Michael Lynn, the former Internet Security Systems researcher who disclosed information about how unpatched Cisco routers could be hacked, said he is seeking to settle with Cisco and ISS over the controversy.
More: Cisco nixes conference session on hacking IOS router code
Furor over Cisco IOS router exploit erupts at Black Hat
Cisco, ISS, Michael Lynn and Black Hat sign legal accord
Forum: Who’s right?
Separately, Cisco said this Friday it plans to issue a security advisory of its own related to the issue of remote exploits of Cisco routers, which will be posted here.
Lynn, an expert in uncovering security flaws, stepped in to the limelight – and a storm of controversy – after he spoke out earlier this week about a buffer-overflow exploit that can potentially undermine routers.
In doing so, he violated the wishes of former employer ISS as well as Cisco, which had abruptly canceled the presentation, saying it was premature to present the security findings.
Facing a lawsuit from Cisco and ISS, Lynn said he entered into a legal agreement with both vendors – with much help from high-tech defense attorney Jennifer Grannick – which he hopes will let him move on with his life and find another job.
But in a room full of reporters at the Black Hat conference, Lynn offered his own impression of the events that had led to the furor, which also included legal action by Cisco and ISS against the Black Hat conference.
Lynn told reporters at Black Hat that despite the complications it caused him and the fact it “was pretty scary,” he still feels he “did the right thing” in revealing what he had discovered in researching exploits associated with unpatched Cisco routers.
“I didn’t think the nation’s interest was served in waiting another year when a router worm would mean a serious threat,” he said of his decision to quit his job at ISS and reveal what he knew.
He said Cisco knew about the underlying vulnerability before he did, sometime in February, and fixed it with a patch in April. Lynn’s research examined how buffer-overflow exploits could undermine routers that aren’t patched.
Lynn admitted that he did engage in a “bit of deception” when he told Jeff Moss, CEO of Black Hat, that he would talk about voice over IP as a substitute presentation when ISS and Cisco canceled the original topic on the Cisco ISO shellcode and exploits.
Lynn said he knew he was in trouble after he gave the talk on Cisco routers; he said he wondered what was happening when a group of “guys with badges” asked him to join them in a room, where one said, “Got the van ready?”
This was a joke, however, and the group of government IT professionals, which included representatives from the U.S. CERT emergency-response team and the Air Force, said they appreciated learning of the potential for exploit of routers.
As a former employee of ISS, Lynn said he knew ISS had integrated knowledge about the exploit into some of its protective security gear, even though the information was not yet public.
Lynn refuted an assertion made by Cisco in its legal filing against him that reverse-engineering is somehow an illegal practice for evaluating software. “It’s not illegal,” said Lynn, saying this is common practice.
In departing the press conference, Lynn said he was accompanying his lawyer Jennifer Grannick over to Cisco to deliver Cisco-related software and materials he had promised under the legal agreement signed today.
For its part, Cisco issued a statement which said the “actions against Mr. Lynn and Black Hat were not based on the fact that a flaw was identified, rather that they chose to address the issue outside of established practices and procedures for responsible disclosure.”
Cisco added that that Lynn’s actions at Black Hat were “not in the best interest of protecting the Internet.”
An ISS spokesman said the company found the controversy with Lynn to be “an emotional issue.”
