Security Threat Or False Alarm? - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Security Threat Or False Alarm?

Improper programming around a little-known but ubiquitous communication protocol used in networking gear, Abstract Syntax Notation One, or ASN.1, has the government, networking manufacturers, security researchers, and IT executives worried that networks--including key parts of the Internet, phone systems, and the electrical power grid--may be vulnerable to disruptive buffer overflow and malformed packet attacks.

The problem, made public last week, was first identified in February when Internet security watch group CERT Coordination Center disclosed products vulnerable to attack because of a weakness in the Simple Network Management Protocol, in which ASN.1 is widely used. The fallout from the ASN.1 problem may especially threaten electric utilities, which rely on ASN.1 throughout their power grids. "That includes power grids for nuclear power generators,'' says Michael Erbschloe, VP of research at research firm Computer Economics.

"We don't know the scope of the problem," says a network administrator at a major electric utility. "We installed a lot of equipment that runs ASN.1 when we did our Y2K work."

Lucent Technologies Inc. says it's identifying which of its products depend on ASN.1. But Cisco Systems is waiting for more information. Right now, it's like "looking for a needle in a haystack," says Mike Caudill, a product security incident response manager at Cisco. That worries the chief security officer at a large insurance company, who says, "I'd rather Cisco find any potential problems in their equipment before some hacker group."

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
2021 State of ITOps and SecOps Report
2021 State of ITOps and SecOps Report
This new report from InformationWeek explores what we've learned over the past year, critical trends around ITOps and SecOps, and where leaders are focusing their time and efforts to support a growing digital economy. Download it today!
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

Remote Work Tops SF, NYC for Most High-Paying Job Openings
Jessica Davis, Senior Editor, Enterprise Apps,  7/20/2021
Blockchain Gets Real Across Industries
Lisa Morgan, Freelance Writer,  7/22/2021
Seeking a Competitive Edge vs. Chasing Savings in the Cloud
Joao-Pierre S. Ruth, Senior Writer,  7/19/2021
Register for InformationWeek Newsletters
Current Issue
Monitoring Critical Cloud Workloads Report
In this report, our experts will discuss how to advance your ability to monitor critical workloads as they move about the various cloud platforms in your company.
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll