back to article Why is the networking business dozing through Meltdown/Spectre?

In the seven weeks since The Register broke the news of the Meltdown/Spectre speculative execution vulnerabilities, nearly every corner of the industry has scrambled to patch, re-patch, and work out how to Spectre-proof the world. Except for Ethernet switch vendors, who with a very few exceptions haven't even troubled to make …

  1. Anonymous Coward
    Anonymous Coward

    Help the hackers

    There’s no news here, ethernet is NOT affected...unless you really dig deep and follow the clues in this article. Why give potentially useful insights to hackers? They’re not going to get the chance to interview Cisco. Thanks El Reg for nothing but click bait and and helping hackers!

    1. Anonymous Coward
      Anonymous Coward

      Re: Help the hackers

      Not sure what you just read but to run code on a switch you have to access the management panel, the management panel is already root so why bother? What useful data could you get from a switch processor you couldn't just take as root?

    2. Mayday
      Stop

      Re: Help the hackers

      Please explain:

      What nasties you could craft with an attack somehow encoded into an etherype, preamble or FCS field (for example) which would be more nastier than already having console and/management access?

  2. amanfromMars 1 Silver badge

    Terminal Blues .... when a Systemic Vulnerability Provides Systems Wide Flash Crash Opportunities

    Free from and secure against attack and alteration is a dangerous belief to espouse and rely on for safety for it's always based upon a false premise such as is .... “in order to exploit any of these vulnerabilities, an attacker must be able to run crafted code on an affected device … There is no vector to exploit them.”

    And as for the above muse on Meltdown/Spectre attack vectors, it is wise to consider, in order to exploit any of these vulnerabilities, an attacker must be able to run crafted code with an effective device in a conflicted sector … and in those will there be multiple vectors to exploit.

  3. Richard 12 Silver badge

    Meltdown doesn't exist on them at all.

    There was only ever one vulnerable ARM core and nobody has shipped it yet.

    El Reg, of all orgs shouldn't be eating Intel's FUD.

    The vector that might exist is Spectre.

    So given that Spectre requires running your actual code on-target, it seems that network switches are going to be pretty safe.

    Unless they expose a (web?) management interface accessible from a "normal" port that already has an exploitable vulnerability. Then they might also be vulnerable to Spectre, but it was already game over - so who cares?

    1. Anonymous Coward
      Anonymous Coward

      Re: Meltdown doesn't exist on any ARM in production at all.

      How do you down vote an article author, perhaps a "shill much?" button needs to be added to the interface

  4. Anonymous Coward
    Anonymous Coward

    Intel network-kit news from 12 months ago

    Hey Mr Chirgwin, it's almost exactly a year since your colleague Mr Claburn wrote this:

    https://www.theregister.co.uk/2017/02/06/cisco_intel_decline_to_link_product_warning_to_faulty_chip/

    In the twelve months that have passed, how many more Intel-SOC-based network boxes have died prematurely, how few have been replaced by the retailer or manufacturer?

    That might be interesting, and might be news. This article is neither.

  5. Anonymous Coward
    Anonymous Coward

    The point of this article is...

    .... I guess to get clicks. It's otherwise "not news".

    "If you're familiar with how Ethernet works, you already know the answer". Yes, we do. The answer is: you're wasting our time with this.

    In other "not news", the Hindenburg didn't hit an Iceberg (analysis follows!). Also, a man hasn't dropped his morning McMuffin (pap photos after the break!)...

    FFS.

    A/C

  6. Anonymous Coward
    Anonymous Coward

    Grumpy bastards

    There seems to be a lot of negativity about this story in the comments above. I can only assume that all the posters so far are network engineers.

    I would think that for the quite large percentage of El Reg readers who aren't network specialists, this article offers an interesting insight into the workings of Ethernet switches, and why they aren't vulnerable to Spectre.

