24 ms·
The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
- xroche 10y agoIt it yet another ASN.1-related exploit ?
- dogma1138 10y agoOn thing I find odd is "JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from a trusted source as claimed." They claim that the implant is digitally signed, then they say that it shouldn't work because Cisco software is digitally signed also, and it's verified by the Cisco Secure Boot. Isn't that a bit contradictory? sure they might have had flaws in their verification process (we've seen signature verifications that were nothing more than "is this a signed message" before) but since Cisco verifies the signature properly (as you haven't been able to binary patch Cisco boot images for 5+ years) doesn't this implies that the NSA got a hold of the signing keys used by Cisco or an authorized 3rd party?
- spdustin 10y agoThey clarified that the files are signed by PKI now. Notice the order of the words "digitally signed [files] are signed using secure [etc] in newer platforms" It suggests to me that the previous signature style was a symmetric type, whereas now it's asymmetric.
- dsp1234 10y agoThe advisory is saying that JETPLOW is not signed. And thus, in newer platforms where signing is implemented, it would prevent that type of attack.
- deleted 10y ago[deleted]
- mintplant 10y ago> They claim that the implant is digitally signed Where do they claim that? Both occurrences of the words "digitally signed" in the quoted section refer to the new Cisco software and not to the JETPLOW payload.
- revelation 10y agoIt says in newer platforms. That said, a boot verification is kind of pointless in systems that are expected to run continuously for months. If you have code execution, you might be perfectly fine only having your in for months and not bother to patch the firmware.
- lallysingh 10y agoIt's just poor grammar. Here's the fixed sentence, replacing a confusing proper noun: "PROPERNOUN Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms [that] prevents these types of attacks."
- dogma1138 10y agoYeah I guess it's a combination of non ideal grammar and lack of reading comprehension on my part :)
- tater_sent_me 10y agoIsn't it interesting how JETPLOW is an anagram for JEWPLOT?
- nibbler_death 10y agoIsn't it interesting how JETPLOW is an anagram for JEWPLOT?
- dogma1138 10y agoIt's also an anagram of JoltPew maybe The Flash is behind this....
- nibbler_death 10y agoThat's getting a little far fetched now...
- nibbler_death 10y agoThat's getting a little far fetched now...
- ihaveahadron 10y agoFor being so smart why does every comment and article on this site lack proper English grammar?
- walrus01 10y agore: EXTRABACON If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.
- Shank 10y agoIt's a pivot though. If you can compromise anything that's on the LAN you can pivot inside with this. The sample files provide prove that they have working exploits, that they're NSA-grade, and that they function. The actual auction files are probably much more "fire and forget" grade -- either acting over the internet or doing privilege escalation combined with these attacks.
- walrus01 10y agoyes, absolutely true. If the exploit is running on a non-Cisco compromised device that's in RFC1918 IP space somewhere that it can reach internal, SNMP-listening interfaces of the device, that's a good way to attack it.
- zengid 10y agoIT student here. Genuinely curious: could you explain why this is a fundamental error?
- walrus01 10y agoSNMP is used for internal management/monitoring of network-enabled devices, which you don't expose to the public internet. The SNMP supported on old PIX is SNMPv1/SNMPv2 which sends the community string in plaintext, and the reply is similarly unencrypted, so its basically the same security level as telnet or regular http (none).
- zengid 10y ago
- LeafStorm 10y agoIs this a standard naming convention for exploits?
- alienth 10y agoIt's the code names of the exploits which are being released by Shadow Brokers. Likely the names which the original authors utilized. Equation Group is known to utilize code names like this: https://en.wikipedia.org/wiki/Equation_Group#Codewords_and_timestamps https://en.wikipedia.org/wiki/Equation_Group#Codewords_and_t...
- rdtsc 10y agoThose are the names of compartments / projects for classified information. The way compartments work, they are supposed to be isolated not just from lower level (secret vs top secret) but also among each other. So things would have instructions like "handle via EPICBANANA channels only". So if you are not read into EPICBANANA you don't get access to it, even though you might have TS clearance. So programs / capabilities are referred by those names. Instead of say "Oh that Cisco ASA blah model VPN MitM thing we have". That also means that just because you have TS clearance doesn't mean you get to pick up and walk away with all the TS information you want ... oh wait, that did happen already, didn't it... oops.
- justinjlynn 10y agoSnowden was a member of a group with what is known as "PRIVAC", or privileged access, capabilities. To my amateur understanding, this type of access is granted to systems administrators or other users of information systems who may see things they aren't otherwise cleared to see in the course of their normal duties. Additionally, it was reported, though denied by Snowden, that Snowden used other colleagues' credentials to access information for collection and later disclosure.