8 ms·
Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability
- moyix 10y agoThis is the vulnerability exploited by EXTRABACON: https://xorcatt.wordpress.com/2016/08/16/equationgroup-tool-leak-extrabacon-demo/ https://xorcatt.wordpress.com/2016/08/16/equationgroup-tool-...
- salem 10y agoSo it seems the dump contains at least one legit 0-day, and it's been in use for 3 years.
- jonknee 10y ago> and it's been in use for 3 years. At least 3 years.
- ktRolster 10y agoThis is why "responsible disclosure" is a joke. The flaws put in by these companies are not responsible. (Sometimes people make mistakes, but we're at the point of carelessness).
- tptacek 10y agoThat may feel good to say, but as someone whose job it was to find these kinds of bugs in software from companies ranging from tiny startups to financial exchanges to major tech vendors, this is a kind of carelessness shared by virtually everyone shipping any kind of software anywhere. That said, the term "responsible disclosure" is Orwellian, and you should very much avoid using it.
- cdubzzz 10y agoHow is "responsible disclosure" Orwellian?
- tptacek 10y agoIt's coercive. It redefines language to make any handling of vulnerabilities not condoned by the vendors who shipped those vulnerabilities "irresponsible", despite the fact that third parties who discover vulnerabilities have no formal duty to cooperate with those vendors whatsoever. The better term is "coordinated disclosure". But uncoordinated disclosure is not intrinsically irresponsible. For instance: if you know there's an exploit in the wild for something, perhaps go ahead and tweet the vulnerability without notice!
- deleted 10y ago[deleted]
- gcr 10y agoDo you think there's a moral imperative for researchers to responsibly disclose discovered vulnerabilities? I see it as a kind of Hippocratic Oath in the field.
- tptacek 10y agoNo.
- openasocket 10y agoMaybe I don't understand you. Are you suggesting that, if you find a vulnerability in a piece of software, you aren't ethically obligated to confidentially disclose the vulnerability to the maintainer so it can be patched before the vulnerability becomes publicly known? If so, why? What is a person who found a vulnerability ethically obligated to do?
- 10y ago
- Someone1234 10y agoWhich does at least HINT that it might be what it claims to be. That's a pretty impressive 0-day which they just gave away as a freebie, who knows what they didn't give away. I will say we'll never get real confirmation if this was actually stolen from the NSA, but if the other bundle contains a bunch of nice original vulnerabilities people will presume it was.
- salem 10y agoMakes you wonder if they could have made more money by pretending to find them and reporting them to the respective bug bounty programs.
- deleted 10y ago[deleted]
- wcummings 10y agoBug bounties almost never pay market value for exploits. Only reason to participate in them is charity.
- kbenson 10y agoAnd legality. I'm not sure why people seem to entirely discount that portion. There's more reward by selling on the black market, but there's also more risk associated with that.
- MichaelGG 10y agoYeah. Homeowners don't pay market value for me not robbing them, either. After all, think how much that jewellery is worth. And the damage of ID cards and passports. A laptop alone could get me $250, but no one wants to give me even $10 for telling them their door is unlocked.
- peterbotond 10y agoMost people only care about tangibles. When i politely advised about security holes, i was told that "we don't need people like you' or just called the police. I understand.
- runesoerensen 10y agoYep here's Cisco's statement on this: http://blogs.cisco.com/security/shadow-brokers http://blogs.cisco.com/security/shadow-brokers
- jessaustin 10y ago...secure asymmetrical (public-key) cryptography... Hmmmm.
- molecule 10y agothe lede is @ the bottom of the announcement: > Exploitation and Public Announcements > On August 15, 2016, Cisco was alerted to information posted online by the Shadow Brokers group, which claimed to possess disclosures from the Equation Group. The posted materials included exploits for firewall products from multiple vendors. The Cisco products mentioned were the Cisco PIX and Cisco ASA firewalls. > Source > The exploit of this vulnerability was publicly disclosed by the alleged Shadow Brokers group.
- deleted 10y ago[deleted]
- HammadB 10y agoI see, so this is why they laid off so many employees today.... :P
- curiousgal 10y agoYup, I mean since when doesn't correlation mean causation!
- kevin_thibedeau 10y agoNetcraft would be able to confirm if only their Cisco gear wasn't pwned.
- snowy 10y agoYou would have to have the ASA configured to accept SNMP packets from the IP your sending them from (or maybe spoof the source address if you knew it as it would be a UDP packet) and you would also have to know the SNMP community string. Chances are if you had all of this info you could cause all sorts of damage even without the vulnerability.
- revelation 10y agoI'm not sure I follow, what you can do with the bits of information you named when this vulnerability is not present? In any case, the scenario for this exploit is that you have access (possibly only restricted, no superuser) to an internet-facing machine and are looking to expand your reach into the internal network. That's why they are keen to exploit these Cisco boxes, they are a stepping stone to the wider network that might be otherwise firewalled off and a pretty permanent one at that.
