Ascend Archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

(ASCEND) Bottom line on Ascend Security debacle

Speaking for the entire user community as a whole, Ascend needs to do
the following (before a shareholder lawsuit starts brewing):

o appoint or hire a 'security contact' for the company to handle any
issue related to security of their products
o advertise the email address and the phone number of this contact
o establish well known channels to this contact (CERT listing, buqtraq
database listing, hell... monitor alt.2600 while you're at it)

o provide patch for port 9 exploit within the week
o provide patch/upgrade of software that disables SNMP write access by
default (I believe this is the case already in v6, but not in v5)
o provide patch/upgrade of software that encrypts passwords in TFTP
configs or eliminates them altogether (I personally like being able to
have the passwords there, but at least encrypt them).

The issue of whether SNI handled the situation wrong or not is moot. The
point is WHAT IS ASCEND GOING TO DO ABOUT IT?! 

At any given moment, you can bet that there are at least a dozen
crackers trying everything to circumvent any piece of hardware/software
out there. The fact that rootshell got this info first makes no
difference. It is a clearinghouse for this kind of info, and usually is
the FIRST place to publically exchange this info. I'm glad to have it
around. It's saved my butt a million times and taught me a lot about
networking in the process.

But again, wasting time and resources 'deflecting' or doing spin control
is wasted. FIX THE BUG. When you've fixed the bug and implemented the
pieces listed above, then go on CNN and News.com and tell the world how
great you responded to the security problem, how you've stepped up your
support for security issues, and every one of your users loves you.

Cheers,
Scott Kozicki
BlueStar Communications
-- 
"If you don't get this message, please let me know
   and I will send you another one."
++ Ascend Users Mailing List ++
To unsubscribe:	send unsubscribe to ascend-users-request@bungi.com
To get FAQ'd:	<http://www.nealis.net/ascend/faq>
Follow-Ups: