Cisco Launches Scanner For Finding Hacked Routers

Cisco has a scanner launched enabling organizations hacked routers can be found on their network where the firmware is updated. Attackers appear to hack through stolen passwords or physical access Cisco routers and install a custom operating system.

This custom operating system is called the SYNFUL Knock-malware. Through the malware continue to keep the attackers access to the corporate network, even resetting the router. Cisco recently conducted a scan on the internet and discovered 199 IP addresses that were infected with the SYNFUL Knock-malware. Now, Cisco has developed a tool that allows customers hacked routers can find on their own network. It is in this case only routers that are infected with the SYNFUL Knock-malware.

The tool does come with a manual. The rotation of the tool via network address translation (NAT) can affect the accuracy of the tool and make sure the tool hacked routers can not detect. Cisco advises to carry out the tool from a network location where there is no NAT between the scanning system and the routers.

Cisco Scans The Internet On Hacked Routers

Cisco has teamed up with the Shadow Server Foundation the past few days the Internet scans on hacked Cisco routers, which eventually yielded 199 suspicious IP addresses. Recently warned both Cisco and security for the SYNFUL Knock-malware.

Attackers appear to hack through stolen passwords or physical access Cisco routers and install a customized version of the operating system; the SYNFUL Knock-malware. Through the malware continue to keep the attackers access to the corporate network, even resetting the router. By scanning the Internet Cisco affected customers can now warn. The scan yielded 199 IP addresses that behavior that matches the SYNFUL Knock-malware.

The number of IP addresses varies, as found in a scan yesterday there 163 IP addresses. Perhaps the 'disappeared' 36 routers were cleaned or online. Most of the infected routers are located in the United States. It involves a total of 65 IP addresses. Remote tracking India (12), Russia (11) and Poland (9). Organizations are advised to identify hacked routers and the infection as quickly as possible to remove. Cisco recently published explanation how the infected routers can be found and cleaned up.

Cisco: Routers Hacked Via Stolen Passwords

In recent days, much has been written about attacks on Cisco routers with the firmware of the device was replaced so that attackers had permanent access to the corporate network. In total, worldwide, 79 found such hacked routers.

Cisco had already before the attack warning, but now has shown again that the attackers do not use vulnerabilities in the products of the manufacturer's network. To access the routers are used stolen credentials, says Omar Santos Cisco. Another possibility is that the attackers have physical access to the equipment, and thus the control system may be replaced by a modified version.

"As the technology evolves, so does the nature and complexity of attacks," Santos notes. According to him, this is an example of the "evolution of attacks" in which attackers try to steal login details and then unnoticed to carry out an attack so they keep longer time access to the area surrounding the target. Cisco made ​​the following video explaining how this particular attack is to detect and prevent.