back to article Infosec bod's brag: Text editor pops Avaya phones FOREVER

Dr Ang Cui says Avaya's Ethernet office phones can be permanently compromised using nothing more than a text editor (and a few lines of Python.) The Columbia University PhD and Red Ballon Security cofounder revealed to the RSA security conference in San Francisco a few more details about the vulnerabilities he found last year …

  1. Christian Berger

    Yeah you kinda expect that

    That very company also had a bug in their call centre management software. To quote from their note "Therefore, if there are no files under /tmp at the exact moment when the /etc cleanup script is run on Linux the script may start to delete all files under /."

    http://downloads.avaya.com/css/P8/documents/100177034

    AVAYA is one of the companies I'd put in the "avoid at all cost" category. Luckily there are lots of alternatives.

    1. waldo kitty
      FAIL

      Re: Yeah you kinda expect that

      That very company also had a bug in their call centre management software. To quote from their note "Therefore, if there are no files under /tmp at the exact moment when the /etc cleanup script is run on Linux the script may start to delete all files under /."

      Gotta wonder if that programmer/coder from that game company that just had pretty much this exact same type of flaw worked for Avaya, too.

      1. Michael Wojcik Silver badge

        Re: Yeah you kinda expect that

        Gotta wonder if that programmer/coder from that game company that just had pretty much this exact same type of flaw worked for Avaya, too.

        Possibly, but the error in question seems like a relatively probable one for an inexperienced UNIX developer to make when writing a cleanup shell script. And if memory serves, a big NASA study some years ago into redundant software development - where you have multiple teams develop software for the same purpose, in an effort to produce a fault-tolerant redundant system with an overall reduced error rate - showed that teams working independently often produce the same bugs.

        Basically, it's not uncommon for developers to independently make the same wrong assumptions. And that's not very surprising.

  2. tony2heads
    Facepalm

    "user root and a password of nothing"

    That is soooo stupid

  3. cortland

    Grinned?

    With reason!

  4. Ammaross Danan

    "Indefinite"

    So, he's claiming the "indefinite" compromising was due to his assertion that: “My definition of firmware updating is trading known vulnerabilities for unknown ones,” thus still finding some way into the device through currently-unknown means...thus "the industry needs the ability to retrofit arbitrary devices with operating-system agnostic host-based defences" of which he happens to own a company that does exactly that.... I see a conflict of interest in his assertions (read: points made are likely exaggerated for a sales-pitch opportunity).

    1. Michael Wojcik Silver badge

      Re: "Indefinite"

      Self-serving? Sure. But supported by historical evidence. None of his claims are extraordinary - except maybe the one about "you'll probably be using .. Symbiote"; I don't know enough about it to evaluate that one.

      Given the abysmal state of software security, betting against it is pretty safe, and saying that OEMs need a better class of protection mechanism is hard to argue against. This bar is so low that nearly anything clears it.

  5. Christian Berger

    BTW has someone looked at how he proposes to fix this?

    He's attempting to bring out some sort of magical symbiont software which runs in parallel with the firmware and somehow magically protects it from harm. Kinda like a Skynet.

    It seems extremely unlikely that such a system would work outside the realm of science fiction. Combined with that conference apparently being a sales conference where only marketing people go, we may have a sort of con going on. We'll know more when his thesis is published.

    1. Michael Wojcik Silver badge

      Re: BTW has someone looked at how he proposes to fix this?

      It seems extremely unlikely that such a system would work outside the realm of science fiction.

      That looks like a wildly inappropriate and implausible evaluation to me. There's a ton of research on attack-monitoring software, self-healing software systems, feature injection ... all the stuff Symbiote is supposed to do. Have you read the paper? Or any of the 15 others Cui is primary or secondary author on?

      I'll note that nowhere does it mention doing anything magically. (And that would be fantasy, not science fiction, by most folks' definition.)

      I will note that the article refers to him as "Dr" and claims he holds a PhD, but UMI doesn't have a dissertation for him, and his academia.edu page still says he's a grad student.

      Oh, and a lot of technical people go to the RSA conference.

      But, hey, apart from being completely wrong, insulting, and arguably libelous, good post!

      1. Christian Berger

        Re: BTW has someone looked at how he proposes to fix this?

        Well glancing over his paper it doesn't look very technical. I mean seriously how is it supposed to detect an attack? How can it, for example, find out wether a given input will cause the softare to behave in a certain way before it actually behaves in that way? That just seems to be like solving the halting problem.

        I mean sure there are lots of companies claiming to have solved the halting problem, virus scanners are the most famos example.

        Instead it focuses on bizarre aspects like in the symbiont's ability to be injected into binary code without having the source code. Seriously you either are the manufacturer and have the source code, or you won't be able to boot your firmware image. Plus no manufacturer will sign individual firmware images for your devices, or even provide you with support for images one cannot test. You will never know if your device is broken because of a hardware defect or the injection and morphing software having caused a stack overrun somewhere in the system. In any case it'll cause a sense of false security.

        So I don't think anything useful will come out of this.

  6. rob-carmichael

    Vendor response

    https://downloads.avaya.com/css/P8/documents/100178648

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like