Showing posts with label ZMap Scanner. Show all posts
Showing posts with label ZMap Scanner. Show all posts

Friday, 18 September 2015

Cisco: Routers Hacked Via Stolen Passwords




In recent days, much has been written about attacks on Cisco routers with the firmware of the device was replaced so that attackers had permanent access to the corporate network. In total, worldwide, 79 found such hacked routers.

Cisco had already before the attack warning, but now has shown again that the attackers do not use vulnerabilities in the products of the manufacturer's network. To access the routers are used stolen credentials, says Omar Santos Cisco. Another possibility is that the attackers have physical access to the equipment, and thus the control system may be replaced by a modified version.

"As the technology evolves, so does the nature and complexity of attacks," Santos notes. According to him, this is an example of the "evolution of attacks" in which attackers try to steal login details and then unnoticed to carry out an attack so they keep longer time access to the area surrounding the target. Cisco made ​​the following video explaining how this particular attack is to detect and prevent.

Thursday, 17 September 2015

Researchers Found 79 Cisco Routers With Custom Firmware


Worldwide, there appear to have been hacked 79 Cisco routers whose firmware is modified so that the attackers can still access the network. Which allow researchers from the University of Michigan, UC Berkeley and the International Computer Science Institute know.

This week security firm FireEye announced that it had discovered 14 routers where attackers replaced the firmware. How the attackers access to the routers were able to get is unknown, but according to FireEye is probably not using a zero day attack. Earlier also warned Cisco for these attacks and suggested that the attackers with valid credentials to gain access to the routers know.

Once the custom firmware is active can be accessed using special TCP SYN packets. The researchers used ZMap scanner to go through all the public IPv4 addresses on the Internet and to send these packets. A total of 79 routers discovered that responded to the packets, such as would be the case with the custom firmware. 25 of the routers are in the United States. Lebanon (12) and Russia (8) follow at a distance. The researchers are now working to notify all affected organizations.