[104776] in North American Network Operators' Group
Re: IOS Rookit: the sky isn't falling (yet)
daemon@ATHENA.MIT.EDU (Adrian Chadd)
Tue May 27 13:29:00 2008
Date: Wed, 28 May 2008 01:29:03 +0800
From: Adrian Chadd <adrian@creative.net.au>
To: Chris Grundemann <cgrundemann@gmail.com>
In-Reply-To: <443de7ad0805271024o199dc443u6f907eda871433f8@mail.gmail.com>
Cc: nanog@merit.edu
Errors-To: nanog-bounces@nanog.org
On Tue, May 27, 2008, Chris Grundemann wrote:
> > Sure, its not all fire and brimstone, but the bar -was- dropped a little,
> > and somehow you need to make sure that the IOS thats sitting on your
> > network management site is indeed the IOS that you put there in the
> > first place..
>
> Like MD5 File Validation? - "MD5 values are now made available on
> Cisco.com for all Cisco IOS software images for comparison against
> local system image values."
Yes, but the only thing the router checks iirc is the old-style checksum,
and not some oob provided md5 hash?
And if you can exploit the management box itself, you can load your own
MD5 hash in.
This is all the sort of stuff that public key crypto and chains of trust
were meant to solve, IIRC..
Adrian
