process and brought the administration of justice into disrepute, he concluded.

In his piece on this Sirota suggests that, if the US did conspire with Cisco, it probably did so in response to lobbying.

But I wonder if thereâ(TM)s not something more going on? Hereâ(TM)s how James Bamford described the governmentâ(TM)s efforts to partner with Cisco on wiretapping in his book, The Shadow Factory.

        One of the ways to covertly penetrate both the Internet and fiber-optic communications is to target their weakest point, the point where the systems interconnectâ"the routers.

        [snip]

        By discovering the weak spots and vulnerabilities of in this âoepostal service,â the NSA has the ability to target and intercept much of the electronic mail.

        Thus, as [Deputy Director for Services Terry] Thompson further explained at the 1999 meeting, one of the NSAâ(TM)s goals should be to hire away, on a short-term basis, people from key companies such as Cisco. Having hired them, the agency could use their knowledge and expertise to âoereverse engineerâ the systems and find ways to install back doors.

Just a gut level feel. If Adekeyeâ(TM)s initial suit hinted at something that played a key role in maintaining NSAâ(TM)s access to all communications crossing Ciscoâ(TM)s routers, or if a successful suit would have made it harder to suck the worlds telecommunications off the network, that might explain the governmentâ(TM)s seeming conspiracy with Cisco.

Alternately, maybe our government is just that fucking crazy.

Update: Hereâ(TM)s Ciscoâ(TM)s counterclaim against Adekeye. It claims, in part:

        Adekeye, a former Cisco employee, founded Multiven in 2005. Under Adekeyeâ(TM)s direction, Multiven has, on multiple occasions, unlawfully accessed, downloaded, used, and distributed Ciscoâ(TM)s valuable proprietary information. Among other unlawful acts, Multiven improperly obtained a Cisco employeeâ(TM)s login credentials for password-protected areas of Ciscoâ(TM)s website. Adekeye and Multiven thereafter accessed these areas of Ciscoâ(TM)s website and, among other things, illegally downloaded Ciscoâ(TM)s copyrighted operating system software for use in its business and, on information and belief, for redistribution to others.

        [snip]

        During his five years as a Cisco employee, Adekeye acquired confidential inside knowledge regarding Ciscoâ(TM)s proprietary information, internal operations, security, and personnel. Adekeyeâ(TM)s employment with Cisco ended on May 6, 2005.

        [snip]

        Adekeye and Multiven used at least two improper means to learn about Ciscoâ(TM)s service techniques and proprietary information, including information regarding Cisco configurations and bug fixes. First, they illegally accessed Ciscoâ(TM)s password-protected website to view Ciscoâ(TM)s TAC services resources, some of which are contained in a database rich with technical guidance regarding network configurations and software-related information.

        [snip]

        Multiven and Adekeye concealed their illegal and otherwise improper conduct. As a result, Cisco, despite reasonable efforts and precautions, did not begin to discover Multivenâ(TM)s and Aedkeyeâ(TM)s conduct until 2008.

Update: We donâ(TM)t yet know when the criminal charges against Adekeye were filed. But as Mary noted to me via email, the current US Attorney in NDCA, Melinda Haag,a came from a firmâ"Orrick, Herrington & Sutcliffeâ"that does a lot of work for Cisco. Also, she was hired to be an AUSA by Robert Mueller.

        Haagâ(TM)s firm bio says she was recruited by then-U.S. Attorney Robert Mueller, now FBI Director, to join the Northern District office, based in San Francisco. (Mueller was U.S. Attorney there from 1998 to 2001.) Haag was chief of the officeâ(TM)s White Collar Crime Section, and in private practice, she has represented several corporate general counsels accused of improperly backdating stock options.

Update: Interesting. A portion of Adekeyeâ(TM)s May 20, 2010 deposition was entered into the civil suit docket on March 7, 2011, including the part where the Mounties come in and arrest him.

One of the things they appear to have been suggesting is that someone was paying Multiven to sue Cisco. In the unredacted parts, he is asked about individuals and/or corporations who funded the suit. But thereâ(TM)s a chunk redacted after that.