- tptacek 10y agoNot really. As the preceding comment points out: it's pretty unusual for an ASA to speak SNMP to the Internet. Not having SNMP publicly exposed is CISSP-level (read: elementary, and idiosyncratically specific) best practice. Rather, my (uninformed) guess is that this implant is exclusively used to persist onto networks that have been compromised through some other vector. It's not a pivot bug.
- revelation 10y agoThat's what I was trying to say, you have access to a machine like a webserver that had internet-facing services you could exploit and now you want to go deeper into the network. Or do they usually only speak SNMP on a management port?
- tptacek 10y agoNo, I'm saying you can't do that with this bug; that's what I mean by "not a pivot bug". It's a way of persisting inside access you got some other way. Because, again, people don't listen to SNMP on the outside interface.
- deleted 10y ago[deleted]
- tptacek 10y agoIs there some foreign government or organization that buys large numbers of ASAs, enables SNMP on them, exposes SNMP to the Internet on them, and uses predictable SNMP community strings? (For people w/o net ops experience: the SNMP "community" is your shared SNMP password, and in competent networks will be approximately as unguessable as a login password).
- ryanlol 10y agoI scanned. The answer seems to be no, nobody is doing that.
- tptacek 10y agoSo then this vulnerability is pretty much only useful (1) for persisting onto networks you've already compromised (2) and only in cases where you can apply consultative effort to discover the SNMP community string? Or maybe there are lots of overseas networks where they enable SNMP and leave the community string "public"? (Also: how batshit crazy is it that the ASA will let you use "public" as your community string, let alone default to it?)
- hroi 10y agoYou can learn the community string by monitoring traffic. The community string is included in each and every SNMPv2 PDU. SNMPv2 performs no handshake, so is vulnerable to trivial spoofing. Enterprises and ISPs reusing community strings on every device and never rotating them is not unheard of.
- tptacek 10y agoYes, obviously you can sniff community strings, but that only helps if you're speaking SNMP over the Internet. Again the case I'm making is that this particular bug is really only useful for persisting onto networks you've already compromised.
- 10y ago
- Bino 10y agoCisco is maintaining way to much property code, while laying off people. Wow, that's a recipe for success...
- Relys 10y agoThe bit-rot struggle is real. XD
- deleted 10y ago[deleted]
- pg_is_a_butt 10y agoweird... lay off 14,000 people, and suddenly attack vectors surface that put our country at risk. seems like we better bail out cisco. too big to fail. you're all idiots.
- NKCSS 10y agoThe link ( https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp https://tools.cisco.com/security/center/content/CiscoSecurit...) hits as 404 right now... HTTP Status 404 - /security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp type Status report message /security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp description The requested resource is not available. Apache Tomcat/7.0.54
- revelation 10y agoCisco is running an old version of Apache Tomcat and the links on their security pages are dead? Shocker! They had so many good things to say about their security-mindedness in this post, they even explained Pythons pexpect, and I can't imagine any parallel universe where that somehow connects to the security of Cisco devices.
- oldsj 10y agoAm I missing something? This is like saying "remote code execution possible if the attacker knows your ssh password"
- omginternets 10y agoYeah, I've been scratching my head over this as well.
- wmf 10y agoSNMP should not allow remote code execution under any circumstances.
- rdtsc 10y agoIt's how attack surfaces work. Yes, it shouldn't allow. But SNMP invovles that pesky ASN.1 encoding, written often by cheap contractors or people who don't really care about security much. So it allow for various buffer overflows, timing attacks, it is basically a large hatch to open and start jiggling all the gears in there and see what gives.
- jlgaddis 10y agoOne case that immediately springs to mind is a network monitoring system exposed to the Internet in order to provide a live "status" page, either for the staff, users, or the public. That system would have SNMP access to the ASA firewalls (which are otherwise normally well-protected). Gaining access to that public host would then grant you RCE to the protected internal firewall. If the public host were hosted, say, at AWS/DO/etc., and used a VPN for access to those internal network devices, you've just gained access to the internal network itself. (Note also that a) SNMP uses UDP and b) community strings, v1 and v2c at least, are plain-text. SNMPv3 has a bit more protection but it's not as widely used.)
- therein 10y agoSo what you're saying is it would be trivial for, say, a state actor to tap into the fiber optic cables and snoop for this unencrypted community strings going over UDP? And then to use them to gain access to internal networks? Well fuck, NSA was inside pretty much any corporate network they wanted then.
- tomovo 10y agoEverybody's fired.
- cwkoss 10y agoI wonder if Cisco has any legal basis for suing the NSA for developing/allowing the leak of this software?
- rdtsc 10y agoI like the idea in principle. But the answer is no. In general you can't sue the US govt unless ... wait for it... US govt lets you sue it. Like say it does for some form of tort.
- tptacek 10y agoFurther supporting the hypothesis that these are implants (meant to persist access gained through other vectors), not external or pivoting exploits, is the fact that the other firewall exploits from the batch (for Fortinet firewalls, for instance) target web management interfaces that also aren't exposed on external interfaces.