Cisco routers in at least 4 countries infected by highly stealthy backdoor | Hacker News Reader

Cisco routers in at least 4 countries infected by highly stealthy backdoor

arstechnica.com

200 pointsDeinos75 comments

So it requires a Cisco router that has a default username and password, and the router has to not have any kind of input firewall for its SSH.

Then you log in and install a patched firmware containing your backdoor.

It's hardly Cisco specific. Surely any router (or any device for that matter)that has a known default username and password can be exploited in this way?

Am I missing something here?

I accidentally downvoted you, but meant to upvote. You didn't miss anything.

Can anyone explain how something so basic as changing the default password is left out? Do enterprise routers, such as Cisco's, have web-based management interfaces or must everything be provisioned either manually over SSH or via some other provisioning software?

Imagine this scenario: There's already an exploited router on the network. On noticing traffic that can be identified as as coming from a Cisco router that appears to be booting (or apprears to be factory fresh), it immediately sources an exploit attempt to that address using default Cisco router passwords.

If your lab allows internet access, you would probably be exploited within seconds of booting for the first time.

There are sophisticated ways to employ very unsophisticated exploits.

So, I worked at an internet provider up to several years ago, and we were using quite a lot of Cisco routers. Maybe something has radically changed, but I'd be surprised. Please someone correct me if that's now totally different.

A cisco router with a blank config will come up with all interfaces configured "shutdown" and with no passwords set. You access it via a serial port on the front, labeled "Console". It provides a command line almost, but not quite, entirely unlike a unix shell :-) where you enter commands (ping, show routing tables, ..) or configuration statements (config terminal // Interface FastEthernet 0/0 // ip address 10.1.1.1... // no shutdown).

If the only thing you do is to give it an ip-adddress on an interface and enable it, it will have a passwordless login via telnet.

Every ISP/network department not run by complete imbeciles will have a "standard config" regarding login and passwords: Ours back in the days was a TACACS server for running user authentication, setting access levels for particular users (and automated logins for configuration management) and logging of logins/executed commands. You can also configure access lists that logins are only allowed from specific IP addresses. Probably also have a hardcoded password as fallback when the authentication server isn't reachable, disable the console port for when your router isn't in a locked box, ...

Cisco routers and switches do not have remote access enabled by default. They are not like consumer devices with an admin/admin login and a web interface.

http://www.cisco.com/c/en/us/support/docs/security-vpn/secur...

actually cisco does have a web interface of course if your a pro you turn it off before it ever gets any where near your live network.

The firmware update should be signed by Cisco and verified before being applied, whether the person signed in is an admin or not. I believe newer Ciscos do that, I know newer versions of Windows do that for sure... admin or not, you are not overwriting certain critical components with unsigned/unverified stuff.

Chromebooks work like that, too. Like, if you want to change shit on it without verification (say, to install Linux), you need to switch to "Developer mode" which cannot be done remotely, you need to push a pencil into a hole on the Chromebook or something like that.

This requires an older version of a Cisco router that will accept un-signed firmware. Newer IOS versions will only load Cisco signed code.

The attack likely starts with a computer used by the network operations staff being compromised and a key logger or other credential theft tool being installed. It is much easier to own an admins laptop with a PDF exploit than to find a remotely exploitable Cisco vulnerability.

Routers usually sit outside the firewall in typical network designs. The backdoor listens to raw network traffic coming in for the trigger, before any firewall rules on the router itself are processed.

All in all, it is very well designed and part of an extremely advanced attack.

hmm I wonder who could be doing this.

https://www.techdirt.com/articles/20140518/17433327281/cisco...

Sounds about right

Probably not: "The initial infection doesn't appear to exploit any vulnerabilities in Cisco devices. Rather, attackers seem to be taking advantage of routers that use passwords that are factory default or are somehow otherwise known."

This rhetoric of casually discounting the possibility of government breaches in commercial networks might have sounded insightful and worldly several years ago. Now it just seems ignorant.

The person you were responding to had no evidence to back their claim (in this particular instance), but neither do you.

Quoting facts from a story that rebut someone's theory isn't "rhetoric of casually discounting", even if you don't like where those facts take us.

I don't know, I think it could be seen as that if the facts quoted do not support the position they were used to bolster.

I don't think so. Maybe you could point out the part of the comment I replied to that supports that argument?

I don't think how "easy" or low-tech the infection method is really points one way or another towards whether it was a government agency, whether it be the NSA or some other, or not. Using such a fact, whether it be from the story or not, does not strongly indicate to me, and I do not think it should strongly indicate to others, that this was or was not the NSA. I can see that as "rhetoric of casually discounting".

