“Network segmentation is a key way to secure IoT devices,” says Ben Seri, vice president of research at Armis. “But sometimes we can poke holes. And we know that enterprise devices are being targeted in the world. If they have this type of vulnerability, unfortunately that can be very powerful for a group like an APT.”The flaws lie in the implementation of a mechanism known as the Cisco Discovery Protocol, which allows Cisco products to broadcast their identities to each other within a private network. CDP is part of a network's "Layer 2," which establishes the foundational data link between network devices. All devices use some sort of identity broadcasting mechanism, but CDP is Cisco’s proprietary version.
Separating Cisco products out by having them use CDP has some logistical benefits, but Seri points out that it also creates an easy way for attackers to find Cisco products once they're inside a network. And since all Cisco products use CDP, one vulnerability can be used to automatically and simultaneously target many devices at once, or to take over crucial devices like network switches and move laterally from there. Any Layer 2 protocol can have bugs; vulnerabilities in CDP simply provide a particularly efficient route to attacking ubiquitous Cisco products.
Armis disclosed its findings to Cisco at the end of August, and today the networking giant is releasing patches for all five vulnerabilities. There are so many because Cisco implements CDP in slightly different ways depending on the product; Armis found related bugs throughout the disclosure process and worked with Cisco to patch them all.
"On February 5, we disclosed vulnerabilities in the Cisco Discovery Protocol implementation of several Cisco products along with software fix information and mitigations, where available," a Cisco spokesperson said in a statement. "We are not aware of any malicious use of the described vulnerabilities."
To exploit the bugs, attackers would first need a foothold inside a target's network, but from there they could fan out quickly, compromising one vulnerable Cisco device after another to bore deeper into a system. And once attackers controlled a switch or router they could start to intercept unencrypted network data, like files and some communications, or access a company's "active directory," which manages authentication for users and devices.
“It’s still hop by hop. As a hacker, you still need an initial attack vector into the network,” says Ang Cui, founder of the IoT security firm Red Balloon, who has disclosed numerous Cisco bugs. “But once you’re there, at each hop you have the same vulnerability present—all the switches, firewalls, and routers in a network could be affected by this. So you’re going to have to own a lot of devices, but once you own all of them you’ve literally taken over every single piece of the network.”READ ALSO:
What Is Credential Dumping?