Update: Hereâ(TM)s a brief from Cisco objecting after Adekeye and Multiven suggested they had lured him to Canada to be arrested.

http://www.darkreading.com/insiderthreat/security/perimeter/showArticle.jhtml?articleID=222600993 [darkreading.com]

http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html [forbes.com]

"Special Report
Cisco's Backdoor For Hackers
Andy Greenberg, 02.03.10, 01:45 PM EST
The methods networking companies use to let the Feds watch suspects also expose the rest of us.

ARLINGTON, Va. -- Activists have long grumbled about the privacy implications of the legal "backdoors" that networking companies like Cisco build into their equipment--functions that let law enforcement quietly track the Internet activities of criminal suspects. Now an IBM researcher has revealed a more serious problem with those backdoors: They don't have particularly strong locks, and consumers are at risk.

In a presentation at the Black Hat security conference Wednesday, IBM ( IBM - news - people ) Internet Security Systems researcher Tom Cross unveiled research on how easily the "lawful intercept" function in Cisco's ( CSCO - news - people ) IOS operating system can be exploited by cybercriminals or cyberspies to pull data out of the routers belonging to an Internet service provider (ISP) and watch innocent victims' online behavior.

But the result, Cross says, is that any credentialed employee can implement the intercept to watch users, and the ISP has no method of tracking those privacy violations. "An insider who knows the password can use it without an audit trail and send the data to anywhere on the Internet," Cross says.

Cross told Cisco about his findings in December 2008, but with the exception of the patch Cisco released following the revelation of its router bug in 2008, the security flaws he discussed haven't been fixed. In an interview following Cross' talk, Cisco spokeswoman Jennifer Greeson said that the company is "confident in its framework." "We recognize that security is complicated," she said. "We're looking at [Cross'] findings and we'll take them into account."

Cisco isn't actually the primary target of Cross' critique. He points out that all networking companies are legally required to build lawful intercepts into their equipment.

Special Report
Cisco's Backdoor For Hackers
Andy Greenberg, 02.03.10, 01:45 PM EST
The methods networking companies use to let the Feds watch suspects also expose the rest of us.

ARLINGTON, Va. -- Cisco, in fact, is the only networking company that follows the recommendations of the Internet Engineering Task Force standards body and makes its lawful intercept architecture public, exposing it to peer review and security scrutiny. The other companies keep theirs in the dark, and they likely suffer from the same security flaws or worse. "Cisco did the right thing by publishing this," says Cross. "Although I found some weaknesses, at least we know what they are and how to mitigate them."

The exploitation of lawful intercept is more than theoretical. Security and privacy guru Bruce Schneier wrote last month that the Google ( GOOG - news - people ) hackings in China were enabled by Google's procedures for sharing information with U.S. law enforcement officials. And in 2004 and 2005, a group of hackers used intercept vulnerabilities in Ericsson ( ERIC - news - people ) network switches to spy on a wide range of political targets including the cellphone of Greece's prime minister.

All of that, argues IBM's Cross, means that Internet-related companies need to be more transparent about their lawful intercept procedures or risk exposing all of their users. "There are a lot of other technology companies out there that haven't published their architecture, so they can't be audited," he said in his Black Hat talk. "We can't be sure of their security as a result."

- http://search.forbes.com/search/colArchiveSearch?author=andy+and+greenberg&aname=Andy+Greenberg [forbes.com]

(C) forbes.com

Lest we forget Part 1:

https://www.networkworld.com/community/node/57070 [networkworld.com]

"Cisco backdoor still open
IBM researcher at Black Hat says opening for Feds exposes us
By Jim Duffy on Wed, 02/03/10 - 5:33pm.

The "backdoors" that Cisco and other networking companies implement in their routers and switches for lawful intercept are front and center again at this week's Black Hat security conference. A few years ago, they were cause celebre in some VoIP wiretapping arguments and court rulings.

This time, an IBM researcher told Black Hat conference attendees that these openings can still expose information about us to hackers and allow them to "watch" our Internet activity. Backdoors are implemented in routers and switches so law enforcement officials can track the Internet communications and activity of an individual or individuals under surveillance. They are required by law to be incorporated in devices manufactured by networking companies and sold to ISPs.

