[c-nsp] Fake Cisco Equipment News Articles - very interesting

[Jared Mauch]

On May 14, 2008, at 9:55 AM, Chris Burwel wrote:

> Ted Mittelstaedt wrote:
>>>
>>> And if it is being injected at the source, where is it being made,  
>>> and by
>>> whom?  Is it being made in the same factories that make the non- 
>>> counterfeit
>>> stuff?  Using the same machinery, same dies, same tools, same  
>>> people?  If
>>> so, then why would it be inferior?
>>>
> Unfortunately, I think this is the case. With the backing of the  
> Chinese
> government, I think it's very possible that the same factories,  
> people,
> and equipment are being used  to create the counterfeit Cisco  
> equipment.
>
> I agree with you on getting solid proof from Cisco. The few articles I
> have read on this issue seem to provide very little evidence as to  
> what
> negative effects the counterfeit equipment might have. There are  
> reports
> claiming that malware can be embedded into the equipment at the  
> factory
> to snoop on your network. With no evidence to back that, this seems  
> like
> little more then a scare tactic.

	I think this is something that is hard to prove.  Unless you have  
some personalized loss eg: theft of your own data, or company secrets,  
how do you determine that the 55% savings you got from the used, NIB,  
or surplus equipment is authentic.  Perhaps there is nothing nefarious  
other than concerns about protecting their brand name should the parts  
become sub-par.  There may be other users that are happy to pay a  
premium to know their equipment is authentic, for example those in the  
defense or intelligence community.

	There will always be someone who wants the price advantage, be it in  
hardware acquisition costs or elsewhere.  I recall  when some local  
ISPs would utilize the ISA and PCI T1 cards because it was cheaper  
than one of those "expensive" 2500 routers.  Over time they came to  
the realization that while the PC setup would work, it also required  
more care and feeding over a longer time.

	If you know the risk(s) you are taking, go ahead and get the  
equipment.  If folks are improperly labeling it and marketing it to  
you, even if it comes from reputable places, go back to them or go to  
law enforcement.  I just wish it was a bit easier to sort out the  
heritage of some of the equipment.  If I buy a discontinued IP Phone  
from eBay for my home, I want to know it wasn't stolen.  This process  
isn't easy.  It's also hard to validate a "sticker" when I could print  
5000 of them myself with the exact same S/N and slap them on some  
cheap clone.

	I do wish the sillyness with stuff like the CF, memory and  
optics(gbic, sfp, etc..) could be better dealt with.

	- Jared