Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Cisco Router Vulnerability Gives Window into Researchers' World

The research around a recent vulnerability shows how researchers follow leads and find unexpected results.

In late January, researchers found a vulnerability in Cisco RV320 and RV325 routers — routers aimed at the needs of small businesses and remote offices. Cisco quickly released a software patch to close the vulnerability, but some of the research around the vulnerability offers a view into the world of researchers as they follow leads and look for issues in hardware and software.

The vulnerability itself was given designation CVE-2019-1653. According to the description of the vulnerability, it "…could allow an unauthenticated, remote attacker to retrieve sensitive information." In Cisco's announcement of the vulnerability and patch, it writes that a flaw in the browser-based management interface could allow an attacker to request a specific URL, which would return configuration details.

Jon Hart, senior security researcher at Rapid7, is more specific about those details. "There is a particular URL that you navigate to that happens to include the entire configuration for the device — you know, the username, password, configuration information, and just all sorts of critical information without requiring authentication," he says. To make matters worse, the interface that harbored the vulnerability was enabled by default, with public Internet access possible.

In a blog post on his research, Rapid7 chief data scientist Bob Rudis noted that he had seen news of the vulnerability's discovery through responsible disclosure on the Full Disclosure mailing list at seclists.org. Virtually all researchers deploy their own active and passive scanning tools on the Internet, and Rapid7 is no exception.

The company calls its active tool Project Sonar and the passive tool Project Heisenberg. Hart, who manages Project Sonar, says, "Project Sonar, as you know, is our Internet scanning project, so it's actively looking for interesting things and collecting data about endpoints and things on the public Internet. Heisenberg, on the other hand, is a passive tool that listens on the public Internet. And really, it's a series a series of global, publicly deployed, honeypots."

One of the things that Rudis found was a discrepancy between the number of affected devices he found and the number that had been reported by researcher Troy Mursch on the Bad Packets Report. Where Mursch found "over 9,000" devices vulnerabe, out of more than 15,000 hosts exposed to the Internet, Rudis found nearly 20,000 exposed devices. Hart says that the difference, while small in a global sense, is likely due to differences in the interfaces each researcher was scanning and searching for.

As Hart (who was working on the research with Rudis) looked at the data, he found another piece of interface-associated interest: There were duplicate MAC addresses in the vulnerable population of devices. Hart says that he was able to look at the MAC because of information returned by the routers' SSL certificates. "These SSL certificates, in addition to identifying the model, also provide the MAC address," he explains.

A MAC address is supposed to be unique to a particular physical interface — there really shouldn't be two the same anywhere in the world. In the case of the vulnerable routers, though, Hart says that one MAC address appeared more than 1,200 times. The duplicate MAC appears to be related to a company, NetKlass Technology, that was a supplier to Cisco a number of years ago. The duplicate MACs could be the result of supply chain or development issues and don't, by themselves, represent a security issue.

Duplicate MACs can, though, create performance and configuration issues if multiple devices with the same MAC are deployed on a single network. And the vulnerability that researchers were following can create a number of issues, especially, in Hart's words, if the routers are deployed by their intended audience — small businesses unlikely to have a dedicated security staff.

Hart says he would rate this vulnerability somewhere around a 5 or 6 on a 10-point severity scale. "If an attacker gets access to this configuration, he has the username and password and basically keys to the kingdom on this router," Hart says, "…and at that point he can do whatever he wants to that particular router." And because the router is responsible for routing the traffic of everything on the other side of it, Hart says, an attacker could then reconfigure DNS and firewall rules, and quickly own the network.

[Author's note: This article has been revised from the original. At original posting, Troy Mursch's name was misspelled. The article has also been edited to clarify the differences between the findings of Mursch and Rudis.]

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MarkSindone
50%
50%
MarkSindone,
User Rank: Moderator
2/19/2019 | 12:01:39 AM
The more the merrier
I actually find it quite amazing how easy it is for software engineers to release a patch that magically solves all the problems of their hardware around the world. I reckon that it takes actual operations and real-life testing to actually detect these issues. Testing before release is definitely not exhaustive if the company wants to push all of their stock out off storage and start raking in the profits from the sale of their items.
DavidHamilton
50%
50%
DavidHamilton,
User Rank: Apprentice
2/18/2019 | 11:10:03 PM
Take advantage of situation
Have you heard of the saying "Every cloud has a silver lining"? This situation somehow explains this term in a vague manner. Though the unfortunate event of Cisco router compromise happened, it also created an opportunity for security experts to improve their security processes. If it hadn't happened, perhaps the level of their expertise might have not progressed a step forward.
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15224
PUBLISHED: 2019-08-19
The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
CVE-2019-15225
PUBLISHED: 2019-08-19
In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.
CVE-2019-15223
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.
CVE-2019-15211
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.
CVE-2019-15212
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.