Thanks fun kite posted: things are from the July 27 L.A Black Hat meeting start ….
Report road are as follows:
Cisco (Cisco Systems) company to decide to take legal action, prevents security research personnel further step talk how 駭 router software into this company.
Internet the large factory from Cisco systems and the Internet Security Systems (ISS) 2008–09 sleeve to the Court, upon request, to the Black Hat Security meeting Michael Lynn Festival main office units-stub 緊 emergency prohibition order. Lynn black hat in this meeting has shown attacking 擊 personnel on how to hack into the Cisco router, and says this law make to let the net international Internet road because of crippling blow.
This region made by a local court in Northern California tell asked a judge to ban black hat Lynn stub “is not permitted to disclose ISS focus of Shu shu Cisco stub information. “Cisco post man John Noh said.
“Our 認 because Lynn yesterday morning at the Black Hat made by general meeting information was obtained illegally, and 違 by our Intellectual Property. “Noh said. He pointed out that Lynn order to their own research while dismantling a Cisco software, Ju has been breach the rights and interests of this company.
Lynn in yesterday’s Black Hat ju row at the general meeting speeches by a small time, Cisco will immediately take legal action. Lynn as a stub, say the meeting he ju Office this time speeches by 辭 but actually built out of a research member of ISS (because ISS come decide not ju Office this airport after speeches by). Some related article says of the vulnerability as well as speeches by central theme of the original (“The Holy Grail:Cisco IOS Shellcode and Remote Execution”, “edit version San Cup: Cisco IOS section of Qiao long program code stub-end Executive”) also notice removed from the general meeting the proposed range.
Lynn ju using IOS project known weak points, have on the Cisco Internetwork for industrial system lines of program code further attack 擊. A problem of software used in Cisco routers and routers are group into net international Internet foundations of road equipment. Airport large scale attack 擊 may crippling blow net international Internet road, he said.
Professionals attending the Black Hat Concilium said Lynn range attack 擊 Zuan as shown in security vulnerability have been pass report from Cisco systems, and is the latest release of IOS current or her contribution.
Lynn was originally a surname Shu ISS research group team Monday (25th) to decide to cancel this airport Presentation meeting, ISS technology long Chris Rouland accept Fang Wen times said. “Yet finished preparing 畢,” his said. But Lynn 27th morning di 辭, Ju row Presentation meeting as you normally would.
Fu 雜, PCCW-Black Hat the sources claimed said, wants to cancel Presentation meeting not ISS and Lynn, but Encore. Message source revealed that Lynn get instructed, to his central theme of living matter in different, such as the living NET road Tel (VoIP) security.
But representatives of Rouland said ISS development, 絕 have on the allocation for any reasons not airport VoIP Presentation meeting, ISS had planned to completely abolish the Presentation of the 27th meeting. “This project was really important, research foundations are also important, but we should be left and the Cisco collaboration, have on the impact of Pan 評 revaluation,” Rouland said.
Cisco does not immediately back to the application. The past years, Encore DVD-level on IOS security vulnerabilities. This online road equipment giant said last year, IOS is part of the original code lost 竊, the outside world 憂 慮 more security weak points possible exposure.
27th 擊 range of angles is directly connected as shown in line of routers, not progress through online international online road attack 擊 long end of the line. “You can capture your own router, rather than the long side of the router,” Rouland said.
One Black Hat attendees say he have on the Lynn struck by the range as shown in. “He 輕 and Ju intrusion Qiao program, then show the basic attack 擊 method. Many people have voice Steelyard balance, this cannot Office be, but he sat in the children’s Office, under three two is up, “security studies Member Darryl Taylor says. “Qiao program” (Shell) is a kind of a command prompt and have on the industry reached under system control instructions.
Rouland said, ISS is studying whether to have on the Lynn to take legal action. When Lynn Presentation like this range of time, no longer has the ISS staff identity, Rouland said.
After they have completed Presentation, to listen to Lynn audience showing his Résumé table, announced that he would find a new job.
Lynn did not accept this article Fang Wen. Black Hat Conference wikis work personnel, said Lawyer Lynn stub meet the living.
Next August 1, Richard Forno is beating in his net “Infowarrior.org” away inside black hat made in receiving Internet meeting content Security Systems (the ISS) represents future communications Lawyer
Presentation road as follows:
Is clearly in order to prevent Cisco (Cisco Systems) Presentation content flow tradition of router security vulnerability to the global information online, because there is another person details wrap around labeling security weak points at the net while on the road were 訴 訟 Wei 脅.