In this report from Forbes, IBM Internet Security Systems researcher Tom Cross demonstrated how easily the backdoor in Cisco IOS can be exploited by hackers. When they gain access to a Cisco router, they are not blocked after multiple failed access attempts nor is an alert sent to an administrator. Any data collected through the backdoor can be sent to anywhere -- not just merely to an authorized user, Forbes reports.

What's more, an ISP is not able to perform an audit trail on whoever tried to gain access to a router through the backdoor - that nuance was intended to keep ISP employees from detecting the intercept and inadvertently tipping off the individual under surveillance. But according to IBM's Cross, any authorized employee can use it for unauthorized surveillance of users and those privacy violations cannot be tracked by the ISP.

Cisco said it is aware of Cross's assertions and is taking them under consideration. To Cisco's credit, it is the only networking company that makes its lawful intercept architecture public, according to the recommendations of the IETF, the Forbes story states. Other companies do not, which means they may be susceptible to the same security flaws, or worse."

Lest we forget Part 2:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com]

"Cisco Security Advisory
A Default Username and Password in WLSE and HSE Devices
Advisory ID: cisco-sa-20040407-username
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com]
Revision 1.4
For Public Release 2004 April 7 16:00 UTC (GMT)
Contents

        Summary
        Affected Products
        Details
        Vulnerability Scoring Details
        Impact
        Software Versions and Fixes
        Workarounds
        Obtaining Fixed Software
        Exploitation and Public Announcements
        Status of This Notice: Final
        Distribution
        Revision History
        Cisco Security Procedures

Summary

A default username/password pair is present in all releases of the Wireless LAN Solution Engine (WLSE) and Hosting Solution Engine (HSE) software. A user who logs in using this username has complete control of the device. This username cannot be disabled. There is no workaround.

This advisory is available at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com] .

Affected Products

This section provides details on affected products.
Vulnerable Products

These products are vulnerable:

        The affected software releases for WLSE are 2.0, 2.0.2 and 2.5.
        The affected software releases for HSE are 1.7, 1.7.1, 1.7.2 and 1.7.3.

Products Confirmed Not Vulnerable

No other Cisco products are currently known to be affected by these vulnerabilities.

Details

A hardcoded username and password pair is present in all software releases for all models of WLSE and HSE devices.

This vulnerability is documented in the Cisco Bug Toolkit as Bug ID CSCsa11583 ( registered customers only) for the WLSE and CSCsa11584 ( registered customers only) for the HSE.

CiscoWorks WLSE provides centralized management for the Cisco Wireless LAN infrastructure. It unifies the other components in the solution and actively employs them to provide continual "Air/RF" monitoring, network security, and optimization. The CiscoWorks WLSE also assists network managers by automating and simplifying mass configuration deployment, fault monitoring and alerting.

Cisco Hosting Solution Engine is a hardware-based solution to monitor and activate a variety of e-business services in Cisco powered data centers. It provides fault and performance information about the Layer 2-3 hosting infrastructure and Layer 4-7 hosted services.

Vulnerability Scoring Details
Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html [cisco.com] .

Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss [cisco.com] .

Impact

Any user who logs in using this username has complete control of the device. One can add new users or modify details of the existing users, and change the device's configuration. Here are some more concrete examples of possible actions:

        For WLSE this means that an adversary can hide the presence of a rogue Access Point or change the Radio Frequency plan, potentially causing system-wide outages. The first action may cause long term loss of information confidentiality and integrity. The second action can yield Denial-of-Service (DOS).
        For HSE this may lead up to illegal re-directing of a Web site with the ultimate loss of revenue.
        In both cases the device itself may be used as a launching platform for further attacks. Such attacks could be directed at your organization, or towards a third party.

Software Versions and Fixes

When considering software upgrades, also consult http://www.cisco.com/go/psirt [cisco.com] and any subsequent advisories to determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

For WLSE, users need to install the WLSE-2.x-CSCsa11583-K9.zip patch. The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/wlan-sol-eng [cisco.com] ( registered customers only) . Installation instructions are included in the accompanying README file, WLSE-2.x-CSCsa11583-K9.readmeV3.txt, in that same download directory. This patch is applicable to WLSE 1105 and 1130 software releases 2.0, 2.0.2 and 2.5.

