IT Jobs
Security researcher quits job to defy Cisco
Presentation on router software flaws goes ahead.
By Robert McMillan, IDG News Service and Kieren McCarthy, Techworld
Published: 11:27 GMT, 28 July 05
The controversial conference presentation on flaws in Cisco's router software did go ahead as planned, despite an earlier agreement to pull it, after the lead researcher quit the company.
Michael Lynn decided to resign his position at Internet Security Systems (ISS), after the company agreed under pressure from Cisco to kill it. He then gave his presentation at the Black Hat security conference in the Las Vegas.
It is now believed that Cisco and ISS have filed a restraining order against the management of the Black Hat Conference and Lynn.
Lynn said he felt compelled to quit his job so that he could give the talk because the Cisco security issues are of vital importance to the Internet's health. "This is the right thing to do," he said to applauding Black Hat attendees. "When you attack the router, you gain control of the network."
Lynn described a now-patched flaw in the Internetwork Operating System (IOS) software used to power Cisco's routers, and the steps he used to gain control of a router. Although Cisco was informed of the flaw by ISS, and patched its firmware in April, users running older versions of the company's software are at risk, he said.
By giving his presentation, Lynn said he hoped to clear up the misconception that Cisco's products are somehow less vulnerable to the kinds of attacks that frequently affect widely used software like the Windows operating system. "IOS is the Windows XP of the Internet," he said.
After six months of research work, Lynn discovered a way to shut down a Cisco router so that it could not be restarted. In light of the 2004 theft of Cisco's IOS source code, it was possible that attackers could create a devastating worm attack that could shut down many Internet routers, he said.
A recent decision to include a technical feature called "virtual processes", in upcoming versions of IOS would make it easier to create a "routing worm that breaks every router in the world," he said. "When they come out with a version with virtual processes, this is a real flaw," he said.
Show organisers had literally ripped out the 31 pages containing Lynn's talk from the 1,200 page book of Black Hat presentations handed out to attendees this week. Whether or not the written presentation will be made available remains unclear.
During his presentation, Lynn said he understood how ISS might have had a hard time allowing the talk, given Cisco's objections. "They had to do what was right for their shareholders," he said. "But I had to do what was right for the country and the national infrastructure."
.gif)
Add your commentComments