Cisco Unveils Previous Malware Attacks On Routers

It was recently announced that networking giant Cisco routers had become the target of malware, but in the past have more of these incidents took place. In total there are six malware attacks that have been discovered over the past four years and examined, let Cisco know themselves.

The most recent incident concerns the SYNFUL Knock-malware, with attackers install a custom operating system on routers. Through the malware continue to keep the attackers access to the corporate network, even resetting the router. To install malicious operating system make the attackers use physical access or stolen credentials.

The first two incidents where malware was used date from 2011 and 2012. These were probably created malware specifically targeted against a particular target. Also in this case, the routers of the control system was modified, with the aim of weakening of the encryption. The traffic seemed therefore still encrypted, but the attackers could then decrypt the traffic with less effort.

IPv4 packets

Two other incidents were identified in 2013. Again knew the attacker with stolen credentials of the administrator to access the router was added code. This code ensured that certain IPv4 packets were sent to the attacker. In addition, the attacker using the additional code reach an IPv4 address that was normally not accessible from the Internet.

End 2014 the fifth incident was noticed. Again, the attack began with stolen credentials. Compared to previous ones, the attackers used this time advanced malware that was able to survive a reboot of the router. This malware also aimed to intercept certain packages and provide the attacker access from the public Internet.

Cisco says it has taken since the discovery of the first malware various measures to better protect the equipment. The attacks, however, continue to evolve. Therefore, the networking giant says that it will add to the medium detection and recovery capabilities to the equipment.

Cisco Launches Scanner For Finding Hacked Routers

Cisco has a scanner launched enabling organizations hacked routers can be found on their network where the firmware is updated. Attackers appear to hack through stolen passwords or physical access Cisco routers and install a custom operating system.

This custom operating system is called the SYNFUL Knock-malware. Through the malware continue to keep the attackers access to the corporate network, even resetting the router. Cisco recently conducted a scan on the internet and discovered 199 IP addresses that were infected with the SYNFUL Knock-malware. Now, Cisco has developed a tool that allows customers hacked routers can find on their own network. It is in this case only routers that are infected with the SYNFUL Knock-malware.

The tool does come with a manual. The rotation of the tool via network address translation (NAT) can affect the accuracy of the tool and make sure the tool hacked routers can not detect. Cisco advises to carry out the tool from a network location where there is no NAT between the scanning system and the routers.

Cisco Scans The Internet On Hacked Routers

Cisco has teamed up with the Shadow Server Foundation the past few days the Internet scans on hacked Cisco routers, which eventually yielded 199 suspicious IP addresses. Recently warned both Cisco and security for the SYNFUL Knock-malware.

Attackers appear to hack through stolen passwords or physical access Cisco routers and install a customized version of the operating system; the SYNFUL Knock-malware. Through the malware continue to keep the attackers access to the corporate network, even resetting the router. By scanning the Internet Cisco affected customers can now warn. The scan yielded 199 IP addresses that behavior that matches the SYNFUL Knock-malware.

The number of IP addresses varies, as found in a scan yesterday there 163 IP addresses. Perhaps the 'disappeared' 36 routers were cleaned or online. Most of the infected routers are located in the United States. It involves a total of 65 IP addresses. Remote tracking India (12), Russia (11) and Poland (9). Organizations are advised to identify hacked routers and the infection as quickly as possible to remove. Cisco recently published explanation how the infected routers can be found and cleaned up.

Cisco: Routers Hacked Via Stolen Passwords

In recent days, much has been written about attacks on Cisco routers with the firmware of the device was replaced so that attackers had permanent access to the corporate network. In total, worldwide, 79 found such hacked routers.

Cisco had already before the attack warning, but now has shown again that the attackers do not use vulnerabilities in the products of the manufacturer's network. To access the routers are used stolen credentials, says Omar Santos Cisco. Another possibility is that the attackers have physical access to the equipment, and thus the control system may be replaced by a modified version.

"As the technology evolves, so does the nature and complexity of attacks," Santos notes. According to him, this is an example of the "evolution of attacks" in which attackers try to steal login details and then unnoticed to carry out an attack so they keep longer time access to the area surrounding the target. Cisco made ​​the following video explaining how this particular attack is to detect and prevent.

Researchers Found 79 Cisco Routers With Custom Firmware

Worldwide, there appear to have been hacked 79 Cisco routers whose firmware is modified so that the attackers can still access the network. Which allow researchers from the University of Michigan, UC Berkeley and the International Computer Science Institute know.

This week security firm FireEye announced that it had discovered 14 routers where attackers replaced the firmware. How the attackers access to the routers were able to get is unknown, but according to FireEye is probably not using a zero day attack. Earlier also warned Cisco for these attacks and suggested that the attackers with valid credentials to gain access to the routers know.

Once the custom firmware is active can be accessed using special TCP SYN packets. The researchers used ZMap scanner to go through all the public IPv4 addresses on the Internet and to send these packets. A total of 79 routers discovered that responded to the packets, such as would be the case with the custom firmware. 25 of the routers are in the United States. Lebanon (12) and Russia (8) follow at a distance. The researchers are now working to notify all affected organizations.