For HSE, users need to install the HSE-1.7.x-CSCsa11584.zip patch. The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/1105-host-sol [cisco.com] ( registered customers only) . Installation instructions are included in the accompanying README file, HSE-1.7.x-CSCsa11584.readme.txt, in that same download directory. This patch is applicable to HSE 1105 for versions 1.7, 1.7.1, 1.7.2, and 1.7.3.
Workarounds

There is no workaround.

Obtaining Fixed Software

Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html [cisco.com] , or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml [cisco.com] .

Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.

Customers with Service Contracts

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com./ [www.cisco.com]
Customers Using Third-Party Support Organizations

Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.
Customers Without Service Contracts

Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.

        +1 800 553 2447 (toll free from within North America)
        +1 408 526 7209 (toll call from anywhere in the world)
        e-mail: tac@cisco.com

Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.

Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml [cisco.com] for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages.
Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

Status of This Notice: Final

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

Distribution

This advisory will be posted on Cisco's worldwide website at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username [cisco.com] .

In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.

        cust-security-announce@cisco.com
        bugtraq@securityfocus.com
        first-teams@first.org (includes CERT/CC)
        cisco@spot.colorado.edu
        comp.dcom.sys.cisco
        firewalls@lists.gnac.com

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.

Revision History

Revision 1.4

2004-April-12

Fixed URL for Cisco.com Downloads under Obtaining Fixed Software section.

Revision 1.3

2004-April-08

Updated Software Versions and Fixes section.

Revision 1.2

2004-April-08

Updated to include WLSE 1105 in Software Versions and Fixes section.

Revision 1.1

2004-April-07

Correction in the Obtaining Fixed Software section.

Revision 1.0

2004-April-07

Initial public release.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html [cisco.com] . This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt [cisco.com] ."

http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html?feed=rss_technology_security [forbes.com]

Cisco handholds hackers to backdoor
Routers are vunerable to wiretapping flaw
By Spencer Dalziel
Fri Feb 05 2010, 14:39

AN INSECURITY EXPERT at IBM reported to the Black Hat conference that he discovered Cisco routers are vulnerable to a potential surveillance backdoor.

According to Arstechnica, Tom Cross, security systems researcher at IBM, gave a presentation exposing the backdoor to demonstrate how the 'lawful intercept' function in Cisco's system can be targeted by hackers to gain access to data flowing through the routers.

Hackers aren't blocked after failed attempts to access a Cisco router and notification alerts aren't sent to the administrator. Making matters even worse, ISPs can't detect and track who the culprits might be because their employees aren't allowed to detect and intercept.

It is not entirely Cisco's fault. The 'lawful intercept' function was deployed after a US Federal Communications Commission (FCC) ruling a few years ago that allowed wiretapping by law enforcement agencies on all networking hardware. All telecommunications vendors had to build monitoring solutions into their hardware.

However this ruling meant all equipment with the lawful intercept functions had gaping holes that left them open to back door surveillance attacks.

Cross told Cisco about the problem in December and it issued a patch. But there are still a lot of vulnerable systems out there because network administrators haven't applied the patch.

Cisco's wiretapping system open to exploit, says researcher
By John Timmer | Published February 4, 2010 6:20 PM

To meet the needs of law enforcement, most telecommunications equipment includes hardware and software that allow for the monitoring of traffic originating with the targets of investigations. The precise capabilities are often dictated by formalized standards, which allow any hardware maker to implement a compliant system. Unfortunately, these standards often leave the hardware wide open to various attacks that leave regular users vulnerable, and provide savvy surveillance targets the opportunity to evade the snooping. An IBM researcher has put Cisco's system under the microscope at a Black Hat Conference, and found it comes up short.

Although the standard was designed to put Cisco hardware in compliance with EU directives, it has apparently been adopted by a number of other hardware makers. The presentation, described in detail by Dark Reading, describes how its reliance on SNMPv3, creates a variety of options for attack. For example, the protocol was initially vulnerable to a brute force attacks on its authentication system; although Cisco has patched that flaw, there's no way to determine how many unpatched machines remain in the wild.

