Spook BackDoors In Cisco Routers

- Older news, but still relevant!!

  Please save this story and repost it everywhere

  Especially in Security Discussion Forum Sites

- You should use OpenBSD or a hardened Linux distro

  For a router, NOT these blackboxes offered with

  proprietary hardware & firmware!

 

http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html

 

"Special Report

Cisco's Backdoor For Hackers

Andy Greenberg, 02.03.10, 01:45 PM EST

The methods networking companies use to let the Feds watch suspects also expose the rest of us.

 

ARLINGTON, Va. -- Activists have long grumbled about the privacy implications of the legal "backdoors" that networking companies like Cisco build into their equipment--functions that let law enforcement quietly track the Internet activities of criminal suspects. Now an IBM researcher has revealed a more serious problem with those backdoors: They don't have particularly strong locks, and consumers are at risk.

 

In a presentation at the Black Hat security conference Wednesday, IBM ( IBM - news - people ) Internet Security Systems researcher Tom Cross unveiled research on how easily the "lawful intercept" function in Cisco's ( CSCO - news - people ) IOS operating system can be exploited by cybercriminals or cyberspies to pull data out of the routers belonging to an Internet service provider (ISP) and watch innocent victims' online behavior.

 

But the result, Cross says, is that any credentialed employee can implement the intercept to watch users, and the ISP has no method of tracking those privacy violations. "An insider who knows the password can use it without an audit trail and send the data to anywhere on the Internet," Cross says.

 

Cross told Cisco about his findings in December 2008, but with the exception of the patch Cisco released following the revelation of its router bug in 2008, the security flaws he discussed haven't been fixed. In an interview following Cross' talk, Cisco spokeswoman Jennifer Greeson said that the company is "confident in its framework." "We recognize that security is complicated," she said. "We're looking at [Cross'] findings and we'll take them into account."

 

Cisco isn't actually the primary target of Cross' critique. He points out that all networking companies are legally required to build lawful intercepts into their equipment.

 

Special Report

Cisco's Backdoor For Hackers

Andy Greenberg, 02.03.10, 01:45 PM EST

The methods networking companies use to let the Feds watch suspects also expose the rest of us.

 

ARLINGTON, Va. -- Cisco, in fact, is the only networking company that follows the recommendations of the Internet Engineering Task Force standards body and makes its lawful intercept architecture public, exposing it to peer review and security scrutiny. The other companies keep theirs in the dark, and they likely suffer from the same security flaws or worse. "Cisco did the right thing by publishing this," says Cross. "Although I found some weaknesses, at least we know what they are and how to mitigate them."

 

The exploitation of lawful intercept is more than theoretical. Security and privacy guru Bruce Schneier wrote last month that the Google ( GOOG - news - people ) hackings in China were enabled by Google's procedures for sharing information with U.S. law enforcement officials. And in 2004 and 2005, a group of hackers used intercept vulnerabilities in Ericsson ( ERIC - news - people ) network switches to spy on a wide range of political targets including the cellphone of Greece's prime minister.

 

All of that, argues IBM's Cross, means that Internet-related companies need to be more transparent about their lawful intercept procedures or risk exposing all of their users. "There are a lot of other technology companies out there that haven't published their architecture, so they can't be audited," he said in his Black Hat talk. "We can't be sure of their security as a result."

 

- http://search.forbes.com/search/colArchiveSearch?author=andy+and+greenberg&aname=Andy+Greenberg

 

(C) forbes.com

 

Lest we forget Part 1:

 

https://www.networkworld.com/community/node/57070

 

"Cisco backdoor still open

IBM researcher at Black Hat says opening for Feds exposes us

By Jim Duffy on Wed, 02/03/10 - 5:33pm.

 

The "backdoors" that Cisco and other networking companies implement in their routers and switches for lawful intercept are front and center again at this week's Black Hat security conference. A few years ago, they were cause celebre in some VoIP wiretapping arguments and court rulings.

 

This time, an IBM researcher told Black Hat conference attendees that these openings can still expose information about us to hackers and allow them to "watch" our Internet activity. Backdoors are implemented in routers and switches so law enforcement officials can track the Internet communications and activity of an individual or individuals under surveillance. They are required by law to be incorporated in devices manufactured by networking companies and sold to ISPs.

 

In this report from Forbes, IBM Internet Security Systems researcher Tom Cross demonstrated how easily the backdoor in Cisco IOS can be exploited by hackers. When they gain access to a Cisco router, they are not blocked after multiple failed access attempts nor is an alert sent to an administrator. Any data collected through the backdoor can be sent to anywhere -- not just merely to an authorized user, Forbes reports.

 

What's more, an ISP is not able to perform an audit trail on whoever tried to gain access to a router through the backdoor - that nuance was intended to keep ISP employees from detecting the intercept and inadvertently tipping off the individual under surveillance. But according to IBM's Cross, any authorized employee can use it for unauthorized surveillance of users and those privacy violations cannot be tracked by the ISP.

 

Cisco said it is aware of Cross's assertions and is taking them under consideration. To Cisco's credit, it is the only networking company that makes its lawful intercept architecture public, according to the recommendations of the IETF, the Forbes story states. Other companies do not, which means they may be susceptible to the same security flaws, or worse."

