Transforming Network Infrastructure Industry News

[July 28, 2005]

Cisco, Security Researcher Settle Dispute

(AP) Cisco, Security Researcher Settle Dispute
AP Technology Writer
SAN JOSE, Calif.
Cisco Systems Inc. and a network security firm reached a settlement Thursday with a researcher who quit his job so he could deliver a speech on a serious flaw in Cisco software that routes data over the Internet.

Michael Lynn, who left his job at Internet Security Systems Inc. hours before his speech, agreed never to repeat the information he gave at the Black Hat conference in Las Vegas on Wednesday.

He also must return any proprietary Cisco source code in his possession.

Cisco, the leading maker of Internet equipment, was supposed to join Lynn on stage. But the company and ISS changed course late last week and tried to cancel the session, going so far as to hire workers this week to yank pages from conference handouts and seek a court order.

The companies claimed the research was "premature" and would be presented at a later security conference. Lynn, however, said he felt obliged to report the problem before it was exploited in attacks that could endanger the Internet.

"Not to sensationalize, but it would be the digital Pearl Harbor we've heard about," Lynn said in an interview Thursday. "I felt it was the right thing to do for the country and for the national critical infrastructure."

The incident highlights the thorny issue of when to go public with a security problem. Security firms and computer vendors generally agree to do so when there's a patch -- or fix -- available.

But it's not always so simple. In the latest case, Lynn and other researchers at Atlanta-based Internet Security Systems discovered a technique that could allow someone to seize control of a Cisco router by exploiting a vulnerability in its operating system.

That flaw was patched in April, but it's possible that the same technique could be used to exploit other vulnerabilities in Cisco routers. Lynn said the technique also could lead to the creation of a worm that targets routers, particularly when coupled with an upcoming version of Cisco's operating system.

Cisco said it encourages independent security research but said in a statement that it felt Lynn's presentation "was presented prematurely and did not follow proper industry disclosure rules."

Chris Rouland, chief technology officer at ISS, said his company and Cisco agreed the research was premature. Rouland said Cisco did not pressure ISS.

But Lynn, who said it was never clear to him who was pressuring ISS, said it was important to get word out now.

Worms -- malicious programs that spread automatically -- are less likely in today's version of Cisco's operating system because the underlying software is different enough for each device. That will change in the next release, making it possible to attack a wide swath of routers without adjusting the malware for each unique configuration.

Such attacks, Lynn said, could modify routers en masse so that they cannot receive updates so they are always infected. Worse, attackers could erase instructions that tell the machine how to turn on.

"The purpose of doing this presentation was to prevent a worm from being made," he said.

His Las Vegas demonstration was stripped of any information that would lead anyone to figure out how the technique works, Lynn said.

He also said he decided to defy his employer because Cisco's operating system source code had been stolen and posted on a hacker Web site. Additionally, Lynn said, he has seen discussions of Cisco vulnerabilities posted on Web sites for Chinese hackers.

"Cisco has never told anybody that it was possible to take over one of their routers," Lynn said. "They fought that argument for a long time. You can see how far they're willing to go. I demonstrated it live on stage. That debate is over now."

Such information is one of the key points of the Black Hat conference, said organizer Jeff Moss. The event attracts thousands of computer security experts from business, academia and government.

"The point of the talk was to demonstrate there's a problem -- that you need to update all your software as soon as you can because of these types of problems," said Moss. "It wasn't a roadmap to world destruction."

As part of the settlement reached Thursday in San Francisco federal court, Black Hat also agreed to return any video of Lynn's presentation.

It's not clear why the decision to cancel the presentation was made only a few days before the conference was to begin. Moss said ISS first contacted Black Hat several weeks ago about the possibility of pulling presentation material from the handouts given to every attendee.

Until last week, ISS never followed through with a request to actually remove the material.

That changed when Cisco and ISS hired a team of temporary workers to yank about 20 pages from thousands of conference binders and replace compact discs with presentation materials.

"The speech had been vetted like two or three times through ISS's PR department. Everything was great, and ISS was contacting the media telling them to come see this talk," Moss said. "Then last Thursday or last Friday there was a total about-face on ISS's part."

[ Back To Transforming Network Infrastructure's Homepage ]

Featured Blog Entries

The History of Fiber in Data Centers, Part II

As I stated at the close of "The History of Data Centers, Part I," Fiber Mountain™ believes data centers must evolve from hub and spoke architecture—in which traffic is aggregated and delivered to a central hub—to a design that includes many direct connections.

Three Things Your Boss Wants—No, Needs—To Know About Glass Core

Fiber Mountain™ CEO and Founder— plus my longtime friend—M.H. Raza does a terrific job on this blog of explaining how our Glass Core™ architecture transforms the way data centers build their network infrastructure.

The History of Fiber in Data Centers, Part I: Past and Present

Fiber Mountain, as our company name suggests, believes fiber cabling must play a central role in helping data centers scale affordably as bandwidth needs continue to grow. Before I go further down the path to the future, however, I want to back up and provide a high-level history of fiber in the data center.

Four Reasons to Make the Leap to SDN in Your Data Center

I'm always fascinated by what causes a business trend to emerge, grow and sometimes expand to actually redefining the industry as a whole. Having spent years in the technology field, I've found the networking sector particularly exciting in this regard because true innovation can and does transform entire segments of our industry. Revolutionary processes and technologies make past deployments and best practices look laughable in light of recent innovations.

Reflections From the Fiber Mountain Launch

Over the past weeks and months, the Fiber Mountain team has worked hard to prepare for our company launch at this year's Interop New York. In this post, I want to share our thoughts from the days leading up to the October 1st unveiling and about the event itself at the Jacob Javits Center in Manhattan.

Featured Event

ITEXPO Miami 2015

January 27 - 30, 2015
Miami Beach Convention Center
Miami, Florida

9:30 - Wed. January 28
M. H. Raza
Fiber Mountain™
Founder & CEO

Video Showcase