4 ms·
> some type of exploit for the Cisco ASA as well Given ASAs run a 2.6 kernel that's not hard. From my Kiwicon 8 notes on Alec Stuart-Muirk's talk: * Literall
by rodgerd 11y ago
> some type of exploit for the Cisco ASA as well
Given ASAs run a 2.6 kernel that's not hard. From my Kiwicon 8 notes on Alec Stuart-Muirk's talk:
* Literally every protocol handler has CVEs against it.
* Every time Cisco add a new one it gets at least a DOS CVE. (There are some proofs of concept for pivoting these into real exploits on other Cisco products.)
* The ASA’s high availability protocols are unauthenticated and unencrypted. This is bad. Like, “will accept any packet claiming to be a management packet as valid” bad.
* Some authentication is optionally available, but if you enable it, the ASA will still accept unauthenticated protocols.
- BuildTheRobots 11y agoI this this might be the slides [1] -though if anyone has a video of the talk I'd love to watch it. [1] https://ruxcon.org.au/assets/2014/slides/Breaking%20Bricks%20Ruxcon%202014.pdf https://ruxcon.org.au/assets/2014/slides/Breaking%20Bricks%2...
- jlgaddis 11y agoBecause they can (allegedly) survive software upgrades (on the ASAs and IOS routers), I've always believed that these "infections" are done at a lower level than the OS, such as in the ROMMON on the IOS routers. After hearing about "SYNful Knock" recently, I'm inclined to believe this even more.