News for hackers. Stuff that matters.

A comment on Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability. Parent comment

Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by tptacek on Wednesday August 17, 2016 @04:37PM (#12308260)
Not only is it all internal, but in modern networks SNMP is usually run on specific dedicated backchannel networks, precisely because anyone who has done network security since 1994 knows that SNMP is terribly insecure.

It may be a little less rigorous because ASAs are often prem boxes in enterprise environments, not like tier 1 backbone components. But it might be a little more rigorous because ASAs are firewalls.

[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by jlgaddis on Wednesday August 17, 2016 @06:33PM (#12308992)
I'd say that not only is it all NOT internal, it is often not run on "specific dedicated backchannel networks". Ask anyone who was a victim of a DDoS that made use of SNMP amplification.

I would agree that it should be internal and should be run on internal-only interfaces/networks but the reality is that that very often isn't the case.

The average ASA is better off than most other devices simply because one must explicitly configure and enable SNMP on it. Too many other devices ship with it enabled, accessible from 0/0, with the default community strings set to "public" and "private". I believe the last abuse@ e-mail I received notifying me of a customer with a device exactly like that was on Saturday.

[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by monkmartinez on Wednesday August 17, 2016 @04:43PM (#12308307)
Just a quick google for: Remote grafana SNMP, Remote LibreNMS SNMP, Remote Observium SNMP, etc. leads to all kinds of good stuff.
[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by tptacek on Wednesday August 17, 2016 @04:55PM (#12308394)
I mean, you can literally just ask a site like Shodan to give you a list of publicly available SNMP interfaces. Do you see a lot of what look like ASAs on that list?
[ Parent | on HN ]