TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Huawei cryptographic keys embedded in Cisco’s firmware

184 点作者 risent将近 6 年前

10 条评论

elmo2you将近 6 年前
So, in summary:<p>1. Cisco used Open Source software (OpenDaylight), without sanitizing publicly available (GitHub) certificates and private keys.<p>2. The screenshot in the source article mentions the subject of the certificate. Yet, the text refers to it as the signing party.<p>3. Somebody used a business name and an email address that is associated to Huawei, to generate a certificate.<p>Observations:<p>- Regarding (1): If any finger pointing or suggesting should be done here, it should not be at anyone but Cisco.<p>- Regarding (2): Either the original source article contains incorrect information, or these certificates were self-signed, which makes any information supplied in the certificate arbitrary and meaningless.<p>- Regarding (2): If the information is incorrect, and the certificate was signed by an accredited party, the person who put this on GitHub sure made a stupid mistake, rendering this private key essentially useless (to anyone, Huawei and Cisco included).<p>- Regarding (3), just because somebody uses (either real of fake) business information to generate a certificate, does not indicate that said business had any involvement whatsoever. Not unless the certificate is signed by a party that guarantees the vetting of that info.<p>Final thought: The title with &quot;Huawei cryptographic keys&quot; appears to be very misleading at best, simple incorrect more likely. I do not see the link between Huawei and these keys, other than somebody using arbitrary information to generate a (self-signed) certificate from a private key.
评论 #20354705 未加载
评论 #20354456 未加载
评论 #20354399 未加载
评论 #20355576 未加载
评论 #20354472 未加载
segfaultbuserr将近 6 年前
Tired: Cisco routers have U.S. backdoors!<p>Fired: Huawei routers have Chinese backdoors!<p>Inspired: Cisco routers have Huawei backdoors!<p>Reality is often stranger than fiction...
评论 #20356350 未加载
评论 #20353895 未加载
chvid将近 6 年前
The key was in a test folder of an open source project. Shouldn&#x27;t get into a production build but doesn&#x27;t really matter if it did. This is just sloppy work by Cisco.
nrki将近 6 年前
* embedded in an OSS package used by Cisco&#x27;s firmware
leptoniscool将近 6 年前
If a Cisco crypto key was found in a Huawei switch, the media response would be very different.
评论 #20356495 未加载
评论 #20353304 未加载
评论 #20353504 未加载
评论 #20357094 未加载
vbezhenar将近 6 年前
So those were just files hanging around in the image, not used by anything.
评论 #20353587 未加载
评论 #20353409 未加载
marcus_holmes将近 6 年前
seeing this more and more... open source projects pulled in as dependencies without auditing, and causing a security issue.<p>I predict this is going to become more and more of an issue over the next couple of years, and provoke some drastic changes to the way we do open-source software. What those changes are, I don&#x27;t know...
评论 #20359064 未加载
评论 #20354280 未加载
Merrill将近 6 年前
&gt;&quot;The firmware contained a few certificates and a corresponding private key.&quot;<p>A cunning plot by Huawei to distribute private keys in Cisco firmware?
sova将近 6 年前
Title reeks of clickbait -- especially since this is innocuous and clearly just an oversight in packaging
kazinator将近 6 年前
&gt; <i>Who is gary.wu1(at)huawei.com, and why are his keys embedded in Cisco’s firmware?</i><p>.. and, lastly, why the do we care about protecting his e-mail address from harvesters with (at) if he so loose with it himself that he lets it end up in random firmware?