NSA stealing VPN data

[Skiiwee29]

http://arstechnica.com/security/2016/08/cisco-firewall-exploit-shows-how-nsa-decrypted-vpn-traffic/

 

In a revelation that shows how the National Security Agency was able to systematically spy on many Cisco Systems customers for the better part of a decade, researchers have uncovered an attack that remotely extracts decryption keys from the company's now-decommissioned line of PIX firewalls.

The discovery is significant because the attack code, dubbed BenignCertain, worked on PIX versions Cisco released in 2002 and supported through 2009. Even after Cisco stopped providing PIX bug fixes in July 2009, the company continued offering limited service and support for the product for an additional four years. Unless PIX customers took special precautions, virtually all of them were vulnerable to attacks that surreptitiously eavesdropped on their VPN traffic. Beyond allowing attackers to snoop on encrypted VPN traffic, the key extraction also makes it possible to gain full access to a vulnerable network by posing as a remote user.

 

"It shows that the NSA had the ability to remotely extract confidential keys from Cisco VPNs for over a decade," Mustafa Al-Bassam, a security researcher at payments processing firm Secure Trading, told Ars. "This explains how they were able to decrypt thousands of VPN connections per minute as shown in documents previously published by Der Spiegel."

 

 

This is crazy. I work with ASA's on a near daily basis as well as other networking equipment here with my job and this just makes me want to vomit. 

[Atmos]

Post doesn't meet requirements. Please edit it to follow guidelines.

 

As for the content, it is what it is. The NSA is going to do what it does, and nothing should be a surprise at this point. Either we step up and force them to stop through action, or nothing and allow them to continue to stomp on rights.

[ThinkWithPortals]

QUICK! MORE TIN FOIL! IT'S THE ONLY WAY TO PROTECT OURSELVES!

[Skiiwee29]

I looked and didnt see this topic. If it had been, please do link it to me. 

[ThinkWithPortals]

3 minutes ago, legacy99 said:

I looked and didnt see this topic. If it had been, please do link it to me. 

No, it's not that. It's that you need to include:

- Quotes from the source

- Topical images

- Your opinion

[Skiiwee29]

1 minute ago, ThinkWithPortals said:

No, it's not that. It's that you need to include:

- Quotes from the source

- Topical images

- Your opinion

better? it still makes me want to vomit, thats my opinion

[ThinkWithPortals]

Just now, legacy99 said:

better? it still makes me want to vomit, thats my opinion

Yeah, that's fine

 

And I completely understand your opinion, Jesus Christ the NSA pulls some sneaky shit...

[Skiiwee29]

Just now, ThinkWithPortals said:

Yeah, that's fine

 

And I completely understand your opinion, Jesus Christ the NSA pulls some sneaky shit...

Yea, really bugs me as we use ASA's to block hackers from feeding garbage into some of our video feed and/or destroying that box its on at the ISP level. I know its not the confidential level that companies would want/need when doing VPN tunnels between 2 sites to transfer data from main corporate office to a remote site. 

[Misanthrope]

24 minutes ago, ThinkWithPortals said:

QUICK! MORE TIN FOIL! IT'S THE ONLY WAY TO PROTECT OURSELVES!

I don't think it's thin foil when the snooping has been confirmed. The only "tin foil" part is assuming they have done, will do or even can do anything meaningful with the information but the fact it happens it's not in question: it did happen, to US citizens even.

 

More over, hundreds of companies (maybe even thousands worldwide) pay millions of dollars to use Cisco systems to get to their data. They have been shown to be compromised. As a company you might not be terribly worried that the American government will come after you for something like tax evasion or such (since the information was illegally obtained for any process other than terrorism fighting anyway and even then dubiously legally) But then again you've got all this hardware you need to upgrade and you could go with the fuckups that let security holes into their hardware and trust nobody else will be able to do it in the future or that it doesn't gets into more sensitive hands...

 

...Or you just fucking go with someone else. Suddenly you kinda know why Cisco was firing 17k people (then later claiming only 5k but I bet 12k will still be outsourced positions no longer in company ppl) and in trouble.

[KuJoe]

It's a good thing that the vast majority of consumer VPNs (at least 99%) don't rely on Cisco appliances so the only people this really impacts are people and companies (mostly companies) who use Cisco appliances for their VPN connections. The only people really affected by this are people who use unsupported VPN appliances which at this point is really their own fault for using a something that was EOL 7 years ago.

[Curufinwe_wins]

2 minutes ago, Misanthrope said:

I don't think it's thin foil when the snooping has been confirmed. The only "tin foil" part is assuming they have done, will do or even can do anything meaningful with the information but the fact it happens it's not in question: it did happen, to US citizens even.

