
Multiple Severe Vulnerabilities Reported in Juniper Networks Hardware - lgats
https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES
======
sydney6
'The affected SSHD configuration has the PermitEmptyPasswords option set to
"yes".'

Wow.

~~~
spydum
Honestly this not that odd. If you have local users with no password (not
normal), and ssh exposed, you prob have bigger issues. Do agree tho, this is a
stupid default and surprising it got past any sort of system hardening
checklist.

~~~
sydney6
iirc, OpenWRT also uses password-less root access via ssh by default and
indeed, one might find these kind of configs in provisioning setups quite
often. What are the options these days besides default user/pw? The
(Plastic)Router from my ISP has this sticker on the back with a custom default
pw for user access. Always wondered how this works.. probably somehow derived
from MAC addresses and/or other factors.

~~~
pwnna
The last time I checked the password-less root is on first setup with telnet,
accessible only via LAN and with WIFI off.

The first thing it asks you to do is to set a password, before enabling SSH.

------
based2
[https://www.reddit.com/r/netsec/comments/9n2o7c/multiple_sev...](https://www.reddit.com/r/netsec/comments/9n2o7c/multiple_severe_vulnerabilities_reported_in/)

------
anon49124
FreeBSD vulns or Junos introduced?

~~~
gonzo
Mostly OpenSSH

------
itomato
It's a nice day to consider a Linux-based whitebox switch.

~~~
SEJeff
Fun fact, Arista switches are very lightly modified minimal Fedora installs
with some fancy hardware. The entire userspace (literally all of it) is
written in well done python and the magic is all in their asics. I got to RE
their entire firmware as part of R&D at one of my previous employers.

~~~
xvf22
Don't they run on commodity Broadcom ASICs?

~~~
mcpherrinm
Modern network ASICs are highly-programmable devices. So you can implement a
lot of magic on the same hardware as competitors.

It's really not one way or the other, but the software and hardware working
together that's important.

[disclaimer: I am a former Arista employee. I did some of the "light" Fedora
modifications.]

~~~
SEJeff
Did I get it wrong? One thing we found interesting is that we could run
unmodified software directly on the switches so long as we built it for the
AMD Athlons running on them.

------
onetimemanytime
In other words, several other (non-friendly) countries have their own NSA.
Live by the sword and all...

~~~
throwaway5752
And those countries would not engage in surveillance if the US did not? You
create a 2 country elementary payoff matrix for that game and tell everyone
what the Nash equilibrium is.

~~~
xvector
What does your comment say when translated to the language of mere mortals?
Asking for a friend

~~~
mrgalaxy
> And those countries would not engage in surveillance if the US did not?

A rhetorical question about whether other countries would spy on citizens if
the US were to stop. (Hint, the answer is that they absolutely would
continue).

> You create a 2 country elementary payoff matrix for that game and tell
> everyone what the Nash equilibrium is.

I think this is saying that there is nothing for other countries to gain by
stopping surveillance programs, even if the US were to. This is the Nash
equilibrium[1].

[1]:
[https://en.wikipedia.org/wiki/Nash_equilibrium](https://en.wikipedia.org/wiki/Nash_equilibrium)

