Cisco fixes critical IOS XE bug but malware crew way ahead of them

After a six-day wait, Cisco started rolling out a patch for a critical bug that miscreants had exploited to install implants in thousands of devices. Alas, it seems, the security results have been mixed since the attackers got wise. The flaw in the networking giant's IOS XE software, which allowed criminals to hijack thousands …

[ChoHag]

> "Normally, when an attacker is caught, they go quiet and revisit the affected systems when the dust has settled," he said. "This attacker is attempting to maintain access to implants that dozens of security companies now know exist. To me, it seems like a game they can't win."

Everybody who got infected is an idiot, as evidenced by the fact that this private management interface was publicly available. Whoever got in doesn't want to let go of that set of juicy marks and a lot of them won't fix the problem properly or at all.

And really, it probably wasn't that much work to add a simple test then roll it out to your thousands of production machines at the click of a button, yet judging by the state of the industry anybody capable of doing that has left it and is at home, bored, sitting on the knowlegde that the internet runs on incompetence...

[ecofeco]

The whole world is currently the Mrk 14 torpedo writ large all over again.

But ESPECIALLY in the tech sector.