Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Cisco Router Vulnerability Gives Window into Researchers' World

The research around a recent vulnerability shows how researchers follow leads and find unexpected results.

In late January, researchers found a vulnerability in Cisco RV320 and RV325 routers — routers aimed at the needs of small businesses and remote offices. Cisco quickly released a software patch to close the vulnerability, but some of the research around the vulnerability offers a view into the world of researchers as they follow leads and look for issues in hardware and software.

The vulnerability itself was given designation CVE-2019-1653. According to the description of the vulnerability, it "…could allow an unauthenticated, remote attacker to retrieve sensitive information." In Cisco's announcement of the vulnerability and patch, it writes that a flaw in the browser-based management interface could allow an attacker to request a specific URL, which would return configuration details.

Jon Hart, senior security researcher at Rapid7, is more specific about those details. "There is a particular URL that you navigate to that happens to include the entire configuration for the device — you know, the username, password, configuration information, and just all sorts of critical information without requiring authentication," he says. To make matters worse, the interface that harbored the vulnerability was enabled by default, with public Internet access possible.

In a blog post on his research, Rapid7 chief data scientist Bob Rudis noted that he had seen news of the vulnerability's discovery through responsible disclosure on the Full Disclosure mailing list at seclists.org. Virtually all researchers deploy their own active and passive scanning tools on the Internet, and Rapid7 is no exception.

The company calls its active tool Project Sonar and the passive tool Project Heisenberg. Hart, who manages Project Sonar, says, "Project Sonar, as you know, is our Internet scanning project, so it's actively looking for interesting things and collecting data about endpoints and things on the public Internet. Heisenberg, on the other hand, is a passive tool that listens on the public Internet. And really, it's a series a series of global, publicly deployed, honeypots."

One of the things that Rudis found was a discrepancy between the number of affected devices he found and the number that had been reported by researcher Troy Mursch on the Bad Packets Report. Where Mursch found "over 9,000" devices vulnerabe, out of more than 15,000 hosts exposed to the Internet, Rudis found nearly 20,000 exposed devices. Hart says that the difference, while small in a global sense, is likely due to differences in the interfaces each researcher was scanning and searching for.

As Hart (who was working on the research with Rudis) looked at the data, he found another piece of interface-associated interest: There were duplicate MAC addresses in the vulnerable population of devices. Hart says that he was able to look at the MAC because of information returned by the routers' SSL certificates. "These SSL certificates, in addition to identifying the model, also provide the MAC address," he explains.

A MAC address is supposed to be unique to a particular physical interface — there really shouldn't be two the same anywhere in the world. In the case of the vulnerable routers, though, Hart says that one MAC address appeared more than 1,200 times. The duplicate MAC appears to be related to a company, NetKlass Technology, that was a supplier to Cisco a number of years ago. The duplicate MACs could be the result of supply chain or development issues and don't, by themselves, represent a security issue.

Duplicate MACs can, though, create performance and configuration issues if multiple devices with the same MAC are deployed on a single network. And the vulnerability that researchers were following can create a number of issues, especially, in Hart's words, if the routers are deployed by their intended audience — small businesses unlikely to have a dedicated security staff.

Hart says he would rate this vulnerability somewhere around a 5 or 6 on a 10-point severity scale. "If an attacker gets access to this configuration, he has the username and password and basically keys to the kingdom on this router," Hart says, "…and at that point he can do whatever he wants to that particular router." And because the router is responsible for routing the traffic of everything on the other side of it, Hart says, an attacker could then reconfigure DNS and firewall rules, and quickly own the network.

[Author's note: This article has been revised from the original. At original posting, Troy Mursch's name was misspelled. The article has also been edited to clarify the differences between the findings of Mursch and Rudis.]

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MarkSindone
50%
50%
MarkSindone,
User Rank: Moderator
2/19/2019 | 12:01:39 AM
The more the merrier
I actually find it quite amazing how easy it is for software engineers to release a patch that magically solves all the problems of their hardware around the world. I reckon that it takes actual operations and real-life testing to actually detect these issues. Testing before release is definitely not exhaustive if the company wants to push all of their stock out off storage and start raking in the profits from the sale of their items.
DavidHamilton
50%
50%
DavidHamilton,
User Rank: Apprentice
2/18/2019 | 11:10:03 PM
Take advantage of situation
Have you heard of the saying "Every cloud has a silver lining"? This situation somehow explains this term in a vague manner. Though the unfortunate event of Cisco router compromise happened, it also created an opportunity for security experts to improve their security processes. If it hadn't happened, perhaps the level of their expertise might have not progressed a step forward.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20898
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.
CVE-2019-20899
PUBLISHED: 2020-07-13
The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.
CVE-2019-20900
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.
CVE-2019-20897
PUBLISHED: 2020-07-13
The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...