BlackHat 2009 Router Exploitation Presentation

I was reading an interesting presentation the other day, taken from BlackHat USA 2009 Briefings from Felix Lindner, and thought about sharing the main points here. The guy presents a reasonable analysis of the current situation regarding Router security and exploitation. As we all know, routers are exploitable of course, but not as easy as some “security Gurus” wants us to believe.

Some of the main points of the presentation are shown below:

• There is not much research going on from the general security community regarding Router vulnerabilities. In 2008 there were only 14 vulnerabilities reported for Cisco and some open ssl and memory leak issues for Juniper.
• Routers expose little functionality to remote attackers.
• Attackers prefer to focus on servers rather than the network infrastructure.
• Although router vendors started to implement more and more services on routers (such as VoIP, IPv6, SIP, H323, Lawful Intercept, SSL VPN, Web Service Routing etc) fortunately network engineers are slow in adopting all those new services. This means less vulnerabilities.
• Routers are rarely used as clients, so client site attacks are very rare.
• Router operating systems based on UNIX flavors are easier to exploit.
• Cisco is a monolithic architecture and IOS runs as a single large binary program running directly on the CPU. IOS is harder to exploit.

The presentation then continues with some useful recommendations for protecting Routers as described below:

Router Protection:

• Block traffic destined to any interface of the router itself. Only exception is traffic from management stations.
• Use MD5 on routing protocols
• Avoid running network services on your routers (such as HTTP,FTP,TFTP etc)
• Avoid running VoIP services on border or exposed routers.
• Monitor the router’s service modules independently.
• Use a configuration monitoring tool to observe any changes in IOS configuration. An excellent tool for this is RANCIT (Really Awesome New Cisco Config Differ) from http://www.shrubbery.net/rancid/
• Configure Core Dumping