4 ms·

So it requires a Cisco router that has a default username and password, and the router has to not have any kind of input firewall for its SSH. Then you log in

by snowy 11y ago

So it requires a Cisco router that has a default username and password, and the router has to not have any kind of input firewall for its SSH. Then you log in and install a patched firmware containing your backdoor. It's hardly Cisco specific. Surely any router (or any device for that matter)that has a known default username and password can be exploited in this way? Am I missing something here?

msellout 11y ago
I accidentally downvoted you, but meant to upvote. You didn't miss anything.
georgerobinson 11y ago
Can anyone explain how something so basic as changing the default password is left out? Do enterprise routers, such as Cisco's, have web-based management interfaces or must everything be provisioned either manually over SSH or via some other provisioning software?
- kbenson 11y ago
  Imagine this scenario: There's already an exploited router on the network. On noticing traffic that can be identified as as coming from a Cisco router that appears to be booting (or apprears to be factory fresh), it immediately sources an exploit attempt to that address using default Cisco router passwords. If your lab allows internet access, you would probably be exploited within seconds of booting for the first time. There are sophisticated ways to employ very unsophisticated exploits.
- cnvogel 11y ago
  So, I worked at an internet provider up to several years ago, and we were using quite a lot of Cisco routers. Maybe something has radically changed, but I'd be surprised. Please someone correct me if that's now totally different. A cisco router with a blank config will come up with all interfaces configured "shutdown" and with no passwords set. You access it via a serial port on the front, labeled "Console". It provides a command line almost, but not quite, entirely unlike a unix shell :-) where you enter commands (ping, show routing tables, ..) or configuration statements (config terminal // Interface FastEthernet 0/0 // ip address 10.1.1.1... // no shutdown). If the only thing you do is to give it an ip-adddress on an interface and enable it, it will have a passwordless login via telnet. Every ISP/network department not run by complete imbeciles will have a "standard config" regarding login and passwords: Ours back in the days was a TACACS server for running user authentication, setting access levels for particular users (and automated logins for configuration management) and logging of logins/executed commands. You can also configure access lists that logins are only allowed from specific IP addresses. Probably also have a hardcoded password as fallback when the authentication server isn't reachable, disable the console port for when your router isn't in a locked box, ...
Kephael 11y ago
Cisco routers and switches do not have remote access enabled by default. They are not like consumer devices with an admin/admin login and a web interface. http://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/4145-ssh.html http://www.cisco.com/c/en/us/support/docs/security-vpn/secur...
- walshemj 11y ago
  actually cisco does have a web interface of course if your a pro you turn it off before it ever gets any where near your live network.
carterehsmith 11y ago
The firmware update should be signed by Cisco and verified before being applied, whether the person signed in is an admin or not. I believe newer Ciscos do that, I know newer versions of Windows do that for sure... admin or not, you are not overwriting certain critical components with unsigned/unverified stuff. Chromebooks work like that, too. Like, if you want to change shit on it without verification (say, to install Linux), you need to switch to "Developer mode" which cannot be done remotely, you need to push a pencil into a hole on the Chromebook or something like that.
Swannie 11y ago
This requires an older version of a Cisco router that will accept un-signed firmware. Newer IOS versions will only load Cisco signed code.
dsl 11y ago
The attack likely starts with a computer used by the network operations staff being compromised and a key logger or other credential theft tool being installed. It is much easier to own an admins laptop with a PDF exploit than to find a remotely exploitable Cisco vulnerability. Routers usually sit outside the firewall in typical network designs. The backdoor listens to raw network traffic coming in for the trigger, before any firewall rules on the router itself are processed. All in all, it is very well designed and part of an extremely advanced attack.

by snowy 11y ago

msellout 11y ago

I accidentally downvoted you, but meant to upvote. You didn't miss anything.

georgerobinson 11y ago

Can anyone explain how something so basic as changing the default password is left out? Do enterprise routers, such as Cisco's, have web-based management interfaces or must everything be provisioned either manually over SSH or via some other provisioning software?

kbenson 11y ago
Imagine this scenario: There's already an exploited router on the network. On noticing traffic that can be identified as as coming from a Cisco router that appears to be booting (or apprears to be factory fresh), it immediately sources an exploit attempt to that address using default Cisco router passwords. If your lab allows internet access, you would probably be exploited within seconds of booting for the first time. There are sophisticated ways to employ very unsophisticated exploits.
cnvogel 11y ago
So, I worked at an internet provider up to several years ago, and we were using quite a lot of Cisco routers. Maybe something has radically changed, but I'd be surprised. Please someone correct me if that's now totally different. A cisco router with a blank config will come up with all interfaces configured "shutdown" and with no passwords set. You access it via a serial port on the front, labeled "Console". It provides a command line almost, but not quite, entirely unlike a unix shell :-) where you enter commands (ping, show routing tables, ..) or configuration statements (config terminal // Interface FastEthernet 0/0 // ip address 10.1.1.1... // no shutdown). If the only thing you do is to give it an ip-adddress on an interface and enable it, it will have a passwordless login via telnet. Every ISP/network department not run by complete imbeciles will have a "standard config" regarding login and passwords: Ours back in the days was a TACACS server for running user authentication, setting access levels for particular users (and automated logins for configuration management) and logging of logins/executed commands. You can also configure access lists that logins are only allowed from specific IP addresses. Probably also have a hardcoded password as fallback when the authentication server isn't reachable, disable the console port for when your router isn't in a locked box, ...

Kephael 11y ago

Cisco routers and switches do not have remote access enabled by default. They are not like consumer devices with an admin/admin login and a web interface. http://www.cisco.com/c/en/us/support/docs/security-vpn/secure-shell-ssh/4145-ssh.html http://www.cisco.com/c/en/us/support/docs/security-vpn/secur...

walshemj 11y ago
actually cisco does have a web interface of course if your a pro you turn it off before it ever gets any where near your live network.

carterehsmith 11y ago

The firmware update should be signed by Cisco and verified before being applied, whether the person signed in is an admin or not. I believe newer Ciscos do that, I know newer versions of Windows do that for sure... admin or not, you are not overwriting certain critical components with unsigned/unverified stuff. Chromebooks work like that, too. Like, if you want to change shit on it without verification (say, to install Linux), you need to switch to "Developer mode" which cannot be done remotely, you need to push a pencil into a hole on the Chromebook or something like that.

Swannie 11y ago

This requires an older version of a Cisco router that will accept un-signed firmware. Newer IOS versions will only load Cisco signed code.

dsl 11y ago

The attack likely starts with a computer used by the network operations staff being compromised and a key logger or other credential theft tool being installed. It is much easier to own an admins laptop with a PDF exploit than to find a remotely exploitable Cisco vulnerability. Routers usually sit outside the firewall in typical network designs. The backdoor listens to raw network traffic coming in for the trigger, before any firewall rules on the router itself are processed. All in all, it is very well designed and part of an extremely advanced attack.