6 ms·
Critical SSH Backdoor in multiple Barracuda Networks Products
- mpyne 14y agoI wonder how much it is worth to crack the root password that was left embedded in all the Barracuda devices even with the patch applied?
- marshray 14y agoIs it the same in all devices? Is it ever changed? How many people know it?
- sarabob 14y agoTo a competitor? Depends if people blame barracuda or can trace the cracking back to you. Are you thinking of switching a bitcoin mining operation into a cracking-passwords-to-put-companies-out-of-business operation?
- mpyne 14y agoI'm more afraid of the nebulous criminal underground or national entities than I am of Barracuda's competitors. I'm not referring at all to Bitcoin (or putting companies out of busines...), it's surely cheaper to just use available "cloud cracking" assets directly (which I'm also sure is already being done). Since it's apparently unclear, I'm not talking about taking action myself, but I will say that due diligence for any company using Barracuda hardware means that they should be asking the same question themselves.
- nwh 14y agoThere's services that already do this, but it's not really necessary in most cases. Even with my lonely workhorse I can smash through hundreds of millions of hashes a second. You only need additional reinforcements for more computationally harder hashes.
- jtchang 14y agoIf you are going to put backdoors (I can't believe I am even saying this) on your product then it might be good to at least disable normal password logins and only do SSH key exchange. That said why the hell are there UNDOCUMENTED backdoors? I mean it makes sense from a customer support perspective but really?
- frozenport 14y agoIf you think thats bad, why are there undocumented backdoors that don't immediately trace back to Barracuda?
- im3w1l 14y agoWhat do you mean?
- dsr_ 14y agoIf you've got SSHd running on an unexpected port, you could put in a banner: "Barracuda field service access". If you've got accounts on the system, they can have GECOS fields saying the same. And put it in the manual. "Disabling the fieldservice account will prevent service personnel from logging in. Customers with active support contracts should not do so." White hats tell you what they're doing and why.
- rdl 14y agoLooks like it's worth avoiding Barracuda appliances even after this patch, since they're retaining the "remote" account. As to why they did this -- feature checklist compatibility with Huawei and ZTE is my guess. Remember most of these do intercept -- they have an SSL CA cert which is trusted by all your business client devices, to do MITM. So, if you pwn the box, you can pwn all the SSL traffic at the target company, too. It's an excellent place to attack.
- jlgaddis 14y agoWait, so is the private key for that certificate stored on the Barracuda device!? If it's possible to become root on these devices, then ... wow.
- tedunangst 14y agoYes, it has to be able to sign all the fake certs it generates.
- jlgaddis 14y agoSeems like it would be possible to extract the private key then and use it elsewhere, no? So you wouldn't be limited to MITM'ing only at the company where this device sits, but you could effectively MITM (without generating any certificate errors or warnings) anywhere you can get in between the client and server? Or am I missing something?
- marshray 14y agoThe Barracuda device doesn't allow you to do anything you couldn't already do with other tools. However, if an organization were able to get a widely-trusted MitM cert (such as this one http://www.theregister.co.uk/2012/02/09/tustwave_disavows_mitm_digital_cert/ http://www.theregister.co.uk/2012/02/09/tustwave_disavows_mi... or this one http://ssl.entrust.net/blog/?p=1696 http://ssl.entrust.net/blog/?p=1696 ) and deployed it on their Barracuda, it could likely be extracted by someone with root-level access. It wouldn't surprise me to see some "loose nukes" arise out of Barracuda's utterly irresponsible behavior here.
- darkarmani 14y agoHere is the timeline if you're interested - 14 days from contact to publication: 2013-01-10: Sending advisory and proof of concept exploit via encrypted channel. 2013-01-14: Vendor confirms receipt and provides BNSEC IDs. 2013-01-14: Vendor sends listing of reported vulnerabilities and release schedule. 2013-01-21: Conference call - discussing implemented solutions. 2013-01-23: Barracuda Networks releases alert & secdef 2013-01-24: SEC Consult releases coordinated security advisory.
- jlgaddis 14y agoFrom the post to f-d: > 2012-11-29: Contacting vendor. > 2012-11-29: Sending advisory and proof of concept exploit via encrypted channel.
- darkarmani 14y agoOops. You are completely correct. I posted the timeline for the follow-up advisory! And it's too late to edit.
- darkarmani 14y agoOops! This is the correct timeline (the other one is a followup advisory): 2012-11-29: Contacting vendor. 2012-11-29: Sending advisory and proof of concept exploit via encrypted channel. 2012-12-04: Vendor confirms receipt and provides BNSEC IDs. 2012-12-05: Requesting further coordination (conference call). 2012-12-13: Sending reminder regarding SEC Consult disclosure policy. 2012-12-15: Vendor responds - arranging conference call. 2012-12-18: Conference call: Addressing the risks the discovered vulnerabilities pose to customers and release schedule. 2013-01-14: Vendor sends listing of reported vulnerabilities and release schedule. 2013-01-21: Conference call - discussing implemented solutions. 2013-01-21: Vendor provides information about some questions which came up. 2013-01-22: Asking for definitive listing of affected appliances. 2013-01-23: Barracuda Networks releases alert & secdef 2013-01-24: SEC Consult releases coordinated security advisory.