Information professionals and the writer Richard Forno through electronic post code pieces, have received Internet Security Systems (ISS) represent the future of Lawyer letter after gone with his Presentation content from the site Infowarrior.org remove, wrap around labeling a data modification says by ISS legal customers ask Piper Rudnick Gray Cary Lawyer business region issued fax correspondence.
ISS development people the night of 29th now does not immediately monthly real has been a burgeoning Lawyer, have on the wrap around labeling Presentation content site made Zhang tell. Cisco issued statement said, is working and the ISS to processing the matter, and he share of ISS is issued Presentation requires site removed content of notice.
Security research member Michael Lynn Wednesday (27th) morning in Los FIR Los Angeles black cap security meeting proposed (Black Hat Security confab) Shang for about us report, main problem is “thought ` branch IOS between Qiao program code stub long end Executive line”, set off a WA so, due to because he does not customers Cisco and Qian employers ISS of anti-have on the, 堅 holding as shown in range how Zuan security vulnerability, further and control Cisco of router. Lynn post before performing says, Cisco and the ISS has agreed to remove this airport Presentation meeting, but Lynn Resignation, as far as reserve here plan speeches by.
Cisco and the ISS after gone with the Court, 尋 finding have on the Lynn and Black Hat Conference wikis under main office personnel reached password. Tripartite Thursday (28th) reach agreements, Lynn agreed that 絕 no longer chorus chant 講 in his Black Hat revealed information, and surrender his holding all of Cisco’s original code.
Forno Zhang wrap around labeling Presentation content, seems to be 擷 drawn from the Black Hat Concilium report hard copy Bell. At Black Hat before the Concilium start Cisco additional notice of workers in a meeting report from the thick, Cisco security weak points have removed stub related article section, and how important do Hui CD, change to a new. But some attendees also have Office made by the original disc.
Lynn ju Executive 擊 programming method of attack, by using the Internetwork Operating System (IOS) one of the known security weak points, on the IOS attack 擊 Executive program. This software Executive on the Cisco router, and router are group into net international Internet 礎 facility of subgrade foundations, once the commercial was a generic attack 擊 may create net international Internet road, you need to take immediate action, taking the important foundations of protection facility.
Lynn phantom 燈 of the content is still available to other site blatantly download, including Cryptome.org inside. This airport Presentation content through large Member of the Full Disclosure security post code father single stream tradition.
Black Hat Concilium 28th end. DefCon–駭 set more informal meeting–Michael Lynn was hailed fumble recovery in the opening post information protection net international Internet hero of the road. DefCon attendees pain Cisco and ISS man computer think only Zhuan money, 卻 not customers and how to ensure customers data is safe.
Lynn Lawyer Jennifer Granick Friday (29th) says, when people notice of her Federal Government investigation. Her no refusal to disclose further details of the steps, only says this thing could soon meeting ends, for Lynn, ISS and Encore three parties had reached agreements.
29th release of Cisco security notifications, Lynn used by the detailed IOS security weak points, and confirmation of bearing 認 駭 may use weak point of this project seems to take over your router, but voice Steelyard balance 潛 Injury limited, for 駭 this should be a stub router directly connected online, can not be through online international long-side Executive, online road attack 擊.
PCCW-Cisco’s announcement, security vulnerabilities in the processing of the old version of IOS IPv6 packets. Carefully make special data packet may let gangs control router, but only from the area type layers by content development for mobile, Web road attack 擊 is possible, and because only IPv6 equipment group Phase match production Executive on the system.
Cisco control Phase in many ways after the post at the following security bulletin and the official Shuo method
Report road are as follows:
Week five on Cisco public release about one vulnerability announcements in their router software, focus said, this vulnerability may have been 駭, to the net international Internet road have a disruptive impact.
Cisco said in its security bulletin, old versions of Web net international Internet road road IND system (IOS) processing IPv6 data packet vulnerability exists in the way. The passage of special processing data packets can be enough make 駭 control router, but attacking 擊 can only be found on the local end of road NET and used in processing the IPv6 systems.
IOS hissing ye good skill spectrum Mu phenol a legendary evil spirit causing drought-Greek Xuan Pv6 road is the next generation of net international Internet Association. Cisco has been at the April release of the new version fixes this vulnerability in IOS, urges the user upgrade the router software they use.
