15 ms·
Zero-days in Cisco Discovery Protocol
- thatiscool 7y agonot a backdoor?
- AdmiralAsshat 7y ago"Backdoor" usually implies the vulnerability was put in there intentionally.
- sarakayakomzin 7y agoyes, I believe that's why they used the word "Backdoor".
- dx87 7y agoThey might be alluding to the fact that depending on who manufactures the device, security vulnerabilities will be reported as a backdoor.
- AdmiralAsshat 7y agoAdmittedly I didn't read the whitepaper, but the CVEs that were mentioned on the page summary sounded like your run-of-the-mill stack overflow or string vulnerabilities. So yes, the end result might be the same (i.e. remote takeover), but I would hesitate to call them backdoors unless it was demonstrated that this vulnerability was intentionally known or left unfixed for the purposes of being abused by parties in the know.
- simion314 7y agoThe idea if the same bug was in a Chinese product the title would have been "backdoor injected" ... see yesterday and recent articles on HN.
- IAmEveryone 7y agoI searched and only found something about a vulnerability in "HiSilicone" hardware mentioned yesterday. That article mentions a pre-installed telnet server including accounts that can be started with the right command send over TCP. Whereas here, it's apparently a typical buffer overflow resulting in arbitrary (but BYOT (bring your own Telnet)) code execution. Sure, maybe Cisco is just better at disguising their backdoors for plausible deniability. But with what's known, intent seems far more likely in yesterday's case than this.
- trasz 7y agoA Telnet server is way too obvious for a backdoor. It’s more of a leftover debug feature.
- simion314 7y agoThe article title was different initially and was something that included backdoor,injected,Huawei(was no direct relation with Huawei). There were also many similar reports about US routes and IOT having default passwords or easy to guess passwords but each time the stupidity is assumed. Also the Windows "NSA key" article and comments were very convincing that for sure it was nothing evil and was never used anyway.
- TaylorAlexander 7y agoWell I suppose we don’t have enough information to determine whether it was put there intentionally or not. I recall from the Snowden leaks that the US has a well established program to maintain access to as many foreign networks as possible. A cozy arrangement with Cisco and/or a National Security Letter might help ensure such access is possible. https://www.aclu.org/other/national-security-letters https://www.aclu.org/other/national-security-letters
- __jal 7y agoThere has been more than one Cisco vulnerability that struck people as suspicious. I know it comes to my mind every time I see the string "Cisco zero day", whether or not it seems likely in any particular case.
- DyslexicAtheist 7y agoexcept with CISCO "backdoor" has 2 meanings: 1) CISCO's well documented efforts to intentinally put them into place in the canonical sense of the word (for LI): https://news.ycombinator.com/item?id=22251965 https://news.ycombinator.com/item?id=22251965 2) it is a well-known feature that is used to change the administrative distance of eBGP in order for an interior gateway routing protocol (IGP) to take precedence over an eBGP route. https://community.cisco.com/t5/networking-documents/what-is-the-bgp-backdoor-feature/ta-p/3154898 https://community.cisco.com/t5/networking-documents/what-is-...
- Scarbutt 7y agoAnything about all the other millions of devices(different brands) that implement CDP?
- deleted 7y ago[deleted]
- pixelpoet 7y agoDoes anyone actually have faith in their hw+sw security these days? The speculative execution stuff on CPUs, system code full of buffer overflow / privilege escalation bugs, attacks that can work across airgaps using high frequency sounds, all the attacks on various hash functions, fake digital signatures, sandbox escapes, ... it goes on and on and each time you realise that it's been wide open for ages, and whichever security researcher found it could just as well have sold the exploit for lots of money instead. Even as a fairly tech savvy guy I wouldn't actually know how to make a truly secure computing environment short of putting the whole thing in a silent Faraday cage and having metal detecting scans going in and out.
- chundicus 7y agoI think it's all relative really. I don't really worry about these sorts of exploits because I'm not a high value target whose going to be attacked by most scary exploits. Certainly there are exceptions, especially when the exploit casts a wide net and doesn't care about who it hits. Your trust in your HW and SW should be proportional to the risk. I would hate to have my private data leaked, but realistically it wouldn't be much more than a nuisance I have to sort out. The same is not true for a government agent or a CEO for example. It would be nice if we could just 100% trust all our software and hardware, but it's just not practical these days.
- tasty_freeze 7y agoYou are a worthwhile target at a minimum that your machines can be used as part of botnets and DOS networks. Sure, they might not be digging out your bank account number, but since the cost to the attacker of compromising your machine might be nothing more than a few hundred packets, they'll try anyway.
