Researcher at center of Cisco router-exploit controversy speaks out

By Ellen Messmer, NetworkWorld.com
July 28, 2005 10:22 PM ET

. What's this?

Michael Lynn, the former Internet Security Systems researcher who disclosed information about how unpatched Cisco routers could be hacked, said he is seeking to settle with Cisco and ISS over the controversy.

More: Cisco nixes conference session on hacking IOS router code
Furor over Cisco IOS router exploit erupts at Black Hat
Cisco, ISS, Michael Lynn and Black Hat sign legal accord
Forum: Who's right?

Separately, Cisco said this Friday it plans to issue a security advisory of its own related to the issue of remote exploits of Cisco routers, which will be posted here.

Lynn, an expert in uncovering security flaws, stepped in to the limelight - and a storm of controversy - after he spoke out earlier this week about a buffer-overflow exploit that can potentially undermine routers.

Related Content

In doing so, he violated the wishes of former employer ISS as well as Cisco, which had abruptly canceled the presentation, saying it was premature to present the security findings.

Facing a lawsuit from Cisco and ISS, Lynn said he entered into a legal agreement with both vendors - with much help from high-tech defense attorney Jennifer Grannick - which he hopes will let him move on with his life and find another job.

But in a room full of reporters at the Black Hat conference, Lynn offered his own impression of the events that had led to the furor, which also included legal action by Cisco and ISS against the Black Hat conference.

Lynn told reporters at Black Hat that despite the complications it caused him and the fact it “was pretty scary,” he still feels he “did the right thing” in revealing what he had discovered in researching exploits associated with unpatched Cisco routers.

“I didn’t think the nation’s interest was served in waiting another year when a router worm would mean a serious threat,” he said of his decision to quit his job at ISS and reveal what he knew.

He said Cisco knew about the underlying vulnerability before he did, sometime in February, and fixed it with a patch in April. Lynn’s research examined how buffer-overflow exploits could undermine routers that aren’t patched.

Lynn admitted that he did engage in a “bit of deception” when he told Jeff Moss, CEO of Black Hat, that he would talk about voice over IP as a substitute presentation when ISS and Cisco canceled the original topic on the Cisco ISO shellcode and exploits.

Lynn said he knew he was in trouble after he gave the talk on Cisco routers; he said he wondered what was happening when a group of “guys with badges” asked him to join them in a room, where one said, “Got the van ready?”

This was a joke, however, and the group of government IT professionals, which included representatives from the U.S. CERT emergency-response team and the Air Force, said they appreciated learning of the potential for exploit of routers.

As a former employee of ISS, Lynn said he knew ISS had integrated knowledge about the exploit into some of its protective security gear, even though the information was not yet public.

Lynn refuted an assertion made by Cisco in its legal filing against him that reverse-engineering is somehow an illegal practice for evaluating software. “It’s not illegal,” said Lynn, saying this is common practice.