 

More over, hundreds of companies (maybe even thousands worldwide) pay millions of dollars to use Cisco systems to host and get to their data. They have been shown to be compromised. As a company you might not be terribly worried that the American government will come after you for something like tax evasion or such (since the information was illegally obtained for any process other than terrorism fighting anyway and even then dubiously legally) But then again you've got all this hardware you need to upgrade and you could go with the fuckups that let security holes into their hardware and trust nobody else will be able to do it in the future or that it doesn't gets into more sensitive hands...

 

...Or you just fucking go with someone else. Suddenly you kinda know why Cisco was firing 17k people (then later claiming only 5k but I bet 12k will still be outsourced positions no longer in company ppl) and in trouble.

Technically you don't actually know if they were stealing this data. Having the ability to do so, and doing so are not the same thing, although I doubt anyone would actually think they are not doing it.

 

Also, other people can play their "all high and mighty" card about their government doing this or that, but literally every single government with the resources is doing everything they can get away with in the cyber field (which is far more than any other venue because laws and oversight in that media are archaic at best), so calling it the "American Gov" is out to get you is super duper tin-foil. EVERY government wants your data just like every company does and every bit of malware does, and you can be quite thankful the US (and generally speaking China/Russia/UK/etc) governments don't do anything close to directing the thrust of their efforts your way (I say this generically).

 

By this comment, I do not mean to condone the "if everyone is doing it then it's ok" argument, but people need to stop pretending it is an American issue, and recognize it is a global issue that we all have to condemn globally.

[AresKrieger]

You remember a time when this kinda thing was considered a crazed theory by nut released from the insane asylum because I do, but now it's common place and most people don't seem to care as much as they should. A government who can see anything has the power to snuff out dissent very easily. I don't like where all this crap is going, and neither should anyone else.

[Misanthrope]

1 minute ago, Curufinwe_wins said:

Technically you don't actually know if they were stealing this data. Having the ability to do so, and doing so are not the same thing, although I doubt anyone would actually think they are not doing it.

 

Also, other people can play their "all high and mighty" card about their government doing this or that, but literally every single government with the resources is doing everything they can get away with in the cyber field (which is far more than any other venue because laws and oversight in that media are archaic at best), so calling it the "American Gov" is out to get you is super duper tin-foil. EVERY government wants your data just like every company does and every bit of malware does, and you can be quite thankful the US (and generally speaking China/Russia/UK/etc) governments don't do anything close to directing the thrust of their efforts your way (I say this generically).

 

By this comment, I do not mean to condone the "if everyone is doing it then it's ok" argument, but people need to stop pretending it is an American issue, and recognize it is a global issue that we all have to condemn globally.

Aye your point is reasonable: That's why I believe open source software and Linux is the answer: it just cannot be under anyone's control because it has no centralized control. You get a lot more problems like harder innovation since everyone can pull projects on different directions and such but for sensitive stuff like IT security is preferable to a closed source model.

[Lurick]

1 minute ago, Misanthrope said:

...Or yuu just fucking go with someone else. Suddenly you kinda know why Cisco was firing 17k people (then later claiming only 5k but I bet 12k will still be outsourced positions no longer in company ppl) and in trouble.

We won't be outsourcing any jobs, if anything we're bringing more jobs into the states because well outsourcing has done more harm than good in terms of quality overall. I won't go too far down this rabbit hole but about 75% of engineers I deal with in India have this mentality of "oh I don't know what to do, let me sit here and do NOTHING for a week or two until someone asks me if I have problems instead of asking questions or reaching out for help". I know it's most likely a cultural thing and management is wising up to this and they aren't happy. These are just my own thoughts and experiences on the whole issue and don't represent anything else or anyone else.

 

This vulnerability also impacts the PIX firewall and not the ASA line of firewalls which are far more robust and still receiving updates and support. The older models of the ASA (the non -X versions) are losing support or have, I forget which, and we're encouraging customers to move to the newer models which of course have continued support and improved code quality and whatnot. Of course I'm sure our wonderful government overlords have found vulnerabilities which they don't want to disclose but when Cisco finds them they get a patch pretty quickly, can't catch everything but hopefully people find and disclose vulnerabilities that otherwise would be used and abused.

[Curufinwe_wins]

Just now, Misanthrope said:

Aye your point is reasonable: That's why I believe open source software and Linux is the answer: it just cannot be under anyone's control because it has no centralized control. You get a lot more problems like harder innovation since everyone can pull projects on different directions and such but for sensitive stuff like IT security is preferable to a closed source model.

Well that and for trapping non-tech savy users, it is hilariously easy to intercept/manipulate the code even before installation. Making the security back down to clicking the right link, which I think we all know how badly that will go for the common person.