I'm not particularly a fan of the comment in question, it was a bit confrontational for my taste, but I also think evidence in support of a position should be relevant, and I view this evidence as only loosely relevant, if that, to the stated position. Whether it's from the source article or not is besides the (or at least my) point in this case.

If someone were to make a persuasive argument that the initial method of infection actually mattered to the NSA (which I haven't seen yet), I might change my position.

Like how the NSA doesn't know how to use default passwords?

"Foiled again! We found this high value computer network, but using a default password to break in is too crude for our tastes."

I don't care where the facts take us, but that observation does nothing to tell us what is going on here.

Yes, but Dan Guido's point was that the parent comment didn't have anything to tell us either. He used a fact to rebut the insinuation. You accused him of "casually dismissing" it. You were wrong.

> but Dan Guido's point was that the parent comment didn't have anything to tell us either

You talked to him offline? Because he didn't actually write that.

What he said is "Probably not", in reference to the NSA being involved. He then quoted a line that doesn't support his "Probably not" assertion.

> rhetoric of casually discounting the possibility

Rhetoric: language designed to have a persuasive or impressive effect on its audience. Casually: without definite or serious intention.

From a logical standpoint, that sentence fragment is a representation of cognitive dissonance given it states there is and is not intent to impress (raise interest). I'd consider rephrasing it.

A different attack method doesn't rule out the NSA though.

Why would a government use something super secret if a normal attack would work?

To a first approximation every country in the world has an interest in backdooring Cisco routers, so if the vector for accomplishing that is as dumb as default passwords, why exactly would you single NSA out for that? Nobody's saying it couldn't have been NSA --- like China, Russia, France, Israel, &c NSA also backdoors foreign routers --- only that this story doesn't point to NSA directly.

The moral drama in this story is much less interesting than the technical phenomenon, especially when we barely have an inkling of what's happening technically.

I agree it doesn't point to the NSA directly, but I'm interested in how they use the default password as an infection vector. There are theoretically very interesting and sophisticated ways to do that, such is other infected routers on the network identifying source traffic from factory booted routers and initiating the infection at that point, which would have an extremely high chance of succeeding. In that case what would have been discovered is the reproduction method, and possibly not the initial infection method.

FWIW IOS backdoors were already being researched by 2003, this isn't surprising at all, and I imagine by now the true scope of the problem is a little bigger than a few routers

> FWIW IOS backdoors were already being researched by 2003 [...]

I recall there was a Swede (the grue?) on the Pull the Plug IRC network who was cross-compiling and linking in backdoored object code in Cisco IOS images already back in 2000.

This is why your routers should run open source software. At least then you can reinstall it and be reasonably assured it does not have malware.

Also we need an inventory of where things can be hidden in devices. Are there embedded flash areas where are they?

A modern reinstall should:

1) Reinstall the operating system from a known good source 2) Flash all firmware and flash chips with known good code.

Both operating system and firmware should be open source so you can inspect the code.

Routers used by most networks are proprietary boxes from specific vendors. There is no such thing as open source software for them.

I do not know of an open source router hardware that is available (at ISP scale)

Getting an X86 box and throwing freebsd and quagga on it might work for small amounts of traffic. But for ISP scale bandwidth your stuck with a few main vendors...

"I do not know of an open source router hardware that is available (at ISP scale)"

You're basically correct but it's worth remembering that it is possible to add a bunch of quad nics to whitebox and run bpf on it, courtesy of one of the BSDs and do real routing at an ISP scale.

That would be completely open source (and quite secure).

Probably pretty performant if you knew what you were doing.

yep, but you are never going to get a generic processor architecture to have anywhere near the performance of custom silicon ASICs designed for specifically for routing packets. No matter what software you put on top of it.

Its never going to work in a core network routing 100s of gigs of traffic. So it's not going to work for ISPs

This story is about Cisco IOS ROMMON. AFAIK that limits the issue to enterprise-class routers. Such routers can be replaced with PC-based routers running open software.

Not really, this same vulnerability would apply to F/OSS. It's just that the users never changed the password from the factory default. The article is sensationalist, but it's not news.

" At least then you can reinstall it and be reasonably assured it does not have malware."

How so? Is there anywhere a list of hashes of software that multiple people independently from each other verified, compiled (and compared)? Because without that, "open source" adds 0 to security in the scenarios we are talking about here.

