7 ms·
Cisco routers in at least 4 countries infected by highly stealthy backdoor
- tamersalama 11y agoWhy is a country relevant in this context?
- deleted 11y ago[deleted]
- toxican 11y agoWhy wouldn't it be? They found the malware on routers in those countries, and presumably not elsewhere. Should serve as a heads up for owners of those routers in those countries.
- tdaltonc 11y agoKnowing who's been targeted can help you figure out who's doing the targeting.
- takee 11y agoWho do you think is the common enemy of Ukraine, the Philippines, Mexico, and India?
- jayess 11y agoOne doesn't need to be an enemy to be a target of surveillance.
- tdaltonc 11y agoI think that probably only one of them is the enemy. Stuxnet, for example, hit computers in half a dozen countries but only deeply penetrated in Iran (by design). So two of the countries might be collateral or they might be deliberate misdirection. The target could also be a non-state actor with a distribute presence.
- dguido 11y agoI think to show that it's more than an isolated incident. This is not a piece of research malware that was only deployed in a lab or got picked up on a fileshare. It was found, deployed and operating, on many routers. It alludes to a systematic effort to use this capability, so you probably should take steps to do something about it.
- malfist 11y agoBecause it's likely a state did this. > In an interview with Reuters, FireEye CEO Dave DeWalt said, "That feat is only able to be obtained by a handful of nation-state actors." In any event, there's no doubt that the devices were infected by a professionally developed and fully featured backdoor.
- pyvpx 11y agothis presentation says as much, but the techniques have been widely known for...ever. yes, most likely the only group with the will power and means is a government, but it certainly doesn't _have_ to be. http://www.phenoelit.org/stuff/FX_Phenoelit_25c3_Cisco_IOS.pdf http://www.phenoelit.org/stuff/FX_Phenoelit_25c3_Cisco_IOS.p...
- mhurron 11y agoThat piece of information lends support to it being a highly focused attack and not one that you should start expecting to show up everywhere.
- happyscrappy 11y ago>The initial infection doesn't appear to exploit any vulnerabilities in Cisco devices. Rather, attackers seem to be taking advantage of routers that use passwords that are factory default
- Beltiras 11y agoI'm waiting for a hardware feature that prompts the setup administrator for credentials upon factory reset boot (preferably an SSH key rather than a password) and doesn't function till properly secured.
- jlgaddis 11y agoCisco routers by default and/or after erasing the config a) don't have a default password, b) won't let you log in via telnet if there is no password set, and c) do not have SSH enabled. N.B.: I'm referring to BFRs running IOS. I have no idea how the SMB series are configured by default.
- turk- 11y agohmm I wonder who could be doing this. https://www.techdirt.com/articles/20140518/17433327281/cisco-goes-straight-to-president-to-complain-about-nsa-intercepting-its-hardware.shtml https://www.techdirt.com/articles/20140518/17433327281/cisco...
- takee 11y agoSounds about right
- dguido 11y agoProbably not: "The initial infection doesn't appear to exploit any vulnerabilities in Cisco devices. Rather, attackers seem to be taking advantage of routers that use passwords that are factory default or are somehow otherwise known."
- oconnore 11y agoThis rhetoric of casually discounting the possibility of government breaches in commercial networks might have sounded insightful and worldly several years ago. Now it just seems ignorant. The person you were responding to had no evidence to back their claim (in this particular instance), but neither do you.
- tptacek 11y agoQuoting facts from a story that rebut someone's theory isn't "rhetoric of casually discounting", even if you don't like where those facts take us.
- mtgx 11y agoWhoever trusts Cisco at this point are living in la-la land where they refuse to acknowledge the reality that Cisco has been helping governments build surveillance capabilities into its routers to spy on its customers. Whatever negative impact this has on their own business is fully deserved at this point.
- mindcrime 11y agoThe problem is, how do you know who you can trust? I mean, really, you can't, as long as network devices are closed source, proprietary black boxes. Right now I have no particular reason to think Juniper or anybody else ship routers that are less likely to be exploited or back-doored, relative to Cisco. Yet one more reason to say that rms right was right all along.
- imglorp 11y agoPlenty of sites can replace a black box router with a plain linux or bsd box with a couple of good network cards and some iptables/ipfw rules. That solves a number of issues right there.
- amyjess 11y agoOf course, if you were really paranoid, you'd worry that somebody intercepted your Linux box's motherboard as it was being shipped to you so they could install a backdoor in the BIOS or EFI...
- godgod 11y agoRemind me to never purchase a Cisco device ever again.
- _wmd 11y agoFWIW IOS backdoors were already being researched by 2003, this isn't surprising at all, and I imagine by now the true scope of the problem is a little bigger than a few routers
- sslalready 11y ago> FWIW IOS backdoors were already being researched by 2003 [...] I recall there was a Swede (the grue?) on the Pull the Plug IRC network who was cross-compiling and linking in backdoored object code in Cisco IOS images already back in 2000.
