DNSS Inc – IT consulting and IT security services for small to mid-size businesses

Managed IT Services, IT Security Services, Vulnerability Management and Remediation, Help Desk Support, IT Maintenance Services, Network Administration, Business Continuity Planning, Disaster Recovery Planning, Onsite and Offsite Data Backup, and Information Security Assessment

Cisco Flaws Put Millions of Workplace Devices at Risk | WIRED

Five vulnerabilities in Cisco Discovery Protocol make it possible for a hacker to take over desk phones, routers, and more.



Workplace phones and routers have a longstoried history of very bad vulnerabilities. Now it’s time again to add to the list: Researchers say that a crop of recently discovered flaws in Cisco enterprise products—like desk phones, web cameras, and network switches—could be exploited to penetrate deep into corporate networks. Because Cisco dominates the network equipment market, the bugs impact millions of devices.

All software has flaws, but embedded device issues are especially concerning given the potential for espionage and the inherent complexity of patching them. These particular vulnerabilities, found by the enterprise security firm Armis, can also break out of the “segmentation” that IT managers use to silo different parts of a network, like a guest Wi-Fi, to cause widespread issues. Attackers could target a vulnerable Cisco network switch—which moves data around an internal network—to intercept large amounts of unencrypted, internal information and move between different parts of a target’s system. Attackers could use related flaws, also disclosed by Armis, to attack batches of Cisco devices at once—like all the desk phones or all the webcams—to shut them down or turn them into eyes and ears inside a target organization.

“Network segmentation is a key way to secure IoT devices,” says Ben Seri, vice president of research at Armis. “But sometimes we can poke holes. And we know that enterprise devices are being targeted in the world. If they have this type of vulnerability, unfortunately, that can be very powerful for a group like an APT.”
The flaws lie in the implementation of a mechanism known as the Cisco Discovery Protocol, which allows Cisco products to broadcast their identities to each other within a private network. CDP is part of a network’s “Layer 2,” which establishes the foundational data link between network devices. All devices use some sort of identity broadcasting mechanism, but CDP is Cisco’s proprietary version.

Separating Cisco products out by having them use CDP has some logistical benefits, but Seri points out that it also creates an easy way for attackers to find Cisco products once they’re inside a network. And since all Cisco products use CDP, one vulnerability can be used to automatically and simultaneously target many devices at once, or to take over crucial devices like network switches and move laterally from there. Any Layer 2 protocol can have bugs; vulnerabilities in CDP simply provide a particularly efficient route to attacking ubiquitous Cisco products.

Armis disclosed its findings to Cisco at the end of August, and today the networking giant is releasing patches for all five vulnerabilities. There are so many because Cisco implements CDP in slightly different ways depending on the product; Armis found related bugs throughout the disclosure process and worked with Cisco to patch them all.

“On February 5, we disclosed vulnerabilities in the Cisco Discovery Protocol implementation of several Cisco products along with software fix information and mitigations, where available,” a Cisco spokesperson said in a statement. “We are not aware of any malicious use of the described vulnerabilities.”

To exploit the bugs, attackers would first need a foothold inside a target’s network, but from there they could fan out quickly, compromising one vulnerable Cisco device after another to bore deeper into a system. And once attackers controlled a switch or router they could start to intercept unencrypted network data, like files and some communications, or access a company’s “active directory,” which manages authentication for users and devices.

“It’s still hop by hop. As a hacker, you still need an initial attack vector into the network,” says Ang Cui, founder of the IoT security firm Red Balloon, who has disclosed numerous Cisco bugs. “But once you’re there, at each hop you have the same vulnerability present—all the switches, firewalls, and routers in a network could be affected by this. So you’re going to have to own a lot of devices, but once you own all of them you’ve literally taken over every single piece of the network.”

While the patches Cisco has released are important, Seri notes that most of the vulnerable devices don’t auto-update, and need manual patching to receive protection. That’s especially difficult on enterprise switches and routers, which need to be patched carefully so the process doesn’t cause network downtime. There are also other mitigations companies can consider that involve disabling CDP on devices like switches, but this can eventually create other problems.

Given the ubiquity of Cisco equipment in enterprise networks worldwide, though, the first step is always just getting fixes out there.

Source: Cisco Flaws Put Millions of Workplace Devices at Risk | WIRED

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s


This entry was posted on February 5, 2020 by in Blog and tagged , , .
%d bloggers like this: