SNMP is one of those good ideas in theory, bad ideas in practice.
Anyways, Cisco hasn’t done great engineering pretty much since the dotcom bust. They’re now essentially a giant PE firm that grows through acquisitions and then milks them dry. It’s a classic case of the accountants took over.
I was at a startup they acquired ~4 years ago, by now it's just about milked completely dry.
Even though our product is close to industry-leading, they laid off our product manager, then another one, the QA team, and half of the devs. Unsurprisingly the product is falling apart.
It's not a company that attempts to produce value, as with so many others the product is the stock price.
The MBAs are showing some kind of savings on a spreadsheet somewhere though, so I suppose all the sacrifices are worth it.
Cisco's old model (which worked very well for them) was to develop an outside startup and see if they gain traction while keeping at least some financial/control stake to democratize the risk and spend and then spin-in if it is succesful (or sell off).
I interviewed with Cisco once. They wanted me to do a take home interview. Implement an api, make a web app, host the GitHub repo somewhere, host the web app so it was publicly available for them to test, make sure I included full documentation and test suite. A fully tested and deployed full stack application, from scratch, as a “take home test”. I said “no, I don't work for free”.
That was by far the most egregious example I’ve encountered of “we are trying to get unpaid labor from our interview process.”
Selfishly, I'm happy and grateful they bought out chez scheme, opened it up, and funded development. Do I understand why? No, and I'm not going to question it!
EDIT: it seems like it was an acquihire of Dybvig and the team working on chez for something under NDA.
SNMP v3 at least has some security in mind, but a lot of devices are just v1 or v2c which are basically unsecured. Allowing ANY write access via SNMP is a bad idea in my opinion, unless you segment it out into it's own secured management or out-of-band network. Even then... I'd be worried.
Network infrastructure security has a lot of unsolved gotchas and not a lot of industry desire to fix. Most of what everyone interacts with is in an abstracted or virtualized layer on top of the old plumbing.
SNMP v2c is still common in the embedded world because it's protected with a simple password so it just works out of the box. SNMPv3 requires key management and an established PKI, and there's no equivalent of Let's Encrypt for isolated use cases in small orgs.
Depends what you mean by "expose". Some people could read that as "exposed to the Internet". I'm reading it as "exposed to anything".
This looks like a good fun for doing lateral movement inside a network. I know of lots of environments with SNMPv2 wide open for "internal" networks to access.
Plus SNMP is UDP-based, so likely the exploit will work with a one-way path and spoofed source addresses.
The "yet another mortal security flaw in Cisco..." stories never seem to end.
Daydream: Journalists start ending such articles with "This is the Nth critical security flaw for Cisco in just the past year. Network security professionals we spoke to agree that network equipment vendors X, Y, and Z all have far better track records than Cisco."
1/4 of "yes", for this particular article. The regular "brands X, Y and Z are better" part would get more traction in the C-suites. And hopefully on Wall Street.
A few years ago North Korea had some Cisco routers with all ports open to the Internet, wonder if they are vulnerable.
Sounds more like a honeypot.
Since a single, angry dude brought down much of their internet I'd not be certain
When I worked at a company that made some networking equipment SNMP was a constant problem, security, bugs that crash the device and so on.
It became clear to me over time that the pattern at that company was to direct the less great engineering resources to SNMP...
SNMP is one of those good ideas in theory, bad ideas in practice.
Anyways, Cisco hasn’t done great engineering pretty much since the dotcom bust. They’re now essentially a giant PE firm that grows through acquisitions and then milks them dry. It’s a classic case of the accountants took over.
Cisco employee here, this is spot on.
I was at a startup they acquired ~4 years ago, by now it's just about milked completely dry.
Even though our product is close to industry-leading, they laid off our product manager, then another one, the QA team, and half of the devs. Unsurprisingly the product is falling apart.
It's not a company that attempts to produce value, as with so many others the product is the stock price.
The MBAs are showing some kind of savings on a spreadsheet somewhere though, so I suppose all the sacrifices are worth it.
Cisco's old model (which worked very well for them) was to develop an outside startup and see if they gain traction while keeping at least some financial/control stake to democratize the risk and spend and then spin-in if it is succesful (or sell off).
Ah good ole MPLS (Mario, Prem, Luca, and I can't remember who was S)...
Soni
I interviewed with Cisco once. They wanted me to do a take home interview. Implement an api, make a web app, host the GitHub repo somewhere, host the web app so it was publicly available for them to test, make sure I included full documentation and test suite. A fully tested and deployed full stack application, from scratch, as a “take home test”. I said “no, I don't work for free”.
That was by far the most egregious example I’ve encountered of “we are trying to get unpaid labor from our interview process.”
Yeah, that's ridiculous. It's not just FAANGs that pull this crap.
Selfishly, I'm happy and grateful they bought out chez scheme, opened it up, and funded development. Do I understand why? No, and I'm not going to question it!
EDIT: it seems like it was an acquihire of Dybvig and the team working on chez for something under NDA.
SNMP v3 at least has some security in mind, but a lot of devices are just v1 or v2c which are basically unsecured. Allowing ANY write access via SNMP is a bad idea in my opinion, unless you segment it out into it's own secured management or out-of-band network. Even then... I'd be worried.
Network infrastructure security has a lot of unsolved gotchas and not a lot of industry desire to fix. Most of what everyone interacts with is in an abstracted or virtualized layer on top of the old plumbing.
SNMP v2c is still common in the embedded world because it's protected with a simple password so it just works out of the box. SNMPv3 requires key management and an established PKI, and there's no equivalent of Let's Encrypt for isolated use cases in small orgs.
You're secure if you don't expose SNMP. Can't believe there are that many devices out there with that exposed though.
> You're secure if you don't expose SNMP.
Depends what you mean by "expose". Some people could read that as "exposed to the Internet". I'm reading it as "exposed to anything".
This looks like a good fun for doing lateral movement inside a network. I know of lots of environments with SNMPv2 wide open for "internal" networks to access.
Plus SNMP is UDP-based, so likely the exploit will work with a one-way path and spoofed source addresses.
It's damned if you do damned if you don't.
For smaller operations I think just disabling SNMP is safer due to constant bugs and issues.
On the other hand bigger operations, you gotta monitor your devices. But now you’re open to the can of worms.
good old SNMP v1 private/private
I guess that `no snmp-server` is enough to be protected. Well, I hope so.
The "yet another mortal security flaw in Cisco..." stories never seem to end.
Daydream: Journalists start ending such articles with "This is the Nth critical security flaw for Cisco in just the past year. Network security professionals we spoke to agree that network equipment vendors X, Y, and Z all have far better track records than Cisco."
Cisco hasn't yet rolled out a version of Webex that runs on Ubuntu 24.
When I worked for Cisco via an acquisition every single person I knew refused to use Webex in lieu of Google Meet etc
The last paragraph of the article doesn't serve that purpose?
1/4 of "yes", for this particular article. The regular "brands X, Y and Z are better" part would get more traction in the C-suites. And hopefully on Wall Street.
Speaking (unofficially) as someone who works at one of the "other brands" that reeks of journalists having a bias.