 

Lest we forget Part 2:

 

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username

 

"Cisco Security Advisory

A Default Username and Password in WLSE and HSE Devices

Advisory ID: cisco-sa-20040407-username

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username

Revision 1.4

For Public Release 2004 April 7 16:00  UTC (GMT)

Contents

 

    Summary

    Affected Products

    Details

    Vulnerability Scoring Details

    Impact

    Software Versions and Fixes

    Workarounds

    Obtaining Fixed Software

    Exploitation and Public Announcements

    Status of This Notice: Final

    Distribution

    Revision History

    Cisco Security Procedures

 

Summary

 

A default username/password pair is present in all releases of the Wireless LAN Solution Engine (WLSE) and Hosting Solution Engine (HSE) software. A user who logs in using this username has complete control of the device. This username cannot be disabled. There is no workaround.

 

This advisory is available at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username.

 

Affected Products

 

This section provides details on affected products.

Vulnerable Products

 

These products are vulnerable:

 

    The affected software releases for WLSE are 2.0, 2.0.2 and 2.5.

    The affected software releases for HSE are 1.7, 1.7.1, 1.7.2 and 1.7.3.

 

Products Confirmed Not Vulnerable

 

No other Cisco products are currently known to be affected by these vulnerabilities.

 

Details

 

A hardcoded username and password pair is present in all software releases for all models of WLSE and HSE devices.

 

This vulnerability is documented in the Cisco Bug Toolkit as Bug ID CSCsa11583 ( registered customers only) for the WLSE and CSCsa11584 ( registered customers only) for the HSE.

 

CiscoWorks WLSE provides centralized management for the Cisco Wireless LAN infrastructure. It unifies the other components in the solution and actively employs them to provide continual "Air/RF" monitoring, network security, and optimization. The CiscoWorks WLSE also assists network managers by automating and simplifying mass configuration deployment, fault monitoring and alerting.

 

Cisco Hosting Solution Engine is a hardware-based solution to monitor and activate a variety of e-business services in Cisco powered data centers. It provides fault and performance information about the Layer 2-3 hosting infrastructure and Layer 4-7 hosted services.

 

Vulnerability Scoring Details

Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.

 

CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

 

Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

 

Cisco has provided an FAQ to answer additional questions regarding CVSS at

http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html .

 

Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at

http://intellishield.cisco.com/security/alertmanager/cvss .

 

Impact

 

Any user who logs in using this username has complete control of the device. One can add new users or modify details of the existing users, and change the device's configuration. Here are some more concrete examples of possible actions:

 

    For WLSE this means that an adversary can hide the presence of a rogue Access Point or change the Radio Frequency plan, potentially causing system-wide outages. The first action may cause long term loss of information confidentiality and integrity. The second action can yield Denial-of-Service (DOS).

    For HSE this may lead up to illegal re-directing of a Web site with the ultimate loss of revenue.

    In both cases the device itself may be used as a launching platform for further attacks. Such attacks could be directed at your organization, or towards a third party.

 

Software Versions and Fixes

 

When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

 

In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

 

For WLSE, users need to install the WLSE-2.x-CSCsa11583-K9.zip patch. The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/wlan-sol-eng ( registered customers only) . Installation instructions are included in the accompanying README file, WLSE-2.x-CSCsa11583-K9.readmeV3.txt, in that same download directory. This patch is applicable to WLSE 1105 and 1130 software releases 2.0, 2.0.2 and 2.5.

 

For HSE, users need to install the HSE-1.7.x-CSCsa11584.zip patch. The patch can be downloaded from http://www.cisco.com/pcgi-bin/tablebuild.pl/1105-host-sol ( registered customers only) . Installation instructions are included in the accompanying README file, HSE-1.7.x-CSCsa11584.readme.txt, in that same download directory. This patch is applicable to HSE 1105 for versions 1.7, 1.7.1, 1.7.2, and 1.7.3.

Workarounds

 

There is no workaround.

 

Obtaining Fixed Software

 

Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

 

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

 

Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.

 

Customers with Service Contracts

 

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.

Customers Using Third-Party Support Organizations

 

Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.

 

The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.

Customers Without Service Contracts

 

Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.

 

    +1 800 553 2447 (toll free from within North America)

    +1 408 526 7209 (toll call from anywhere in the world)

    e-mail: tac@cisco.com

 

Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.

 

Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages.

Exploitation and Public Announcements

 

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

 

Status of This Notice: Final

 

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

 

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

 

Distribution

 

This advisory will be posted on Cisco's worldwide website at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040407-username.

 

In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.

 

    cust-security-announce@cisco.com

    bugtraq@securityfocus.com

    first-teams@first.org (includes CERT/CC)

    cisco@spot.colorado.edu

    comp.dcom.sys.cisco

    firewalls@lists.gnac.com

 

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.

 

Revision History

 

Revision 1.4

       

 

2004-April-12

       

 

Fixed URL for Cisco.com Downloads under Obtaining Fixed Software section.

 

Revision 1.3

       

 

2004-April-08

       

 

Updated Software Versions and Fixes section.

 

Revision 1.2

       

 

2004-April-08

       

 

Updated to include WLSE 1105 in Software Versions and Fixes section.

 

Revision 1.1

       

 

2004-April-07

       

 

Correction in the Obtaining Fixed Software section.

 

Revision 1.0

       

 

2004-April-07

       

 

Initial public release.

 

Cisco Security Procedures

 

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt."

 

 

http://www.forbes.com/2010/02/03/hackers-networking-equipment-technology-security-cisco.html?feed=rss_technology_security