- deleted 11y ago[deleted]
- joosters 11y agoFrom the report: The initial infection doesn't appear to exploit any vulnerabilities in Cisco devices. Rather, attackers seem to be taking advantage of routers that use passwords that are factory default Why then are you assuming that Cisco backdoored its products?
- soylentcola 11y agoFor someone looking to cause trouble using other people's routers, I can't imagine it's terribly difficult to run a Shodan search and attempt login with default credentials. The whole thing can be scripted and once you have a list of vulnerable devices, you upload the modified firmware and you own the router. I don't do this sort of thing but I was under the impression that it's pretty common (hence the importance of setting strong passwords on any device accessible to WAN).
- deleted 11y ago[deleted]
- acd 11y agoThis is why your routers should run open source software. At least then you can reinstall it and be reasonably assured it does not have malware. Also we need an inventory of where things can be hidden in devices. Are there embedded flash areas where are they? A modern reinstall should: 1) Reinstall the operating system from a known good source 2) Flash all firmware and flash chips with known good code. Both operating system and firmware should be open source so you can inspect the code.
- acd 11y agoI have not inspected the full source of Linux but I have read parts of it. I suspect other hackers also read parts of the source and will spot if there is anything fishy in there. The point is that should be able to read the source code like a recepie for your cake. If someone hides the recepie and tells you its a yummy cake but you know its full of exploits its not. Main point is, if it can be hacked it will be hacked. It´s better that we can read the source code and verify that the software in our devices has not been tampered with.
- snowy 11y agoRouters used by most networks are proprietary boxes from specific vendors. There is no such thing as open source software for them. I do not know of an open source router hardware that is available (at ISP scale) Getting an X86 box and throwing freebsd and quagga on it might work for small amounts of traffic. But for ISP scale bandwidth your stuck with a few main vendors...
- rsync 11y ago"I do not know of an open source router hardware that is available (at ISP scale)" You're basically correct but it's worth remembering that it is possible to add a bunch of quad nics to whitebox and run bpf on it, courtesy of one of the BSDs and do real routing at an ISP scale. That would be completely open source (and quite secure). Probably pretty performant if you knew what you were doing.
- snowy 11y ago
- snowy 11y agoSo it requires a Cisco router that has a default username and password, and the router has to not have any kind of input firewall for its SSH. Then you log in and install a patched firmware containing your backdoor. It's hardly Cisco specific. Surely any router (or any device for that matter)that has a known default username and password can be exploited in this way? Am I missing something here?
- msellout 11y agoI accidentally downvoted you, but meant to upvote. You didn't miss anything.
- georgerobinson 11y agoCan anyone explain how something so basic as changing the default password is left out? Do enterprise routers, such as Cisco's, have web-based management interfaces or must everything be provisioned either manually over SSH or via some other provisioning software?
- kbenson 11y agoImagine this scenario: There's already an exploited router on the network. On noticing traffic that can be identified as as coming from a Cisco router that appears to be booting (or apprears to be factory fresh), it immediately sources an exploit attempt to that address using default Cisco router passwords. If your lab allows internet access, you would probably be exploited within seconds of booting for the first time. There are sophisticated ways to employ very unsophisticated exploits.
- cnvogel 11y agoSo, I worked at an internet provider up to several years ago, and we were using quite a lot of Cisco routers. Maybe something has radically changed, but I'd be surprised. Please someone correct me if that's now totally different. A cisco router with a blank config will come up with all interfaces configured "shutdown" and with no passwords set. You access it via a serial port on the front, labeled "Console". It provides a command line almost, but not quite, entirely unlike a unix shell :-) where you enter commands (ping, show routing tables, ..) or configuration statements (config terminal // Interface FastEthernet 0/0 // ip address 10.1.1.1... // no shutdown). If the only thing you do is to give it an ip-adddress on an interface and enable it, it will have a passwordless login via telnet. Every ISP/network department not run by complete imbeciles will have a "standard config" regarding login and passwords: Ours back in the days was a TACACS server for running user authentication, setting access levels for particular users (and automated logins for configuration management) and logging of logins/executed commands. You can also configure access lists that logins are only allowed from specific IP addresses. Probably also have a hardcoded password as fallback when the authentication server isn't reachable, disable the console port for when your router isn't in a locked box, ...
- eyeareque 11y agoFirst, I don't think this is the NSA. It is far to sloppy for something like this. You probably wouldn't be able to detect them so easily. It is possible to be from another nation state though, or smart attacker. Also, we know that the NSA tries to cover their tracks: http://arstechnica.com/tech-policy/2014/08/snowden-the-nsa-not-assad-took-syria-off-the-internet-in-2012/ http://arstechnica.com/tech-policy/2014/08/snowden-the-nsa-n... "Instead, the TAO’s hackers “bricked” the router, Snowden said. He described the event as an “oh shit” moment, as the TAO operations center team tried to repair the router and cover their tracks, to no avail." What I am confused about is that I assumed IOS images were signed. How are people creating backdoored IOS images without failing signature checking? Maybe they patched rommon?
- horchata 11y agoSo FireEye posted the original article. Anyone surprised?