SNMP also defaults to operating over UDP, and it's relatively easy to spoof things like the source address and port for that protocol. It's possible to use TCP instead, and even limit the addresses that can access the hardware, but the protocol doesn't specify either of these. Communications aren't encrypted by default, and the system won't notify administrators when a trace is activated or disabled, meaning that hackers could potentially set up or eliminate surveillance without anyone being aware of it.

The IBM researcher, Tom Cross, notified Cisco of the issues back in December, and recommends revisions to the standard that will ensure that it is more secure by default. That might be helpful, but it still wouldn't deal with the problems posed by unpatched systemsâ"Cross himself apparently recognizes that network administrators can be hesitant to risk the disruption of service that may come with updating major pieces of equipment.

IBM ISS Researcher Exposes Holes In Cisco's Internet Surveillance Architecture
Wiretapping architecture could be abused by individuals under surveillance and outside attackers; Cisco reviews recommended fixes

Feb 03, 2010 | 01:03 PM |
By Kelly Jackson Higgins

WASHINGTON, D.C. -- Black Hat DC 2010 -- An IBM ISS researcher here today revealed major security holes in a little-known wiretapping architecture for IP networks created by Cisco Systems for law enforcement. The weaknesses could result in an attacker interfering with legal surveillance or performing some unauthorized surveillance of his own.

Tom Cross, manager of X-Force Research at IBM ISS, says he first discovered the Cisco Architecture for Lawful Intercept in IP Networks, which was published as an IETF RFC in 2004, four years ago. The document, also known as IETF RFC 3924, is based on the lawful intercept architecture used by the European Telecommunications Standards Institute, and is implemented in Cisco's edge and switch routers -- the 7600, 10000, 12000, and AS5000 series products. Cross says other vendors also have deployed the architecture within their network devices.

Cross says an alleged criminal could discover that he was under law enforcement's surveillance using the current architecture, allowing him to manipulate or corrupt the information collected or to use the surveillance information for nefarious purposes.

Cisco had previously patched a SNMPv3 vulnerability in its router models used in the wiretapping architecture, but Cross says the architecture itself needs some repair, pointing out multiple weaknesses that could be exploited by attackers -- which he says he handed over to Cisco in December 2008.

Jennifer Greeson, communications director at Cisco, who was on hand at Cross' Black Hat presentation, says Cisco has been looking over his recommendations and, perhaps, how to incorporate them, she says.

"We are confident in our framework. That's why we published it: We recognize that security is very important" in this architecture, Greeson says.

Today was the first time Cross -- who says he had to put the effort on the back burner until recently due to other commitments -- has gone public with his research on the wiretapping architecture's weaknesses. Cisco's legal surveillance framework defines the architecture from which the "mediation device" remotely gathers intelligence on behalf of law enforcement from the surveillance target (someone under law enforcement investigation). Vendors such as Digivox, NICE Systems, Verint, and Utimaco make these systems. "The mediation device is the heart of the architecture," Cross says. "It is used by the administrator to provision" the surveillance and sends instructions to the devices that perform the actual surveillance, he says. That information is then reformatted and sent directly to law enforcement, he says.

Cross listed six weaknesses in Cisco's architecture that could lead to security breaches in surveillance: SNMPv3's susceptibility to brute-force credential discovery; password vulnerability in SNMPv3; lack of audit trails; the surveillance output stream's flexibility; the interface's vulnerability to packet-spoofing; and that the RFC doesn't require encryption.

While Cisco has patched the SNMPv3 authentication flaws (CVE-2008-0960), that doesn't mean its customers all have deployed those patches, he warns. Router patching is a particularly onerous process that often gets superseded by operational disruption concerns.

Even so, Cross says the biggest issues are architectural ones that must be fixed by Cisco and the IETF. "These are harder problems that require more thought," he says.

"My greatest concern is the lack of audit trails," he says. An attacker can "turn off" the audit trail, for instance, leaving the victim organization unaware of the activity. Attacks on routers that haven't patched for the SNMPv3 authentication flaw could easily be tracked with traps that monitor for these attacks, according to Cross.

