Global networking market leader Cisco Systems Inc said on Monday it has launched a product review to look for tampering after rival Juniper Networks Inc found code in its firewall software that made it vulnerable to cyberattacks.
Juniper Thursday that it had discovered unauthorized code in its firewall software, saying it could be exploited to allow an attacker to decode encrypted communications made through security devices.
This prompted Cisco to revise its code. Security experts urged other technology companies to do the same after Juniper's surprise news last week.
It was the first time such a large technology company had discovered the addition of an unauthorized “backdoor” or code that could facilitate cyberattacks.
Large technology companies frequently check their code for bugs, including backdoors that attackers can use to attack customer networks.
But security expert HD Moore says, "The challenge is that no one was looking for this before. If you know you're looking for a malicious backdoor, you're more likely to find something.".
Cryptologist Bruce Schneier said that technology companies should have been looking for unauthorized code for a long time, but many ignored it because such checks would have added costs. “The problem is that the market doesn’t reward the things we want, like secure code. Nobody wants to pay for it,” he said.
Cisco said on its blog that the test will include code reviews by engineers with deep networking and encryption experience and penetration testing, a process in which technicians try to attack products to find bugs in the way malicious hackers might try to exploit them.
Meanwhile, the US Department of Homeland Security said it is investigating how the Juniper breach could affect government networks.
