Security
Attackers are exploiting a 'protocol misuse' issue in Cisco's Smart Install Client to gain entry to critical infrastructure providers, according to researchers at Cisco's Talos Intelligence group.
The researchers say the attackers are linked to nation-state hackers and point to US CERT's recent alert detailing suspected Russian government attacks on US agencies and organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors. Symantec refers to that hacking group as Dragonfly.
Cisco's warning over the Smart Install client, a tool for rapidly deploying new switches, comes a week after it released a patch for a critical remote code execution flaw affecting the software.
Researchers at security firm Embedi found that millions of Cisco network devices have been left vulnerable by an open TCP 4786 port.
Cisco has also seen a huge uptick in traffic to the TCP 4786 port which began around November 2017 and then spiked in April 2018.
However, the main thrust of the new alert concerns an advisory Cisco issued in February 2017 after discovering a surge in internet scans for Smart Install instances that had been set up without proper security controls.
Download now: Password management policy
Attackers could send Smart Install protocol messages to Smart Install clients to allow them to change the startup-config file, trigger a reload, and then load a new image of Cisco's IOS networking software on to the device.
The attacker could then provide command-line instructions on switches running IOS and IOS XE. Cisco at the time said it was not a vulnerability because the Smart Install protocol intentionally doesn't require authentication.
"The Cisco Smart Install protocol can be abused to modify the TFTP server setting, exfiltrate configuration files via TFTP, modify the configuration file, replace the IOS image, and set up accounts, allowing for the execution of IOS commands," Talos researcher Nick Biasini wrote on Thursday.
"Although this is not a vulnerability in the classic sense, the misuse of this protocol is an attack vector that should be mitigated immediately. Throughout the end of 2017 and early 2018, Talos has observed attackers trying to scan clients using this vulnerability. Recent information has increased the urgency of this issue."
Talos researchers using Shodan discovered 168,000 systems are potentially exposed due to improperly secured Smart Install clients.
Biasini also urged Cisco customers to apply last week's Smart Install security update. However, it has not seen this attack vector being exploited.
"While we have only observed attacks leveraging the protocol misuse issue, recently another vulnerability in the Cisco Smart Install Client was disclosed and patched.
"This vulnerability has been discussed publicly, and proof-of-concept code has been released. While mitigating the protocol misuse issue, customers should also address this vulnerability."
Talos researchers have provided instructions for mitigating the threat.
State-backed attackers have been zeroing in on Cisco's Smart Install client.
Previous and related coverage
Cisco critical flaw: At least 8.5 million switches open to attack, so patch now
Cisco patches a severe flaw in switch deployment software that can be attacked with crafted messages sent to a port that's open by default.
Cisco: Update now to fix critical hardcoded password bug, remote code execution flaw
Cisco patches two serious authentication bugs and a Java deserialization flaw.
Cisco: Severe bug in our security appliances is now under attack
A proof-of-concept exploit for Cisco's 10-out-of-10 severity bug surfaces days after researcher details his attack.
Cisco: You need to patch our security devices again for dangerous ASA VPN bug
Cisco has warned that its original fix for the 10/10-severity ASA VPN flaw was
Cisco 'waited 80 days' before revealing it had been patching its critical VPN flaw
Updated: Cisco should do more to help companies secure their network gear, says one customer.
Cisco switch flaw led to attacks on critical infrastructure in several countries(TechRepublic)
The attack targets the Cisco Smart Install Client, and as many as 168,000 systems could be vulnerable.