Posts by outnumbered 11 publicly visible posts • joined 5 Nov 2015
My kids went through all the pain with this system during and after Covid. It's utterly unbelievable that a Government service has simply been allowed to be taken over by commercial touts charging 10x the normal price. The DSVA should have recognised this issue years ago and fixed it. It's even more unbelievable that they still don't have any specialised staff. Complete failure by a public service organisation.
I wondered about this too. I wonder how many core config changes they are making per day, maybe there are so many this was lost in the noise.
When I ran a comparatively tiny cloud service, we used to monitor pretty carefully after deploying any production changes, I'd hope Cloudflare would be even more diligent.
From the description of the bug, it also sounds like it should be catchable in testing if they're using a realistic configuration, so it's a double fail.
Looking at the advisory, vulnerable versions go back to IOS 12.2. So more or less the entire deployed base is possibly vulnerable (although there are so many hardware variants involved, there probably isn't a working exploit for many of these, and it's a subset that is actually at risk, maybe the x86 based hardware in particular).
There have been any number of allegedly "smart" or "simple" admin solutions developed by Cisco for IOS over the years, but EVERYONE still uses their own homebrewed scripts and CLI scraping, right ?
Even if the Viptela stuff is actually any good, which it might be since Cisco didn't develop it, I'd bet that the integration with IOS is flaky as hell and incredibly constrained.
Just log into any IOS router and use the online CLI help to marvel at the swathes of protocols and features that you've a) never heard of and b) nobody uses. Many of which were probably written 15 years ago with little or no thought of security. It doesn't surprise me at all that there are vulnerabilities in there. It's practically impossible to remove features from IOS, so the crud just builds up over time.
How about this from P.55 of the draft bill. It looks like in principle they are allowing themselves to collect pretty much anything. I assume that in practice they will just record all the standard Netflow 5-tuples, but the way I read this, they can ask for any data they think will help to identify something.
(9) In this Part “relevant communications data” means communications data
which may be used to identify, or assist in identifying, any of the following—
(a) the sender or recipient of a communication (whether or not a person),
(b) the time or duration of a communication,
(c) the type, method or pattern, or fact, of communication,
(d) the telecommunication system (or any part of it) from, to or through
which, or by means of which, a communication is or may be
transmitted,
(e) the location of any such system, or
(f) the internet protocol address, or other identifier, of any apparatus to
which a communication is transmitted for the purpose of obtaining
access to, or running, a computer file or computer program.
In this subsection “identifier” means an identifier used to facilitate the
transmission of a communication
