3 ms·

One case that immediately springs to mind is a network monitoring system exposed to the Internet in order to provide a live "status" page, either for the staff,

One case that immediately springs to mind is a network monitoring system exposed to the Internet in order to provide a live "status" page, either for the staff, users, or the public. That system would have SNMP access to the ASA firewalls (which are otherwise normally well-protected). Gaining access to that public host would then grant you RCE to the protected internal firewall. If the public host were hosted, say, at AWS/DO/etc., and used a VPN for access to those internal network devices, you've just gained access to the internal network itself. (Note also that a) SNMP uses UDP and b) community strings, v1 and v2c at least, are plain-text. SNMPv3 has a bit more protection but it's not as widely used.)

therein 10y ago
So what you're saying is it would be trivial for, say, a state actor to tap into the fiber optic cables and snoop for this unencrypted community strings going over UDP? And then to use them to gain access to internal networks? Well fuck, NSA was inside pretty much any corporate network they wanted then.
- jlgaddis 10y ago
  Pretty much. See previous disclosures discussing how the NSA captures, for example, configuration files for Cisco devices passing over the Internet in e-mail, TFTP, etc. If you've sent a community string over the Internet, it's quite possible that they have it too.
oldsj 10y ago
Edit: I see what you're saying now, if the NMS is in the cloud for some reason, the attacker could get the community string since it's sent clear text. Really glad one of the first things I did when I got my new job was to get us on snmp v3 Wouldn't the firewall be just as exposed to the internet? After all, that's what it's job is: to protect the internal network from the external. In your scenario the attacker would first have to hack the NMS to get the community string on the firewall running SNMP

therein 10y ago

So what you're saying is it would be trivial for, say, a state actor to tap into the fiber optic cables and snoop for this unencrypted community strings going over UDP? And then to use them to gain access to internal networks? Well fuck, NSA was inside pretty much any corporate network they wanted then.

jlgaddis 10y ago
Pretty much. See previous disclosures discussing how the NSA captures, for example, configuration files for Cisco devices passing over the Internet in e-mail, TFTP, etc. If you've sent a community string over the Internet, it's quite possible that they have it too.

oldsj 10y ago

Edit: I see what you're saying now, if the NMS is in the cloud for some reason, the attacker could get the community string since it's sent clear text. Really glad one of the first things I did when I got my new job was to get us on snmp v3 Wouldn't the firewall be just as exposed to the internet? After all, that's what it's job is: to protect the internal network from the external. In your scenario the attacker would first have to hack the NMS to get the community string on the firewall running SNMP