Cisco Routers Again Take Hacker Spotlight

The Cisco hacking scene has been pretty quiet for the past three years, but at this week's Black Hat hacker conference in Las Vegas, there's going to be a little noise.
Security researchers will give talks on rootkits and new hacking and intrusion-detection software for the routers that carry most of the Internet's traffic.
Three years ago, security researcher Michael Lynn shined a spotlight on Cisco's products when he talked about how he ran a simple "shellcode" program on a router without authorization. Lynn's controversial talk was the biggest story at Black Hat 2005. He had to quit his day job to get around a company prohibition on discussing Cisco, and both he and the conference organizers were quickly sued by Cisco. The networking company argued that Lynn's presentation slides contained information that violated the company's intellectual property rights, and Lynn's talk was literally ripped out of the conference materials package. In a settlement agreement, the researcher was barred from further discussing his work, but copies of his presentation (pdf) were posted online.
Today, Cisco Chief Security Officer John Stewart is remarkably candid about the experience, saying that his company acted for the right reasons -- protecting its customers and intellectual property -- but went too far. "We did some sort of silly things," he said. "Which is why I personally sponsored Black Hat at the platinum level ever since. Because I think we had some atonement to do."
Lynn wasn't without a job for long. He was quickly snatched up by Cisco competitor Juniper Networks, but for a few years after his talk, there wasn't much public discussion of Cisco hacking, according to Jeff Moss, Black Hat's director.
Moss believes that economics may have driven some Cisco researchers underground. Any code that exploits Cisco vulnerabilities is so prized that any hacker who chooses to disclose his findings, rather than sell them to a security company or government agency, is often giving up a lot of money, Moss said. Mike Lynn's vulnerability was worth about US$250,000, he reckons.
But this year things have opened up. Black Hat organizers plan three talks on Cisco routers and the Internetwork Operating System that they run. "All of a sudden this year a lot of stuff has been breaking loose," Moss said.
Lately, with Microsoft Windows no longer the fertile ground for bug hunting that it once was, researchers are looking at other products to hack. And Cisco's routers are an interesting target. They command more than 60 percent of the router market, according to research firm IDC.
"If you own the network, you own the company," said Nicolas Fischbach, senior manager of network engineering and security with COLT Telecom, a European data service provider. "Owning the Windows PC is not really a priority anymore."
But Cisco's routers make a harder target than Windows. They're not as well-known to hackers and they come in many configurations, so an attack on one router might fail on a second. Another difference is that Cisco administrators are not constantly downloading and running software.
Finally, Cisco has done a lot of work in recent years to cut down on the number of attacks that can be launched against its routers from the Internet, according to Fischbach. "All the basic, really easy exploits you could use against network services are really gone," he said. The risk of having a well-configured router hacked by someone from outside of your corporate network is "really low."
That hasn't deterred the latest crop of security researchers.
Two months ago Core Security researcher Sebastian Muniz showed new ways of building hard-to-detect rootkit programs for Cisco routers, and this week his colleague, Ariel Futoransky, will give a Black Hat update on the company's research in this area.
Also, two researchers from Information Risk Management (IRM), a security consultancy based in London, plan to release a modified version of the GNU Debugger, which gives hackers a view of what happens when Cisco IOS software processes their code, and three shellcode programs that can be used to control a Cisco router.
IRM researchers Gyan Chawdhary and Varun Uppal have taken a second look at Lynn's work. In particular, they took a close look at the way Lynn was able to circumvent an IOS security feature called Check Heap, which scans the router's memory for the type of modifications that would allow a hacker to run unauthorized code on the system.
They discovered that while Cisco had blocked the technique that Lynn used to trick Check Heap, there were still other ways to sneak their code onto the system. After Lynn's disclosure, Cisco "simply patched the vector," said Chawdhary. "In a sense the bug still remains."
By modifying one part of the router's memory, they were able to bypass Check Heap and run their shellcode onto the system, he said.
The researcher Lynn credited with making his own research possible, Felix "FX" Lindner, will also be talking about Cisco hacking at Black Hat. Lindner, head of Recurity Labs, plans to release his new Cisco forensics tool, called CIR (Cisco Incident Response), which he has beta tested for the past several months. There will be a free version, which will check a router's memory for rootkits, while a commercial version of the software will be able to detect attacks and perform forensic analysis of the devices.
This software will give networking professionals like Fischbach a way to go back and look at the memory of a Cisco device and see if it has been tampered with. "I think there's a use for it," he said. "To me, it's part of the toolkit when you do forensics, but it's not the only tool you should rely on."
There are still major barriers for any Cisco attacker, Stewart says. For example, many attackers are reluctant to hack routers, because if they make a mistake, they knock out the entire network. "We sort of get a pass because no one wants to monkey with the infrastructure that they're using," he said. "It's like screwing up the freeway while you're trying to go to a different city. "
Though Cisco may not have any major security worries right now, Stewart is taking nothing for granted.
In fact, he also admitted that his company has been lucky so far and he knows that could change if enough people like Lindner start working on the problem। "We've got time," he said. "We've got the opportunity to be better, and we should continually invest on lowering the attack surface."
Reference : http://www.pcworld.com/article/149448/2008/08/.html?tk=rss_news