North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: IOS Rookit: the sky isn't falling (yet)

  • From: Jim Wise
  • Date: Thu May 29 09:38:30 2008

Hash: SHA1

On Thu, 29 May 2008, Fred Reimer wrote:

>plaintext (the IOS code) and the hash.  It is not trivial to be able to
>make changes in the code and maintain the same hash value, but there has
>been at least limited success in doing so.

Has there?  My understanding is that constructing a new image to match 
an existing MD5 checksum (vs. constructing two new images with matching 
MD5 checksums) was still not feasible.  Did I miss something?

>It may not be possible to replace the boot ROM, because presumably the new
>hardware would check the ROM code hash before loading it and also
>presumably the ROM code does not have quite as much text messages that can
>be changed to generate the same hash value, thereby bypassing the security

This may be an obvious question, but given that the code which verifies an
IOS image would (presumably) be part of the boot ROM, where would you put
the code which verifies the boot ROM?  What does it mean to say `the
hardware' should check the boot ROM?

- -- 
				Jim Wise
				[email protected]
Version: GnuPG v1.4.9 (NetBSD)