In my opinion, probably the grossest error made by Cisco in all of this was silently patching their IOS back in April. Anyone who's ever used Cisco's software knows that you can never run the latest release, unless you want things to break, and break badly. As a result, how many organizations were at the latest, patched IOS release as of BlackHat? Not many, I'd wager. If, however, Cisco had come clean and told everyone that there is a serious problem in their IOS and exploitation is being actively researched by Chinese hacker groups, you'd see a lot more uptake of that April IOS release. Instead, Cisco hangs their customers out to dry.
Shameful, just shameful. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
