SoylentNews is people
SoylentNews
Submitted via IRC for Bytram
Hackers are actively trying to exploit a high-severity vulnerability in widely used Cisco networking software that can give complete control over protected networks and access to all traffic passing over them, the company has warned.
When Cisco officials disclosed the bug last week in a range of Adaptive Security Appliance products, they said they had no evidence anyone was actively exploiting it. Earlier this week, the officials updated their advisory to indicate that was no longer the case.
"The Cisco Product Security Incident Response Team (PSIRT) is aware of public knowledge of the vulnerability that is described in this advisory," the officials wrote. "Cisco PSIRT is aware of attempted malicious use of the vulnerability described in this advisory."
The update didn't say how widespread the attacks are, whether any of them are succeeding, or who is carrying them out. On Twitter on Thursday, Craig Williams, a Cisco researcher and director of outreach for Cisco's Talos security team, wrote of the vulnerability: "This is not a drill..Patch immediately. Exploitation, albeit lame DoS so far, has been observed in the field."
(Score: 3, Interesting) by NotSanguine on Tuesday February 13 2018, @12:44AM
I agree. IPsec over IPv4 (or even better, IPv6) is not only (when properly configured) more secure, it's also much less resource intensive.
As someone who's implemented and managed Cisco security gear (including their ASA products) at a variety of organizations big and small, the biggest issue is that most home firewalls (and in corporate environments, hotels and other public venues) block the required protocols/ports by default. SSL-based VPN (tcp/443) is allowed through pretty much everywhere.
There have been a few products that used SSL-based VPN connections that were actually not too bad in terms of usability and feature sets. However, Cisco's AnyConnect and clientless VPNs offerings are really crappy. They're buggy, slow and difficult to manage.
As the person implementing and managing this stuff, I always pressed for transport (on mobile devices) and tunnel (on devices at static locations) mode IPSec connectivity. That works pretty well and is much easier to manager.
However, when a VP/partner/other exec is traveling and is at an airport, hotel or other insecure location and want to gain access to the corporate network, UDP/500 and protocols 50 and 51 are invariably blocked. In that scenario, one needs to have something SSL based already available to users, or an updated resume.
SSL VPNs can be quite useful in a variety of use cases. Cisco just does theirs poorly.
No, no, you're not thinking; you're just being logical. --Niels Bohr