I was reading an interesting presentation the other day, taken from BlackHat USA 2009 Briefings from Felix Lindner, and thought about sharing the main points here. The guy presents a reasonable analysis of the current situation regarding Router security and exploitation. As we all know, routers are exploitable of course, but not as easy as some “security Gurus” wants us to believe.
Some of the main points of the presentation are shown below:
- There is not much research going on from the general security community regarding Router vulnerabilities. In 2008 there were only 14 vulnerabilities reported for Cisco and some open ssl and memory leak issues for Juniper.
- Routers expose little functionality to remote attackers.
- Attackers prefer to focus on servers rather than the network infrastructure.
- Although router vendors started to implement more and more services on routers (such as VoIP, IPv6, SIP, H323, Lawful Intercept, SSL VPN, Web Service Routing etc) fortunately network engineers are slow in adopting all those new services. This means less vulnerabilities.
- Routers are rarely used as clients, so client site attacks are very rare.
- Router operating systems based on UNIX flavors are easier to exploit.
- Cisco is a monolithic architecture and IOS runs as a single large binary program running directly on the CPU. IOS is harder to exploit.
The presentation then continues with some useful recommendations for protecting Routers as described below:
- Block traffic destined to any interface of the router itself. Only exception is traffic from management stations.
- Use MD5 on routing protocols
- Avoid running network services on your routers (such as HTTP,FTP,TFTP etc)
- Avoid running VoIP services on border or exposed routers.
- Monitor the router’s service modules independently.
- Use a configuration monitoring tool to observe any changes in IOS configuration. An excellent tool for this is RANCIT (Really Awesome New Cisco Config Differ) from http://www.shrubbery.net/rancid/
- Configure Core Dumping
- How to Find IP Address From MAC Address on Cisco Devices
- How to Configure a Loopback Interface on Cisco Router & Switch
- Cisco Command to Test a Copper UTP Ethernet Cable on a Switch
- What is Cisco Meraki ? Some FAQ About Cisco Meraki You Need to Know
- What is Cisco Identity Services Engine (ISE)? Use Cases, How it is Used etc