With the sample in the previous week, a research personnel Michael Lynn are not customers of Cisco and his employer Web international on-line road safety system (ISS) corporate anti-yeah, public open range as shown in how to use this vulnerability to future control router, does attack 擊 return of post. Zheng matter related article range did not qualify for this vulnerability but exists. Although Cisco announcement 擊 認 attack is possible, but only 駭 time is only going to post on the directly connected to the router attack 擊. But Lynn and enter the Black Hat Security meeting a number of research personnel 認 thought, 駭 attack 擊 return of passenger may be issued from the long end.
Lynn at Black Hat as shown on the meeting very 惱 fire range of Cisco, ISS, they make Lynn lawsuit Court, asked the Court to prohibit Lynn and Black Hat main office list-is not permitted to release category information. Shanghai Vive party in week four reach into the proper Association, Lynn m application is no longer public release in this Concilium on public release of information, and handed him to master all of Cisco’s original code.
In week four at the News Conference, Lynn said he 認 yourself no CUO. He said, using his method is possible to destroy the Hui router, chorus chant this attack 擊 lclose sections or one enterprise Web net international Internet road road. May Cisco IOS original password loss last year 竊 also increases the 駭 use this vulnerability to attack 擊 possibility of return of post.
Cisco and ISS, said Lynn research progress is not perfect, they still understand this vulnerability affect how big is the range did not qualify.
Although Cisco’s Reaction is very fast, but its high pressure tactics there is a lot of people do not man caused by non-dominance, people attending the Defcon security Concilium 紛 紛 voice aid Lynn Italy practices.
Report road are as follows:
Enter Defcon Security Conference wikis personnel rally together against the proposed ISS yeah Michael Lynn Cisco stub high pressure tactics.
Lynn in week three of on black cap meeting 堅 辭 to ISS work seems to show how security vulnerabilities can be used to control Cisco router. Cisco and the ISS has been previously said well you want to cancel this airport Concilium, and Lynn rules 堅 refused to complete agreements. Cisco and the ISS after gone with the Black Hat meeting rules 訴 Lynn stub main office single-flagrant leaking hole leakage of illegally acquired special Shu information.
Although enterprises have on Lynn’s action may not 贊, but his Defcon (category a set of informal meeting of the security professionals) has become a hero. Printing the anti-yeah Cisco practice t-shirt Super fin Mai, even there are 駭 residents set up PayPal special Xian username from the current litigation fund donation.
Saturday, limiting Raven Alder has also made a road safety professional home airport network 礎 of subgrade construction equipment vulnerability analysis says that she did not attack 擊 chorus chant Lynn show, but Alder said Lynn says laws have on the net quite large importance of road safety.
“This is the first time anyone really can be long-end Zong your Cisco machine,” Alder yeah the whole airport blast man listen to audience and said, “If you are Internet pipe member, you definitely going heart 驚 膽 jumps, this prestige 脅 is awful. 」
Lynn has previously said that this vulnerability can allow the entire personal net international Internet road because of crippling blow. He also warned that says, the black sheep 駭 say indefinite has been start set to work to exploit this vulnerability.
Alder in his speech said rules range as shown in how to test Web 礎 of subgrade construction equipment security. Although Cisco loopholes in its implementation has been amended as early as April, but her attack 擊 Cisco did not 針 have on the Lynn vulnerability attack released on week five 擊 issued security notices by letter
Safety notices in the letter, monthly real old version of Cisco Internetwork Operating System in processing IPv6 packet time meeting is vulnerable, routers can be achieved if interested parties take advantage of control rights, but Cisco also said this attack 擊 road only from the local side of Web development is available, and there is still only the equipment will use IPv6 system is going to affect.
Alder said Cisco says method not completely positive confirmation, because this is a very genuine long-side vulnerability. Meeting other stub also echoed the said law, “large livly 擊 scale of attack, then short range attack 擊 離 router is possible,” one said Iowa University graduate Robert Hansen in Computer security.
Alder 砲 轟 訴 Lynn from the Cisco approach.
“Cisco, you get things screwed up,” this telephone says the future meeting airport 陣 Palm of thundering voice, “charged research personnel does not going to let you change much more security. Your safe communities program clear boundaries, since they are not going to cooperate with you, to you to report safety problems. 」
Stub Club now airport road of China Defense Department Web Centre Head Office Director Jim Christy said, “you can share information, but the best is through positive confirmation of the pipeline. 」
Lynn week four ISS reached a total identification with Cisco stub, after he agreed to no longer going to Black Hat this time in the general meeting on the East West you say, he returned to the hands holds all of Cisco’s original code.
