[NANOG] Re: JunOS and MX trojan and malware

[Mike Hammett via NANOG <nanog () lists nanog org>]

Defense has to be right every time. Offence just has to be right once.

But yes, we should treat secure as a goal, not a destination. Take reasonable steps for security and continually strive 
for it, but also realize that you'll never get there.

Also security theory and security real world are very different. If the security isn't seamless, it'll just be bypass 
or not implemented in the first place, which defeats the whole purpose.



-----
Mike Hammett
Intelligent Computing Solutions
http://www.ics-il.com

Midwest-IX
http://www.midwest-ix.com

----- Original Message -----
From: "Saku Ytti via NANOG" <nanog () lists nanog org>
To: "North American Network Operators Group" <nanog () lists nanog org>
Cc: "Saku Ytti" <saku () ytti fi>
Sent: Saturday, March 15, 2025 3:27:54 AM
Subject: [NANOG] Re: JunOS and MX trojan and malware

I'm skeptical. Companies with massive financial incentive to deliver
secure devices, who control hardware and software and have infinite
budgets fail, and produce devices hobbyists own to show their skills.

Router vendors are significantly worse positioned. We accidentally
regularly find crashing bugs while receiving BGP updates or just
packet-of-death which crashes the NPU ucode, which probably could be
developed into a remote attack.

It would be reasonable to assume that any motivated attacker can own
any network device, regardless of the operator's care. And operator
care is trivial, I've not seen one properly written lo0 filter, much
less ddos-policer config, while Juniper is arguably the best vendor
here, most others don't even have a way to protect control-plane.

Yet, realised risks out of worst outcomes are trivial costs,
especially to the providers. We have a lot of anecdotes of massive
infosec failures, and it rarely has any significant financial impact.
Heck, when crowstrike had a mistake (fair mistake, impossible to
deliver a solution like that for infinite time without making a
mistake like that once and a while) I knew it's going to be great for
their business, and it was, it not only recovered in share price, but
outperformed the market. Because there was a lot of media attention,
and infosec leaders who weren't aware of end-point-security were
rushing to procure one, since all the big names seemed to be running
one, on account of being down.

We have a strategic problem in infosec, and we keep treating it as a
tactical problem, that one more fix and it's solved. It is not
working, and investing specifically to infosec is bad investment.
Sure, do things safely and right when it doesn't add cost and is
generally best practice.
I don't know if the strategic problem can be solved or how to even
improve the situation, but what we are doing is new age/faith work,
it's not working, and hasn't been working. And it might be, if not
fundamentally, commercially impossible to do anything secure, due to
the massive leverage the attacker has over the defender.

On Sat, 15 Mar 2025 at 02:44, Justin Streiner via NANOG
<nanog () lists nanog org> wrote:
> This underscores the importance of proper security around out-of-band
> management/console networks and proper security of console ports to the
> extent that devices offer it.
>
> Thank you
> jms
>
> On Thu, Mar 13, 2025 at 1:29 PM Bryan Fields via NANOG <
> nanog () lists nanog org> wrote:
>
> > On 3/13/25 12:22 PM, Eric Kuhnke via NANOG wrote:
> >
> > > PDF file:
> > https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1
> >
> > From reading this there was no known remote exploit, they needed user level
> > shell access to exploit another local vulnerability which got them root and
> > then installed this exploit.  While this isn't great, if someone has
> > unaudited
> > login user level access to your routers, you've already lost.  Basic ACL's
> > go
> > a long way to filtering this from outside a logged network too.  Security
> > is
> > best when it's a multilayered approach.
> >
> > This said, I've been greeted with a login prompt telnetting to carrier's
> > upstream router in the last 6 months.  They seemed outright confused why I
> > cared about it and closed the ticket.  🤦‍♂️
> >
> > --
> > Bryan Fields
> >
> > 727-409-1194 - Voice
> > http://bryanfields.net
> > _______________________________________________
> > NANOG mailing list
> >
> > https://lists.nanog.org/archives/list/nanog () lists nanog org/message/2UEVTAIT5YF3V75PKHMZG4IMUYKNQ6GE/
> _______________________________________________
> NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/YM3RDKBIFRCDHERC6IQ3HYILHQC7W7BH/



-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/OPCWW5EDODGAV4EFRHTIF46WEQYVBI6G/

_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/R2M3YMTBRWED5SEVQEFMZA4IXGISL2PD/