1. Do you think that Mike Lynn acted in a responsible manner? Why or why not?
In
the end, the researcher, Michael Lynn, went ahead with a presentation,
describing flaws in Cisco's software that he said could allow hackers to
take over corporate and government networks and the Internet,
intercepting and misdirecting data communications. Mr. Lynn, wearing
a white hat emblazoned with the word "Good," spoke after quitting his
job at Internet Security Systems Inc. Wednesday. Mr. Lynn said he
resigned because ISS executives had insisted he strike key portions of
his presentation.
http://www.scheier.com/blog/archive/2005/07/cisco_harasses.html
-----------------------------------------
2. Do you think that Cisco and ISS were right to pull the plug on Lynn’s presentation at the
Black Hat conference? Why or why not?
have searched an interview forum which Lynn said:
I was very specifically told... It was January 26th and Cisco had just
announced a totally different vulnerability than the once I
demonstrated, They'd announced a vulnerability for something called
"Multiple Crafted IPv6 Packets Cause Router Reload" (as they worded it
in their patch message). But that's a very vague term. It just says,
"Hey, something is wrong in IP6 with the router reload" ... but it
didn't say you could be in control of it. ISS wanted to get some more
details fot it ... and Cisco wouldn't give (the information) to them. So
(ISS manager) came to me and said, "Can you reverse-engineer ... can
you disassemble IOS ... to find out what their vulnerability is?
http://www.wired.com/politics/security/new/2005/08/68365?currentPage=all
-----------------------------------------
3. Outline a more reasonable approach toward communicating the flaw in the Cisco routers that
would have led to the problem being promptly addressed without stirring up animosity among
the parties involved.
When Mike Lynn discovered that is was possible to create a network
worm that could propagate itself as it attacked and took control of routers
across the internet.
-----------------------------------------