Cisco Blogs

Wow, thanks for accusing me of being an NSA goon. For the record, I said the reporting was sensationalized, not the documents.

On the economic espionage front, I really don't care if the NSA spies in order to shape national policy. Things get a lot murkier when intelligence agencies spy and then hand off that data off to private companies. Huawei was caught red-handed using stolen source code from Cisco[1]. Cisco probably lost millions because Huawei was able to undercut them and skimp on R&D costs. Frankly, I don't want any foreign companies willing to steal trade secrets managing the same internet backbones I conduct business on, just like China probably doesn't want their internet backbones running on American equipment. If there is evidence that the NSA has been handing Huawei source code to Cisco, or any kind of data to any private organization for that matter, in order to gain a competitive advantage, then Greenwald has yet to show it.

You can consider Stewart Baker's opinion to be worth jack shit, but apparently Glenn Greenwald, Ryan Gallagher and Ryan Grim thought his opinion was good enough to quote extensively for the SEXINT article that they wrote. But that's not even the point - they could have been quoting Glenn Beck for all I care. The issue is that they quoted him very selectively in order to not discredit their argument. That wasn't even the first time: right off the bat they omitted slides from the PRISM presentation in order to make the argument…

"In a readout system such as ours the network only consists of a data sender and a data receiver with an optional switch connecting them. Thus the only places where congestion occurs are at the sender or receiver. The readout system will typically produce data at near constant rates during measurements so congestion at the receiver will result in reduced data rates by the transmitter when using TCP."

At that point a better paper title would have been "Increasing buffers or optimizing application syscalls to receive 10 GB/s of data" as it has nothing to do with achieving reliable UDP transmission, which it doesn't even seem they needed:

"For some detector readout it is not even evident that guaranteed delivery is necessary. In one detector prototype we discarded around 24% of the data due to threshold suppression, so spending extra time making an occasional retransmission may not be worth the added complexity"

As far as actual reliable UDP testing at high speeds one might also want to consider the test scenario as not all Ethernet connections are equal. The 2 meter passive DACs used in this probably achieve ~10^-18 bit error rate (BER) or 1 bit error in every ~100 petabytes transferred. On the other hand go optical even with forward error correction (FEC) it's not uncommon to expect transmission loss in the real world. E.g. looking at something a little more current https://blogs.cisco.com/sp/transforming-enterprise-applications-with-25g-ethernet-smf is happy to call…

Thanks for sharing this — really solid write-up, and I agree with the core premise. Pickle is a huge blind spot in ML security, and most folks don’t realize that torch.load() is effectively executing attacker-controlled bytecode.

One thing we ran into while working on similar problems is that static opcode scanning alone tends to give a false sense of coverage. A lot of real-world bypasses don’t rely on obvious GLOBAL os.system patterns and can evade tools that depend on pickletools, modelscan, or fickling.

We recently open-sourced a structure-aware pickle fuzzer at Cisco that’s designed specifically to test the robustness of pickle scanners, not just scan models:

• It executes pickle bytecode inside a custom VM, tracking opcode execution, stack state, and memo behavior • Mutates opcode sequences, stack interactions, and protocol-specific edge cases • Has already uncovered multiple scanner bypasses that look benign statically but behave differently at runtime

Repo: https://github.com/cisco-ai-defense/pickle-fuzzer

We also wrote up some of the lessons learned while hardening pickle scanners here (including why certain opcode patterns are tricky to reason about statically): https://blogs.cisco.com/ai/hardening-pickle-file-scanners

I think tools like AIsbom are a great step forward, especially for SBOM and ecosystem visibility. From our experience, pairing static analysis + fuzzing-driven adversarial testing is where things get much more resilient over time.

I googled the 2003 Cisco vs. Huawei case as your post wasn't clear about the outcome. The WSJ article claims that Huawei admitted copying some software. I found this blog post:

https://blogs.cisco.com/news/huawei-and-ciscos-source-code-correcting-the-record

It's a Cisco reaction to the following statement by Huawei's chief US representative:

"Huawei provided our source code of our products to Cisco for review and the results were that there was not any infringement found and in the end Cisco withdrew the case ... the source code of the issues was actually from a 3rd party partner that was already available and open on the internet."

The blog post goes on to say that this is not a permissible statement and Huawei are misstating facts. Finally it provides some evidence for the copying, such as similar whitespace and comments in the source code. It also mentions the name of the "routine": STRCMP :-D. They should have run this post by an engineer before publishing...

Decide for yourself, but in my opinion there is quite limited value in a specific strcmp and likely they both copied it from the same free-software codebase.

Sure! When Mythos was first announced, there was an obvious prediction to make: if what Anthropic says is even remotely true, the participants will start talking over the next few months about how Mythos has been a big deal for them. Then that happened (https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/, https://blog.cloudflare.com/cyber-frontier-models/, https://blogs.cisco.com/cisco-on-cisco/how-cisco-defends-against-ai-threats), so I became convinced, although I shouldn't make it sound like I ever found the idea implausible.

I might be un-convinced if someone published a clear technical explanation of what error these companies have all made. The only counterarguments I've seen so far are vague speculation about how bubble dynamics might incentivize them to say it worked great, and to me that's not persuasive.

> NO! WRONG! tl;dr NO CODE IS BEING RELEASED AS BSD!

Then please cite a source that backs that up. Bothering to follow the links from the Mozilla post indicates you are dead wrong:

We plan to open-source our H.264 codec, and to provide
it as a binary module that can be downloaded for free
from the Internet. -- [1]

[...] The source code will be open source and distributed
with a BSD lIcense. The binary module is separate and
when the users software downloads it from Cisco, that
is when we are responsible for paying the MPEG LA
royalties. – Nadee Gunasena, Cisco PR [2]

[1] Cisco blog: http://blogs.cisco.com/collaboration/open-source-h-264-removes-barriers-webrtc

[2] Comment on same: http://blogs.cisco.com/collaboration/open-source-h-264-removes-barriers-webrtc/#comment-966417