[Trik'Stari]

15 minutes ago, Misanthrope said:

I don't think it's thin foil when the snooping has been confirmed. The only "tin foil" part is assuming they have done, will do or even can do anything meaningful with the information but the fact it happens it's not in question: it did happen, to US citizens even.

 

More over, hundreds of companies (maybe even thousands worldwide) pay millions of dollars to use Cisco systems to get to their data. They have been shown to be compromised. As a company you might not be terribly worried that the American government will come after you for something like tax evasion or such (since the information was illegally obtained for any process other than terrorism fighting anyway and even then dubiously legally) But then again you've got all this hardware you need to upgrade and you could go with the fuckups that let security holes into their hardware and trust nobody else will be able to do it in the future or that it doesn't gets into more sensitive hands...

 

...Or you just fucking go with someone else. Suddenly you kinda know why Cisco was firing 17k people (then later claiming only 5k but I bet 12k will still be outsourced positions no longer in company ppl) and in trouble.

"B...B.....But nothing to hide nothing to fear!"

 

Nevermind that that was a saying that Hitlers SS used.....

[KuJoe]

2 minutes ago, Lurick said:

We won't be outsourcing any jobs, if anything we're bringing more jobs into the states because well outsourcing has done more harm than good in terms of quality overall. I won't go too far down this rabbit hole but about 75% of engineers I deal with in India have this mentality of "oh I don't know what to do, let me sit here and do NOTHING for a week or two until someone asks me if I have problems instead of asking questions or reaching out for help". I know it's most likely a cultural thing and management is wising up to this and they aren't happy. These are just my own thoughts and experiences on the whole issue and don't represent anything else or anyone else.

I wish Cisco would outsource to Ireland like VCE does. Those guys are awesome to deal with (even though the vBlocks are a total PITA).

[Misanthrope]

3 minutes ago, Lurick said:

We won't be outsourcing any jobs, if anything we're bringing more jobs into the states because well outsourcing has done more harm than good in terms of quality overall. I won't go too far down this rabbit hole but about 75% of engineers I deal with in India have this mentality of "oh I don't know what to do, let me sit here and do NOTHING for a week or two until someone asks me if I have problems instead of asking questions or reaching out for help". I know it's most likely a cultural thing and management is wising up to this and they aren't happy. These are just my own thoughts and experiences on the whole issue and don't represent anything else or anyone else.

 

This vulnerability also impacts the PIX firewall and not the ASA line of firewalls which are far more robust and still receiving updates and support. The older models of the ASA (the non -X versions) are losing support or have, I forget which, and we're encouraging customers to move to the newer models which of course have continued support and improved code quality and whatnot. Of course I'm sure our wonderful government overlords have found vulnerabilities which they don't want to disclose but when Cisco finds them they get a patch pretty quickly, can't catch everything but hopefully people find and disclose vulnerabilities that otherwise would be used and abused.

I'm surprised to hear this since Cisco certifications are actually a defacto requirement in the IT world and while they're not terrible difficult to achieve they are at least a reasonable base point vs the alternative (which is well, fuckall in the way of certification or assuring knowledge and such)

 

But that's rather interesting, thanks for sharing.

[Lurick]

Just now, KuJoe said:

I wish Cisco would outsource to Ireland like VCE does. Those guys are awesome to deal with (even though the vBlocks are a total PITA).

Yah, I like working with the guys in Europe and wish we would hire more people over there.

[AresKrieger]

Just now, Nicholatian said:

Fact is, it was still true to a lesser extent even back in the 80s and 90s. Landline wire tapping, cell phone call tracing… the Internet just wasn’t a target yet. Plenty of people said those things were bogus because of an inflated sense of security + a failure to think critically back when those things were prevalent.

That's exactly what I'm referring to, people didn't believe the government was secretly spying on everyone until things like wiki leaks started exposing all this crap, before then most people considered it all tin foil hat now that the info is out those same people don't seem to care since they are too dense to realize the ramifications.

[themctipers]

30 minutes ago, Trik'Stari said:

"B...B.....But nothing to hide nothing to fear!"

 

Nevermind that that was a saying that Hitlers SS used.....

email me all your passwords

if you have nothing to hide, do it.

 

[Lurick]

25 minutes ago, themctipers said:

email me all your passwords

if you have nothing to hide, do it.

 

My passwords are all abc.123$, for security

[BuckGup]

So does this effect anything like OpenVPN?

[Lurick]

Just now, SamStrecker said:

So does this effect anything like OpenVPN?

No, this impacts VPN endpoints that originate from a Cisco PIX firewall I believe.

[BuckGup]

Just now, Lurick said:

No, this impacts VPN endpoints that originate from a Cisco PIX firewall I believe.

So basically only companies then or a VPN company that gets there stuff with Cisco hardware.