- deleted 7y ago[deleted]
- chundicus 7y agoSure, which is why I mentioned the "wide net". I take reasonable precautions, apply basic monitoring, and take care with what software I'm downloading so that I lower my risk of this. It's not foolproof but it's good enough to keep me from being an easy target, while not sacrificing any convenience or spending a lot of time fortifying my machine.
- gist 7y agoRepresents most of what I hate about the 'security industrial complex'. Self serving and to that point at the bottom of the page is a link saying: 'With the discovery of the CDPwn vulnerabilities, organizations from every industry as well as governments are looking for a way to identify which of their devices are impacted by these vulnerabilities. Armis offers a CDPwn Risk Assessment to help organizations looking to understand their exposure.' Then - 'Request a CDPWN threat assessment'.
- miah_ 7y agoMy thoughts as well. I'm interested in hearing about new novel security issues; I'm not interested in reading a advertisement. With widespread deployment of IP Phones and the like, I think this is a interesting find. But at the same time I wish I read about this on bugtraq.
- IAmEveryone 7y agoI guess for the benefit of having people work on such things you will occasionally have to suffer through the brutal injustice that is ... a single-line text ad at the end of an article?
- jlgaddis 7y agoThey provided a very detailed, technical, 29 page PDF as well.
- drcross 7y agoSame. I'm a CCIE and after a five minute skim I can't tell if this is grandstanding or an actual threat. Best practice is to disable CDP on all eternal interfaces. This is a given.
- Bluecobra 7y agoThere's a funny name and a logo, so grandstanding.
- falcor84 7y ago
- kitteh 7y agoSecurity best practices have always recommended disabling CDP in an untrusted environment (that applies to things like LLDP, too). It is comical to see how many people leave both of those running on internet exchange points or sometimes worse things (like ospf or isis). The general default on nature of products to enable this is unfortunate.
- jcims 7y agoI remember writing it up as part of internal assessments in the late 90's lol.
- fulafel 7y agoSecurity best practices have always recommended treating all networks as untrusted and having non-internet-hardened stuff turned off by default in network facing products. You're right of course too, but Cisco is the real bad guy here.
- kitteh 7y agoEh, I know a lot of folks who do enable CDP/LLDP for internal device to internal device links for discovery and troubleshooting. But they don't turn it on any customer/external facing interfaces (this enforcement thru offline config generation). So there can be a time and a place for it under the right conditions provided you understand the security risks (possibility of someone plugging something on an internal link, changing the router config incorrectly).
- ga-vu 7y agoThey're not zero-days if they've been privately disclosed and patches are available.
- excalibur 7y agoGreat point!
- godgod 7y agoIt might as well be a zero day. I have a ton of Cisco devices sitting around my company. Human nature is to be lazy. Most people won't upgrade to the latest firmware especially with how cisco upgrade procedure is. They'll just plug and go.
- mitchs 7y agoI'd argue with most enterprise's upgrade cycle for this gear it is better than a 0 day, it is a -5 to -3 year exploit.
- jeffrallen 7y agoNice reminder that fuzzing protocol decoders is a good plan. Also a nice time to ask yourself if your last protocol decoding code should have been a structured parser instead of a handmade hack. https://objectcomputing.com/resources/publications/sett/march-2016-protocol-parsing-in-scala-part-i https://objectcomputing.com/resources/publications/sett/marc...
- LeonM 7y agoIf this bug was discovered in a Huawei device we'd immediately call it a backdoor and plea to ban all these devices from our critical infrastructures. And yet, when Cisco has a security bug we patiently wait for the patch and move on with our business.
- layer4 7y agoI think Cisco’s [existing] reputation goes a long way
- driverdan 7y agoTheir reputation for security flaws like this and helping suppress human rights by selling hardware to the Chinese government?
- whatthesmack 7y agoPerhaps. But also their reputation for actually originating ideas and technology (or legally acquiring them) instead of stealing swaths of intellectual property like Huawei has and does.
- VectorLock 7y agoI think most of the luster Cisco had 20 years ago is firmly and irrevocably tarnished.
- fulafel 7y agoYou mean their consistently bad security track record makes their bugs less suspicious?
- deleted 7y ago[deleted]
- Cyph0n 7y agoDamn, that’s a wide array of devices...
- walshemj 7y agoFrom my CCNA days I seem to recall that this protocol is a local one and would require a break into another host on the network. Though the diagram shows the core switch directly connected to the internet instead of having an external router connect to the internet - which was the design CISCO suggested back when in did my CCNMA evening class
- keyme 7y agoThe article does not suggest that devices can be attacked from the internet. The threat is VLAN hopping or lateral movement. That illustration is oversimplified.