- dsl 14y agoThe "patch" disables some but not all backdoor accounts on the machine. The root account is still present with password auth.
- martinced 14y agoKnowing not much about network appliances and their role etc., when you're building a company, starting from scratch, are there good rule of thumb to not fall for the "enterprisey compromisey" piece of junk that such companies (Huawei -- state-sponsored espionnage-- ZTE, Barracuda, etc.) do sell? Is there anything you can do to be at least a little bit safe? Are there vendors that still value security or is it just accepted now that MITM and state-sponsored attacks are a normal way of operating?
- rdl 14y agoIn the long run, I have more faith in software defined networking to de-shitify this space than any other single solution. We're actually working on some tech solutions which might help in the software defined networking security area, but it'll be 6-12 months. Ideally some of it will be open sourced and/or standardized.
- papsosouid 14y agoThe easiest way is to just not buy that crap at all. Computers are cheap, open source software is available, put the two together.
- danielweber 14y agoPeople do not want to maintain that stuff. Your comparative advantage as a startup is not running your own firewall. Nb: I am employed by a Barracuda competitor, but would probably still advise against trying to run things on your own.
- dredmorbius 14y agoWhich is where leveraging Open Source comes into play. We have ROMs for home networking gear, we have bootable distros for security purposes, we have open source builds for Android. No reason similar projects couldn't be aimed at enterprise type kit. You'd still require hardware manufacturers, though open standards and whitebox builds might come into being. And there'd be distro wars, but very likely 2-3 lead contenders that would be the default safe choice.
- martinced 14y agoKnowing not much about network appliances and their role etc., when you're building a company, starting from scratch, are there good rule of thumb to not fall for the "enterprisey compromisey" piece of junk that such companies (Huawei -- state-sponsored espionnage-- ZTE, Barracuda, etc.) do sell? Is there anything you can do to be at least a little bit safe? Are there vendors that still value security or is it just accepted now that MITM and state-sponsored attacks are a normal way of operating?
- EvanAnderson 14y agoIt's unfathomable to me why any company in the IT security industry would ship a product with an undocumented remote access mechanism built-in. This seems like a sure way, when the mechanism is inevitably discovered, to cause harm to your company's reputation. I've always felt vaguely distrustful of Barracuda anyway, but it's nice to have some facts to cite when not recommending their products.
- absconditus 14y agoI attempted to view this URL at work. It was blocked by our Barracuda filter. "The link you are accessing has been blocked by the Barracuda Web Filter because it contains spyware. The name of the spyware is: Spyware.Exploit.Misc.MWBR"
- 0x0 14y agoThis is highly suspicious!
- obituary_latte 14y agoWell, now you know how to fix that. With a properly formatted request to the department responsible for maintaining the web filter, of course.
- btb 14y agoWow thats amazing. Honestly feel bad for any IT admin who bought any of their products not knowing about those backdoors(assuming they arent disclosed anywhere). I personally would be extremely upset to read that A)they had backdoors in the box they sold me, and that B)they intend to keep them intact for "customer support"!
- Intermernet 14y agoThe workaround mentioned involves: 1. Log in to the device and go to the "Advanced" tab on the web GUI. 2. Add "&expert=1" to the end of the URL. 3. Click on the red "Expert" button. 4. Scroll to the bottom and disable remote support. You will need to reverse this process if you ever actually require the barracuda remote support.
- d0c5 14y agoWhy did they write pubic key in the solutions bit? Surely a sly joke..
- neonkiwi 14y agoThere's a very unfortunate [dead] comment by Intermernet in this thread. Unfortunate because it might be a good solution for someone who administers the affected hardware and wants to remove the backdoor after patching (as per the Workaround section in the OP, "Barracuda Networks offers an expert option that disables the SSH daemon. For assistance contact the Barracuda Networks Support.") Note, I have no idea why the user is dead, nor if this solution actually works, but I'm posting Intermernet's post below: The workaround mentioned involves: 1. Log in to the device and go to the "Advanced" tab on the web GUI. 2. Add "&expert=1" to the end of the URL. 3. Click on the red "Expert" button. 4. Scroll to the bottom and disable remote support. You will need to reverse this process if you ever actually require the barracuda remote support.
- deleted 14y ago[deleted]
- Aloha 14y agoI worked for Barracuda, I left, because I felt the company was slimy. On the other hand, from a customer service point of view, this supposed back door is great, it makes the product much easier to support, for a customer base who is honestly, most of the time not that technically astute. If they were more astute, they would have bought a different product.
- mcpherrinm 14y agoI've had an upswing in spam today on my systems, and it looks like a lot of them have headers indicating they've gone through a Barracuda device. It doesn't surprise me that spammers are all over this.
- dredmorbius 14y agoMonitoring and support backdoors are common and pervasive in most networking gear. This isn't something that should be considered lightly. There's been some hullaboo about Chinese manufacturers putting backdoor access into their devices, Huawei Technologies and ZTE Corporation particularly: http://www.infosecisland.com/blogview/21930-China-Has-Backdoor-Access-to-Eighty-Percent-of-Communications.html http://www.infosecisland.com/blogview/21930-China-Has-Backdo... Legally mandated backdoors exist on Cisco gear as well: http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html http://www.forbes.com/2010/02/03/hackers-networking-equipmen...