Cisco Flaws Put Millions of Workplace Devices at Risk

Workplace phones and routers have a long, storied history of very bad vulnerabilities. Now it’s time again to add to the list: Researchers say that a crop of recently discovered flaws in Cisco enterprise products—like desk phones, web cameras, and network switches—could be exploited to penetrate deep into corporate networks. Because Cisco dominates the network equipment market, the bugs impact millions of devices.

All software has flaws, but embedded device issues are especially concerning given the potential for espionage and the inherent complexity of patching them. These particular vulnerabilities, found by the enterprise security firm Armis, can also break out of the “segmentation” that IT managers use to silo different parts of a network, like a guest Wi-Fi, to cause widespread issues. Attackers could target a vulnerable Cisco network switch—which moves data around an internal network—to intercept large amounts of unencrypted, internal information and move between different parts of a target’s system. Attackers could use related flaws, also disclosed by Armis, to attack batches of Cisco devices at once—like all the desk phones or all the webcams—to shut them down or turn them into eyes and ears inside a target organization.

“Network segmentation is a key way to secure IoT devices,” says Ben Seri, vice president of research at Armis. “But sometimes we can poke holes. And we know that enterprise devices are being targeted in the world. If they have this type of vulnerability, unfortunately that can be very powerful for a group like an APT.”

The flaws lie in the implementation of a mechanism known as the Cisco Discovery Protocol, which allows Cisco products to broadcast their identities to each other within a private network. CDP is part of a network’s “Layer 2,” which establishes the foundational data link between network devices. All devices use some sort of identity broadcasting mechanism, but CDP is Cisco’s proprietary version.

site link
helpful hints
pop over to this web-site
go to my site
see this page
browse around this website
view website
my sources
webpage
Discover More Here
Learn More Here
company website
click for info
Read Full Article
his response
click over here
take a look at the site here
more tips here
helpful resources
check out this site
look at this website
have a peek at this site
the original source
Continue
visit our website
visit this website
go to this website
pop over here
Home Page
Recommended Reading
these details
advice
try these out
check my reference
her comment is here
useful link
Resources
hop over to here
click this link here now
blog link
Continue eading
Click Here
Clicking Here
Go Here
Going Here
Read This
Read More
Find Out More
Discover More
Learn More
Read More Here
Discover More Here
Learn More Here
Click This Link
Visit This Link
Homepage
Home Page
Visit Website
Website
Web Site
Get More Info
Get More Information
This Site
More Info
Check This Out
Look At This
Full Article
Full Report
Read Full Article
Read Full Report
a cool way to improve
a fantastic read
a knockout post
a replacement
a total noob
about his
active
additional hints
additional info
additional reading

Separating Cisco products out by having them use CDP has some logistical benefits, but Seri points out that it also creates an easy way for attackers to find Cisco products once they’re inside a network. And since all Cisco products use CDP, one vulnerability can be used to automatically and simultaneously target many devices at once, or to take over crucial devices like network switches and move laterally from there. Any Layer 2 protocol can have bugs; vulnerabilities in CDP simply provide a particularly efficient route to attacking ubiquitous Cisco products.

Armis disclosed its findings to Cisco at the end of August, and today the networking giant is releasing patches for all five vulnerabilities. There are so many because Cisco implements CDP in slightly different ways depending on the product; Armis found related bugs throughout the disclosure process and worked with Cisco to patch them all.

“On February 5, we disclosed vulnerabilities in the Cisco Discovery Protocol implementation of several Cisco products along with software fix information and mitigations, where available,” a Cisco spokesperson said in a statement. “We are not aware of any malicious use of the described vulnerabilities.”

To exploit the bugs, attackers would first need a foothold inside a target’s network, but from there they could fan out quickly, compromising one vulnerable Cisco device after another to bore deeper into a system. And once attackers controlled a switch or router they could start to intercept unencrypted network data, like files and some communications, or access a company’s “active directory,” which manages authentication for users and devices.

“It’s still hop by hop. As a hacker, you still need an initial attack vector into the network,” says Ang Cui, founder of the IoT security firm Red Balloon, who has disclosed numerous Cisco bugs. “But once you’re there, at each hop you have the same vulnerability present—all the switches, firewalls, and routers in a network could be affected by this. So you’re going to have to own a lot of devices, but once you own all of them you’ve literally taken over every single piece of the network.”

Leave a Reply

Your email address will not be published. Required fields are marked *