Analysis Security issues involving Cisco kit highlighted in Michael Lynnâ€™s presentation at Black Hat are characteristic of networking vendors in general. Cisco is just the most visible of these vendors to target as hackers raise their sights from attacking operating systems towards attacking network infrastructure and database systems, security researchers warn.
According to vulnerability management firm nCircle, virtually all the network vendors tend to run monolithic, closed OSs that are mission-critical for their customers and doesn’t lend itself well to the simplistic desktop patching models currently in place. nCircle reckons as Microsoft’s security gradually improves hackers will look to others mechanisms of attack – a trend that puts networking equipment in the firing line.
Like what you might ask, right?
Routers and printers are mentioned in the article. There has also been some discussion around the web about the potential for exploiting memory in video cards, USB devices (such as keyboards and mice with memory onboard), hard drive cache, and using a computer’s own BIOS against it.
And of course there have been things like viruses utilizing bluetooth to infect and spread on cellphones. And what of other embedded devices getting exploited, such as smartcards? Here’s a quote from that article in 2004:
Panelists at the DATE 2004 conference here also warned that attackers use a variety of technologies to compromise the security of smart cards. They range from invasive and non-invasive attacks in hardware to software attacks such as buffer overflow and Trojan Horses that deliberately inject codes that can be hidden in a harmless and attractive program such as a game.
Another excerpt from the Register’s article:
Timothy Keanini, CTO at nCircle, said that “as Microsoft raises the bar with countermeasures the threat goes elsewhere”. Keanini, who attended Lynnâ€™s presentation, said that it built on other research by German hacker FX, into security vulnerabilities with embedded systems such as routers and even printers. Compromised printers could be used to scan for vulnerabilities elsewhere in a network while rooted routers pose an even greater risk.
Most computer techs have seen computers with exploits that dump a bunch of junk to the printer spewing page after page of garbage … wasting a ton of paper (and these are also network aware to make spreading of itself just so much easier).
One in particular was Bugbear-B – a bloody nuisance to Windows users. Other malware/virii have done similar things on Windows computers. But they generally don’t stop there, they also steal passwords, and other information from the computer user.
And it just gets worse when you research information on router exploits.
So it begs the question … What are device developers doing to mitigate these possibilities?