Additionally, how many packages/firmwares have you inspected the last, let's say, decade? If I were a betting man, I'd put my money on 'less than I can count on one hand' (well maybe you're in infosec and get paid for audits...)

Why has this been downvoted? It's an important argument.

Which open source projects have deterministic builds, with a verifiable source of signature information - be that concensus or a source of truth that is verfied by concensus, so that I can be sure that either a) the binary I download has a very high certainty of being correct, or b) the source code I downloaded and compiled from has a very high certainty of being un-modified.

With a vendor, they don't need deterministic builds so badly, as they push a single file, and an authoritative source of signatures.

Ultimately a vendor needs deterministic builds too. Otherwise, it doesn't necessarily know what it's shipping!

I have an example of a binary where the difference between a remotely exploitable service and a fixed version of the same service is a single bit. That bit (or some other bit that also changes the code's functionality in an important way) can be changed by any person or (potentially compromised) computer in the chain of compilation, packaging, and distribution unless someone has a way to tell whether what those people and computers assert is "correct". If the binaries routinely change appreciably every time someone cuts a software release, it's going to be expensive to go back and check whether there's also a malicious change, bearing in mind that the person whose computer made the change doesn't have to have been malicious.

Sure, my point was that open source doesn't matter anything for this attack vector. I have yet to see anyone with reproducible builds being used and cared about in production. It's too expensive, and impractical. How are you going to verify that a system you just installed is OK? An attacker would've patched the md5sum (or other hashing) utility as well, so you'd need to mount you whole filesystem from another (trusted) machine, run the checksum on each file from that other machine, and compare with a known-good (through a reputation network) list.

And in the mean time, a million monkeys have social-engineered your secretary's machine through a Farmville js trick and pwned your network 3 ways from Sunday.

I agree it would be hard to take advantage of today. I hope we'll get better tools over time, like package managers and forensics tools that are aware of these things.

Even better: routers should have a physical switch where flashing the firmware can be disabled. Malware wouldn't survive a reboot.

The likely result of that is even more routers running unpatched vulnerable software.

I have not inspected the full source of Linux but I have read parts of it. I suspect other hackers also read parts of the source and will spot if there is anything fishy in there.

The point is that should be able to read the source code like a recepie for your cake. If someone hides the recepie and tells you its a yummy cake but you know its full of exploits its not.

Main point is, if it can be hacked it will be hacked. It´s better that we can read the source code and verify that the software in our devices has not been tampered with.

First, I don't think this is the NSA. It is far to sloppy for something like this. You probably wouldn't be able to detect them so easily. It is possible to be from another nation state though, or smart attacker. Also, we know that the NSA tries to cover their tracks: http://arstechnica.com/tech-policy/2014/08/snowden-the-nsa-n... "Instead, the TAO’s hackers “bricked” the router, Snowden said. He described the event as an “oh shit” moment, as the TAO operations center team tried to repair the router and cover their tracks, to no avail."

What I am confused about is that I assumed IOS images were signed. How are people creating backdoored IOS images without failing signature checking? Maybe they patched rommon?

Why is a country relevant in this context?

Why wouldn't it be? They found the malware on routers in those countries, and presumably not elsewhere. Should serve as a heads up for owners of those routers in those countries.

Knowing who's been targeted can help you figure out who's doing the targeting.

Who do you think is the common enemy of Ukraine, the Philippines, Mexico, and India?

One doesn't need to be an enemy to be a target of surveillance.

Just a potential enemy.

Economic competitors who are not really potential enemies are targets of surveillance.

I think that probably only one of them is the enemy. Stuxnet, for example, hit computers in half a dozen countries but only deeply penetrated in Iran (by design). So two of the countries might be collateral or they might be deliberate misdirection. The target could also be a non-state actor with a distribute presence.

I think to show that it's more than an isolated incident. This is not a piece of research malware that was only deployed in a lab or got picked up on a fileshare. It was found, deployed and operating, on many routers. It alludes to a systematic effort to use this capability, so you probably should take steps to do something about it.

Because it's likely a state did this.

> In an interview with Reuters, FireEye CEO Dave DeWalt said, "That feat is only able to be obtained by a handful of nation-state actors." In any event, there's no doubt that the devices were infected by a professionally developed and fully featured backdoor.

this presentation says as much, but the techniques have been widely known for...ever. yes, most likely the only group with the will power and means is a government, but it certainly doesn't _have_ to be.

http://www.phenoelit.org/stuff/FX_Phenoelit_25c3_Cisco_IOS.p...