- walshemj 7y agoI was being generous :-))))))) though maybe if some PFY had let the management interface exposed to the internet but that is a worse problem I feel.
- bifrost 7y agoI read through it - it doesn't seem like VLAN hopping would really be possible unless you can straight up get into the control plane and change the port configuration. Thats at least 2-3 more steps from "RCE" basically.
- fulafel 7y agoOr a compromised L2 VPN endpoint
- crmrc114 7y agoDo we really need half of the features pre-installed on our cisco devices. Like honestly- I really wish I could "tune" my ios firmware and remove things I dont need so I could reduce my attack surface. Since its not called out clearly in the title this affects cicso's LLDP implementation as well https://go.armis.com/hubfs/White-papers/Armis-CDPwn-WP.pdf https://go.armis.com/hubfs/White-papers/Armis-CDPwn-WP.pdf
- socceroos 7y agoThat's what I was taught to do by my dad. Take the uncompiled kernel, remove every driver and feature from it that you don't use for your use-case and then compile. Then go through hardening steps at each layer, chroot all the things, tripwire, etc. Compile all applications configuring for only the features you're going to use. Get a report on all versions and subscribe to vulnerability mailing lists. And then at the end, understand that you have a system that is still vulnerable so set up a regular cadence of maintenance. It's a bit harder to do these days for various reasons.
- bifrost 7y agoIts fairly easy to turn CDP and LLDP off...
- eternalny1 7y agoThe NSA used to intercept Cisco routers in-transit to swap them out for back-doored ones. I'm sure they knew about these, that's the problem, the NSA "hoards" zero-days instead of alerting the manufacturers. And then we end up with nonsense like this, and you know half of these won't be patched for years, if ever. Tens of millions of Cisco devices.
- yjftsjthsd-h 7y agoIf they have a known exploit in the normal firmware, why bother MITMing hardware in order to backdoor it?
- onesmallcoin 7y agoFlytraps! Probably easier than finding rces
- eternalny1 7y agoThey may not have known about these protocol flaws at the time they were intercepting the physical devices. Either that, or they were not vulnerable to these exploits at the time.
- andresramon60 7y agoRegularly backup and keep those backups off your network, boom problem solved. My point was not that I take no precautions or that you're not at risk because you're not a government agent. Email Nicolas on webspycode@gmail.com for hacking related
- bifrost 7y agoI've read through the description and now the whitepaper and I've got a few takeaways. 1. These attacks can't be carried out over the internet, you need local access. Thats easier than you'd think with employees with unsecured laptops/vms/etc. 2. The exploit(s) appears to be RCE in the OS that runs on the device, but not neccesarily translating into executing configuration commands on the control plane. But its not a big leap to make configuration changes... 3. The DoS case doesn't seem great either but also requires local access. 4. The string format bug has the most entertainment value for me -> You can spew CDP packets into a switch/device which potentially overwrite other devices CDP data, which means you could potentially issue a poweroff or change the name of said device. 5. The phone vulnerability is good too -> If you can broadcast/spew CDP from your host, you can be annoying to phones. 6. The cameras can only be harassed by plugging directly into it, rendering the vuln somewhat useless. My takeaway is that you can't easily escalate vlan privileges via CDP which is good, but you can def monkey with the controlplane and maybe someone will come up with a way to change the IOS configuration.
- Cyph0n 7y agoThe NX-OS video shows a demo where the attacker remotely enables the management IP and uses that to reconfigure the Nexus switch.
- bifrost 7y agoI guess thats what I get for not watching the video and only reading the PDF. That said "enabling the management ip" is unlikely to happen since most people put the management IP on OOB and ACL where you can access it from; the exploit is unlikely to be able to change ACLs.
- Hikikomori 7y agoIf you can enable it you can change other config like ACLs as well.
- fulafel 7y agoThey can be carried over the internet: VPN vulnerabilities are pretty common, eg https://www.us-cert.gov/ncas/current-activity/2019/07/26/vulnerabilities-multiple-vpn-applications https://www.us-cert.gov/ncas/current-activity/2019/07/26/vul... VPNs commonly bridge at layer 2, that's a direct path to pwnage in this case.
- geocar 7y agoThis doesn’t surprise me. I’ve avoided Cisco equipment since I wrote cdp-tools over a decade ago. During development (reverse engineering) lots of things I tried crashed switches and routers. No faith in anything Cisco makes after that. But lots of networks I was connected to learned my topology from CDP so I needed to speak CDP...