You Don't Own What You Buy, Part 15,332: Cisco Forces Questionable New Firmware On Routers

from the not-cool dept

One of the things that we keep learning in a connected, digital age, is that what you think you "bought" you often don't really own. Companies who sell you products seem to feel a certain freedom to unilaterally change the terms of your purchase, after the fact. I'm reminded of Sony removing key features on the PS3, though there are plenty of other examples. A new one is the story of Cisco, pushing out a firmware update to routers without customer approval and (even worse) having that firmware update block people from logging in directly to their own routers. Apparently, if you don't like it... er... too bad.

Cisco has started automatically pushing the company's new "Cloud Connect" firmware update to consumer routers -- without customer approval. Annoyed users note that the update won't let consumers directly log into their routers anymore -- they have to register for a new Cloud Connect account. The only way to revert to directly accessing the device you paid for? You have to unplug it from the Internet.

Oh, and registering for such an account means you have to agree to give up your data so that Cisco can sell it. As per the terms:

...we may keep track of certain information related to your use of the Service, including but not limited to the status and health of your network and networked products; which apps relating to the Service you are using; which features you are using within the Service infrastructure; network traffic (e.g., megabytes per hour); Internet history; how frequently you encounter errors on the Service system and other related information ("Other Information"). We use this Other Information to help us quickly and efficiently respond to inquiries and requests, and to enhance or administer our overall Service for our customers.

We may also use this Other Information for traffic analysis (for example, determining when the most customers are using the Service) and to determine which features within the Service are most or least effective or useful to you. In addition, we may periodically transmit system information to our servers in order to optimize your overall experience with the Service. We may share aggregated and anonymous user experience information with service providers, contractors or other third parties...

Seems like a good way to drive people into buying routers from other companies. I can see how a "cloud service" could have value, but it should be presented to users as a choice, where the actual benefit to them (if there is one) is clearly presented. Instead, this rollout seems designed solely to benefit Cisco and its partners, rather than the people who bought (or so they thought) their routers.

Filed Under: firmware, hacking, routers
Companies: cisco

Should We Be Concerned That The Military Will Use Counterfeit Routers Bought Off eBay?

from the it's-not-pretty dept

There was a story last week that got a lot of press about how the FBI discovered that the military was using a ton of counterfeit technology equipment, including thousands of fake Cisco routers. Dan Wallach has an excellent writeup looking at the security implications of what happened. From the description, it certainly doesn't sound like any of the equipment was found to include any kind of questionable technology for spying, but the point is that it would have been easy enough if someone had wanted to do so. Basically, the background is that while the government only buys equipment from approved vendors, those vendors can subcontract out the actual tech purchases to anyone. That leads to situations where (no joke) one subcontractor purchased a bunch of fake routers off of eBay and then resold them to the government via an authorized vendor. Or, try to follow the details of the case of the US Navy contracting with Lockheed Martin for equipment. Lockheed outsourced the deal to an unauthorized Cisco reseller as a subcontractor. That subcontractor turned to its own subcontractor who (yup, you guessed it) hired another subcontractor who shipped the equipment straight to the Navy. If you lost count, that's five layers deep, with most of those layers having no real oversight on what they did. You would think the government (and especially the military) would be a bit more careful in where it sourced its products from, but it certainly doesn't seem as though that's the case at all. Given all that, it's almost difficult to believe that compromised equipment hasn't been sold to the government at some point.

Filed Under: counterfeit, espionage, government procurement, military, routers, security, supply chain
Companies: cisco