    1. Anonymous Coward
      Anonymous Coward

      Re: Grumpy bastards

      I know something about setting up and using networking equipment, but I know very little about their internal workings. So yes, I read this article with at least a small degree of interest.

      Grumpy bastards indeed.

    2. Anonymous Coward
      Anonymous Coward

      Re: Grumpy bastards

      "There seems to be a lot of negativity about this story in the comments above."

      Here's some more.

      From the article: "Nearly most of the frame..."

      Just how much is 'nearly most'?

      1. This post has been deleted by its author

      2. Destroy All Monsters Silver badge

        Re: Grumpy bastards

        Everything except the government-mandated "evil" byte. [0 = not evil, 0x20 = evil, 0xFE = iran, 0xFF = putin]

    3. gnasher729 Silver badge

      Re: Grumpy bastards

      It's similar to MacOS, Windows, Linux, used as single user systems: To exploit, you need to get malware on the computer. And if an attacker manages to get malware on the computer, you have lost anyway. So being careful, downloading from trusted sources only, that kind of thing protects you.

      On an Ethernet switch running all code as root, as soon as you get malware on it, you've lost. Meltdown/spectre don't help the attacker, he has already won. The problem is to get the malware running, and there is just no way in. So Cisco doesn't need Spectre / Meltdown protection, just malware protection.

      1. Anonymous Coward
        Anonymous Coward

        Re: Grumpy bastards

        "So being careful, downloading from trusted sources only, that kind of thing protects you."

        Not exactly, you don't have to 'download' (technically you are) anything, just opening a webpage can do it. Meltdown and spectre can be exploited via javascript.

        1. Anonymous Coward
          Anonymous Coward

          Re: Grumpy bastards

          Grumpy because Intel have seemed to be trying to spin the idea that since other manufacturers have also have components suffering to a lesser degree then Intel are some how less to blame.

          Every article that supports Intel's attempts to spread the blame is at best adding misdirection and at worst shill posting.

          Intel screwed the pooch, they IMHO wrote security off to get a performance advantage over their competitors, if their competitors then emulated them then IMHO intel are to blame for all the effected hardware.

  7. Anonymous Coward
    IT Angle

    Get a snooze free, for a limited time.

    Sleeping until all the guff is worked out may be a reasonable tactic, but cannot be sustained as a principle policy, much was unknown and waiting until 'others' have worked it out has some merit especially if they cannot contribute anything beneficial themselves.

    If you avoided all the crashes with earlier patches that may have been a benefit, and even if manufacturers had a patch some still would not have rolled it out.

    So we now know, separate your cloud usage from others for number one , use Google patch for number two, and Microsoft for number three.

    Time to wake up now.

  8. DCFusor

    Uh

    If you can run code on my switch...you can snoop on all my lan packets and I have no way to know you're doing it - you can send your catch right out through the router, that I don't own (like most home/small business) and I can't see them at all, so I have no idea you are doing it and you can grab quite a haul over time.

    Do that to any machine on my LAN, and wireshark or equivalent can see them, eg the tools most use to check for things like that.

    Root on a switch isn't root on every box on the LAN, not by a long shot - just having root on one means you have that one, and that's it. Only a complete moron would use the same password etc for all boxes for root. There seems to be considerable confusion about that in comments above...Seems few even seem to know what it is - the author seems to have been right that there are a lot who could learn more here.

    1. Christian Berger

      Re: Uh

      Well actually to exploit Spectre/Meltdown you'd first have to find a way to execute code on the management processor of the switch. In this case you usually have full control over that processor as you usually are either root or have no security boundaries between "userland" and "kernel".

  9. Christian Berger

    Actually I wouldn't go so far

    Even though I could not imagine any situation where executing code on the microprocessor of the control processor could happen and could be made even worse by Spectre/Meltdown and any simmilar bug that's still to be discovered, there are companies who have over and over again surprised us with stupid ways to increase the attack surface of their products.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon