Russian state-sponsored threat actors have built custom malware and are using it against old, unpatched Cisco IOS routers (opens in new tab), a joint US-UK report has warned.
The UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) released a report (opens in new tab) in which they state that APT28, a group allegedly affiliated with the Russian General Staff Main Intelligence Directorate (GRU), developed a custom malware named “Jaguar Tooth”.
This malware is capable of stealing sensitive data passing through the router, and allows threat actors unauthenticated backdoor access to the device.
Stealing data
The attackers would first scan for public Cisco routers using weak SNMP community strings, such as the commonly used “public” string, BleepingComputer reports. As per the publication, SNMP community strings are like “credentials that allow anyone who knows the configured string to query SNMP data on a device”.
If they find a valid SNMP community string, the attackers will look to exploit CVE-2017-6742, a six-year-old vulnerability that allows for remote code execution. That allows them to install the Jaguar Tooth malware directly into the memory of Cisco routers.
“Jaguar Tooth is non-persistent malware that targets Cisco IOS routers running firmware: C5350-ISM, Version 12.3(6),” the advisory reads. “It includes functionality to collect device information, which it exfiltrates over TFTP, and enables unauthenticated backdoor access. It has been observed being deployed and executed via exploitation of the patched SNMP vulnerability CVE-2017-6742.”
The malware will then create a new process called “Service Policy Lock” that gathers all the output from these Command Line Interface commands and harvests them using TFTP:
- show running-config
- show version
- show ip interface brief
- show arp
- show cdp neighbors
- show start
- show ip route
- show flash
To address the problem, admins should update their Cisco routers’ firmware immediately. Furthermore, they can switch from SNMP to NETCONF/RESTCONF on public routers. If they can’t switch from SNMP, they should configure allow and deny lists to limit who can access the SNMP interface on internet-connected routers. Also, the community string should be changed to something stronger.
The advisory also says admins should disable SNMP v2 or Telnet.
Via: BleepingComputer (opens in new tab)