That piece of information lends support to it being a highly focused attack and not one that you should start expecting to show up everywhere.

So FireEye posted the original article. Anyone surprised?

>The initial infection doesn't appear to exploit any vulnerabilities in Cisco devices. Rather, attackers seem to be taking advantage of routers that use passwords that are factory default

I'm waiting for a hardware feature that prompts the setup administrator for credentials upon factory reset boot (preferably an SSH key rather than a password) and doesn't function till properly secured.

Cisco routers by default and/or after erasing the config a) don't have a default password, b) won't let you log in via telnet if there is no password set, and c) do not have SSH enabled.

N.B.: I'm referring to BFRs running IOS. I have no idea how the SMB series are configured by default.

Whoever trusts Cisco at this point are living in la-la land where they refuse to acknowledge the reality that Cisco has been helping governments build surveillance capabilities into its routers to spy on its customers.

Whatever negative impact this has on their own business is fully deserved at this point.

The problem is, how do you know who you can trust? I mean, really, you can't, as long as network devices are closed source, proprietary black boxes. Right now I have no particular reason to think Juniper or anybody else ship routers that are less likely to be exploited or back-doored, relative to Cisco.

Yet one more reason to say that rms right was right all along.

Plenty of sites can replace a black box router with a plain linux or bsd box with a couple of good network cards and some iptables/ipfw rules. That solves a number of issues right there.

Of course, if you were really paranoid, you'd worry that somebody intercepted your Linux box's motherboard as it was being shipped to you so they could install a backdoor in the BIOS or EFI...

That’s why you’d use neither of those.

If you felt that way, you could configure a read-only filesystem once it is setup. Not a terribly complex solution.

How would that protect against an EFI or BIOS backdoor?

Do you have a citation detailing their helping the government?

A confusing thing is that Cisco builds features that enable wiretapping, for example

http://www.cisco.com/c/en/us/tech/security-vpn/lawful-interc...

Those features are disclosed to the customers and are meant to be used with their knowledge, if at all. It might be easy to confuse this with other spying features that Cisco could include in routers that are meant to be used without customers' knowledge.

The information that I've seen about U.S. government attacks against Cisco customers would be consistent with the hypothesis that Cisco is unaware of the details of these attacks and doesn't intentionally facilitate them, but maybe there's other information out there.

Additionally, every major router company has lawful intercept features. [1][2][3][4][5]

Just as the allegations that Huawei is collaborating with the Chinese spy agencies are unfounded, there is no evidence that Cisco has collaborated with American spy agencies.

Cisco has been the victim of espionage, however (and the theft has been remedied). [6][7]

[1] http://alcatel-lucent.com/wps/DocumentStreamerServlet?LMSG_C...

[2] http://www.cisco.com/c/en/us/tech/security-vpn/lawful-interc...

[3] http://www.ericsson.com/us/ourportfolio/telecom-operators/la...

[4] http://enterprise.huawei.com/ilink/enenterprise/download/HW_...

[5] http://www.juniper.net/documentation/en_US/junos12.2/topics/...

[6] http://archive.arstechnica.com/news/posts/1084683212.html

[7] http://blogs.cisco.com/news/huawei-and-ciscos-source-code-co...

"...there is no evidence that Cisco has collaborated with American spy agencies."

According to Snowden's files, Cisco is among those companies that have strategic partnership with NSA http://revolution-news.com/strategic-partnerships-new-snowde...

Plus, this http://electrospaces.blogspot.gr/2015/04/some-equipment-that...

So I read your eclectic sources; the first shows a slide displaying 80 companies in a "strategic partnership." This is never defined in a meaningful fashion. Later a random slide is cherry-picked to support the tenuous argument. Surprising, considering the level-headed image "Revolution News" is known for.

Your second source shows a slide that has a picture of some networking equipment, which the website claims is manufactured by Cisco. Presumably I could "collaborate" with Whole Foods by buying some mangoes, if I use your definition of "collaborate".

Please use factual premises to support your assertions. Some HN commenters actually critically review sources! I'm not claiming that no malicious collaboration exists, just that there's no evidence.

Don't flatter yourself, you didn't "critically" review nothing, what you exhibit here is (ironically) lots of Cherry picking which lead us of course to Confirmation bias.

The focus on the "Revolution-news" site (Btw It's NOT the source of the said slides) and your godawful example about the mangoes speak for itself.

I agree the snark about your first source's name was a bit uncalled for. I can disagree with your position without being rude.

Reply on news.ycombinator.com