IOS worm clarification


Thanks for your review and language skills in this
area, the article translated was even a mess

From: Andrei Mikhailovsky <>
Subject: Re: [Full-disclosure] Cisco IOS hacked?


Being a co-author of the "Hacking Exposed Cisco
Networks" book and one
of the co-founders of Arhont Ltd an Information
Security Company that is
doing the research for the book on Cisco Devices I
have to make the
following comments about the article in

The russian article
( has been
badly paraphrased from the livejournal of one of the
of the book. As a result of this outrageously
inaccurate paraphrasing of
the article many confusions and misunderstandings
have been circling on
the security related sources and mailing lists.

Some of the issues addressed in the article are true
and Arhont is
currently preparing a formal advisory that will be
sent to PSIRT.

Among the discovered issues are multiple
vulnerabilities in EIGRP
implementation. Also, authors have addressed the
_theoretical_ aspects
of an algorithm for cross-platform worm that could
spread in IOS based
devices. The existence of the practical
implementation of such warm is a
complete lie. Let me assure that there has been no
development nor the
desire to develop such code by the authors of the
book. The theoretical
methodology and algorithms will be also discussed
with PSIRT at the
appropriate time.

In addition, there has been some minor
inconsistencies of the
livejournal postings that will be soon addressed and

If you have any comments on this topic we would be
glad to address them.

Andrei Mikhailovsky
Arhont Ltd - Information Security

J. Oquendo
GPG Key ID 0x97B43D89