"Cisco gate" and "Meet the Fed" at Defcon....

Mon Aug 1 09:47:49 UTC 2005

> Cisco, are you listening?

Cisco is in fact listening.  Cisco, like other companies, generally  
does not release security notices until enough information exists to  
allow customers to make a reasonable determination as to whether or  
not they are at risk and how to mitigate possible risk.

The issue underlying the suit wasn't the disclosure of the security  
issue, although we would have rather worked that according to the  
usual processes. From what the corporate legal folks tell me, their  
issue was the disclosure of Cisco intellectual property. Note that it  
wasn't just Cisco that felt the presentation was out of order; Lynn's  
employer became "former" because it also felt that way. I'll refer  
you to the legal brief for anything further on that, but I would  
really like to see this discussion begin to resemble an informed one.

> By this misbehavior you are seriously discouraging researchers from  
> releasing info to you. They will suspect you'll sit on the exploit  
> for months and not tell anyone (as you did with this one). They'll  
> be afraid you'll try to kill the messenger (as you did with this one).

For the record, the vulnerability was first detected by Cisco in  
internal testing, not by outside researchers, and Cisco's approach to  
this has been in accordance with the RDF. Part of that process, at  
Cisco, is to develop work-arounds or updated code that corrects the  
exploit, testing it, and getting it into the field. Releasing the  
information on the exploit before that point exposes the ISPs to a  
vulnerability that they can't fix, or puts them into a scramble to  
download code that they haven't been able to gain confidence on. I  
should imagine that the various operators on this list would prefer  
to get the fix in place before the vulnerability is exposed rather  
than playing catchup while their pants are around their ankles.

We very much try to work with people that are willing to work with  
us. We aren't very impressed by people that expose the industry to  
danger.