Cross says Cisco's configuration guide for the architecture recommends that network administrators enable SNMP trap notifications to detect potential threats on SNMPv3 authentication, and it "implies" that traps will be sent for packets that carry an incorrect authentication key or any other packet that isn't part of the approved access list.

"I tested this, and there were no authentication traps. So I sent this to Cisco and said it didn't work," Cross says. "Cisco said the implementation was right, but the documentation was wrong [and rewrote the documentation]. So now it no longer says traps are generated.

"But a network administrator would want to know if his network was under attack."

Cross' recommendations to Cisco and the IETF include using a different port for surveillance, such as SNMP over TCP, which would be less prone to spoofing, limiting the addresses for the output stream, and moving notification control into the router configuration so that network administrators won't be able to monitor surveillance or interfere with it.

ISPs in their deployments for law-enforcement surveillance should not only patch for the SNMPv3 flaw, but also use encryption -- namely IPSec encryption, Cross says. Assigning user-group IP access control lists can help seal the authorized user of the lawful intercept action to the proper mediation device, he says. "Also, build out-of-band management networks," he says.

Re:rev.3 - Spook Backdoors in Cisco Routers (-1, Offtopic)

Anonymous Coward | more than 2 years ago | (#38847435)

tl;dr

Re:rev.3 - Spook Backdoors in Cisco Routers (1)

Anonymous Coward | more than 2 years ago | (#38848215)

Jesus Christ, Dude - go type your thesis somewhere else.

HOW DO I SIGN UP ?? (0)

Anonymous Coward | more than 2 years ago | (#38847233)

I want to join !! Do they take American Express ?? How about Western Union ??

Google privacy challenge accepted. (3, Insightful)

RandomAvatar (2487198) | more than 2 years ago | (#38847235)

As long as the website tells the truth in its privacy policy, https://ixquick.com/ [ixquick.com] will be more secure than Google.

there is also DuckDuckGo

Re:Google privacy challenge accepted. (0)

Anonymous Coward | more than 2 years ago | (#38847403)

DuckDuckGo uses Bing. What makes you think Microsoft cares about your privacy?

Re:Google privacy challenge accepted. (1)

heypete (60671) | more than 2 years ago | (#38849135)

They don't need to, so long as DDG does and you don't search for personally-identifying things about yourself.

Re:Google privacy challenge accepted. (1)

allo (1728082) | more than 2 years ago | (#38849865)

ddg sets no cookies with unique ids, so they cannot really track you for longer than to the next ip change (so approximate 24 hours only)

My Social Network Needs to Know (0)

Anonymous Coward | more than 2 years ago | (#38847365)

Quick! Everybody live-Tweet the event!

And don't forget to update your Facebook status!

Data Piracy Day (0)

Anonymous Coward | more than 2 years ago | (#38847549)

Is it just me or did anyone else read that as data piracy day?

We're EVIL now. Deal with it! (0)

Anonymous Coward | more than 2 years ago | (#38848167)

Look, instead of charging everybody 10 bucks a month which everyone would whine about paying we've gone ahead compiling a comprehensive and indestructible dossier on every man, woman, and child in the developed world, and crunching the data through a MapReduce farm 24x7 to figure out what people are likely to be thinking and doing next. We'll know what you're likely to do before YOU do.

Peace,
Larry, Sergei, and Eric

for a second there I thought (1)

ILongForDarkness (1134931) | more than 2 years ago | (#38848345)

Data Piracy Day and was thinking "yes". Everyone turn everything on to download stuff at the same time. Make those "legitament business use" people beg for mercy.

Why not February? (0)

Anonymous Coward | more than 2 years ago | (#38849111)

Sure, 4 days away from avoiding Black History Month!

What? (1)

Mariomario (2558403) | more than 2 years ago | (#38857823)

Sometimes I feel like there is a computer that randomly puts a few words together, put a random day of the year, then tell everyone what to do for a day. I take all these "_____ _____ day" as a joke now. Along withe "___-____month" as a joke. I'm going to make Jan 31 Tell a secret day.
Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...