bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

DoS hole in Cisco IOS endangers internet providers’ routers [Update]

Summary

In 2007 a DoS hole in Cisco’s IOS allowed routers to be forced to restart via the command “show ip bgp regexp” with certain regular expressions. Many providers offered such commands publicly via telnet route servers or looking glass websites; repeated restarts could cause other networks to ignore the provider’s routes. As a workaround, providers filtered the expressions or blocked the command, and Cisco recommended the “Deterministic Regular Expression Engine”.

Ideas

  • Public diagnostic access to routers becomes attack surface.
  • A router restart forces the BGP table to be rebuilt.
  • Routes that frequently drop out are temporarily suppressed by other networks.
  • Looking glass websites often pass parameters to core routers unfiltered.

Insights

  • Through BGP dampening, a local crash can make an entire network unreachable.
  • Dedicated route servers without routing tasks limit the risk of public diagnostic services.

Facts

  • According to Cisco, the bug resembled a problem known since 2005.
  • Details of the hole were already circulating in IRC channels before an update was available.

References

Critique

  • The scope remains vague because it is unclear how many providers passed looking glass requests directly to production routers.

Recommendations

  • Never pass public looking glass and route server requests to production core routers.
  • Restrict diagnostic commands with free parameters to trusted users.

Read the original article

Search the Web Archive

hß · 2014

TR-069 remote maintenance hole in DSL routers: German internet providers call their networks secure

After Shahar Tal’s DEF CON talk about holes in TR-069 remote maintenance servers, heise asked German providers in 2014 how they were protected. Telekom, Vodafone, 1&1 and others considered their networks secure because their routers reject self-signed certificates or only contact preset servers. Tal had shown that a hijacked Auto Configuration Server can redirect or read out thousands of routers.

hß · 2024

Wednesday: Meta annoys AR developers, security hole at internet providers

Alongside Meta ending third-party AR effects and the Polaris Dawn launch, heise’s news round-up of 28 August 2024 reported an attack on internet providers. An unpatched hole in the network software Versa Director (CVE-2024-39717) was used to gain a foothold in at least four ISPs. There the attackers intercepted customer credentials in plain text before they were stored hashed; Lumen attributed the attack to the Chinese group Volt Typhoon.

hß · 2001

New security hole in internet routers

In 2001 the configuration password of DrayTek’s Vigor2000 and Vigor2200 DSL and ISDN routers could be spied out from the local network. Attackers on the LAN could use it to reconfigure the router; only firmware 1.07 helped. The hole could not be exploited from the internet and was therefore less dangerous than the insecure default configuration of many routers.