Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut...
by tptacek on Wednesday August 17, 2016 @05:44PM
(#12308729)
Yeah I guess, but I think that scenario is way less common than you think it is, only because almost nobody reliably segments networks. Once you're internal, you've usually got everything within a few hops.
Whereas persisting onto an ASA sounds like an actually widely useful capability! The ASAs don't get reimaged during incident response.
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut...
by mschuster91 on Wednesday August 17, 2016 @05:49PM
(#12308756)
> Yeah I guess, but I think that scenario is way less common than you think it is, only because almost nobody reliably segments networks. Once you're internal, you've usually got everything within a few hops.
Indeed, yes, but entities large enough to afford dedicated teams to run hundreds of pieces of Cisco gear with proper segmentation etc. usually also tend to be those of most interest to any espionage outfit.
Last I heard, ex-employer switched from huge VLAN switches to dedicated, unconnected switches for each network part after Snowden. Given the leak here, I'd say their fear wasn't totally unjustified.
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut...
by oasisbob on Wednesday August 17, 2016 @06:30PM
(#12308980)
It seems like a massive oversight to implement segmentation like that and yet still allow the fax printer SNMP and telnet/SSH access to the firewall.
In environments I've seen, the network management network is the thing most likely to be isolated first.
No! For example, at one place I was employed at, the switches had different VLANs - one for private internal network, one which had external (direct) internet access, one for VoIP telephones, one for printers, one for servers and one for BYOD external consultants. Basically, compartmentalization - and everything was firewalled, and every cross-VLAN access had to be separately allowed.
So this exploit (or, for that matter any switch/router exploit) can be used not just for persisting, but for escalating privileges. Assume you have hacked a fax printer via the telephone line (hey, given that, I'm tempted to actually grab a modem and do some fuzzing with my fax printer...), you can then use its network connection to punch holes in the firewall and spread.