Wind 箏 short 評:
Although provisional time to subside, but if Cisco does not take forward-preventing measures, we have reason to believe that this category make the event in the near future there is going to take two connected three post. Order Cisco network equipment for world’s largest companies, it is necessary to draw on this event teach training to improve their security organization and now about the matter.
Above report road source: Cnet Taiwan extends 評 matter changes into the current safety professional home fan manufacture? 》
Original: Mary Ann Davidson Translation: Chen Zhi Wen
Source: Cnet Taiwan
About safety research member, there is one common myth: software is a group does not want to – or even want to level quickly to save the security weak points of indifference 懶 ghosts unless noble members through public open security research uncovers 脅, forcing them to take action.
On from the reality, most software City efforts to improve the security of the digital processing of the weak points, without any external force “Wei 脅”. But some research member, has been to be a fan make.
Telephone although, I would like to thank those who really serve the public interest research members pay, they are not, as some e notorious fellow, executives often boarded the Tau article press release. But I also 認, software companies group needs to improve the quality of commercial software, reducing less security vulnerabilities exist.
Following is a general use have on software security research member stub some myths of return of each other:
1. inside you applied this in two days finished level on save
Some studies Member 認 because, they can be through Granville 脅 “external voice Zhang”, forcing the software faster processing times. If software companies really hard, can definitely reached them of any given 5, 15 days,/30 day “contribution to save window”.
On from the reality, when study members to report some personal security weak points, adds rescue methods or most are two trip takes 20 minutes to complete the modifications. However, make contribution programs delivered to customers, and often take several week. PCCW official jiao is a program, software may need to analyze this CUO Wu whether a particular version/platform, or any version/any platform, or program code for the desired analysis-related article is a category a problem (in order to further universal repair contribution). Software may also need to provide multiple kinds of version/platform contribution program, or poll item security contribution program that makes customers adds costs to a minimum, don’t say the necessary items of test in order to ensure any contribution saved the method itself is not going to stub East West yeah Chong.
For example come say, Oracle Corporation (Oracle) had its 針 have on the single security weak points the progress line 78 personal contribution, for spend 5 days to complete. We also tie in with the quarterly financial statements report poll count time, 釋 item level Combination of programs. (Many customers do not want in a quarterly poll is outside of time, they return of more of the production system. ）
Simple two lines of program code modifications can be completed in 5 minutes inside, but make available immediately sent a contribution program into the hands of customers, 絕 non-several minutes, to obtain the final things.
2. the statement, the Huai, more business
Many research member 認 because, they open to expose security vulnerabilities more, meeting with more software please they employed Dan customers ask. Some people about us straight is blackmailed (“pay me money not rules I 買 to iDefense”), or suggestive Wei 脅 (“three week six days adds good, Black Hat meeting because I want to post an article reporting”).
On the implementation of international, many of the most priority show research member, China, most people didn’t even listen to but because they work low Musical keys are one Asset. They usually do not return of those mobile study of voice shouting to media members high pole. We only going to hire to customers recommendation please does who acted 謹 carefully study members.
In addition, the gas will also self-injury: I know there are customers because research members announce security weak points of spy programs and his contract. Bong 勸 諸 security professional, when you post on the Black Hat meeting time, or most able to win customer praise 賞 駭, but the company is not going to pay money to your normal self 斷 its first. Knowledge aselia with gone with the responsibility to either.
3. I found the weak point, my current credit
Most DVD software meeting accumulated points-based incentive to report security vulnerabilities research member in order to continue their and their cooperation. In addition, the said statement “thank you for your cooperation,” just basic Ronald Holmes appearance. Here myth is that members always right get award encouraged the study.
On the implementation of international, current research members have time now in the software business contribution arbitrarily 釋 spying program before saving problem, resulting in customers notice of a security risk, difficult road, but ridiculous to expect software yeah he says “thank you place our customers at risk and nature” Ma? I met customers asked us to provide from the not spying programs or related article details, but they all want enough information to make the risk of foot 評.
In some cases, software effort, merit and even larger than the research members also. For example come say, Oracle’s own major security vulnerabilities found more than 75%. However, if a research member found a project we have been found on their own, but may not have been level on the problem, we usually just the meeting to the personal application of accumulated points-based incentive.
Security research member is not all are noble sentiments, software makers also is not entirely indifferent 懶 ghosts. The most important is that this fight the highest purpose of every people in the airport, nutrited protection users of these products from hurt.
Bian: the writer is Oracle security long, burden responsibility accident processing software security 評 stub.