RE: Cisco vulnerability and dangerous filtering techniques
I was thinking about this the other day. The most efficient way to make this work would be to spread using some vulnerability (like the Microsoft DCOM vulnerability released last week), and then at a predetermined time, start DoS'ing routers in the IP space of major providers, and then work your way towards the "edges." You can pretty much safely assume that most of your infected machines are going to basically be on the edges of the internet, so if you start with major providers, you won't kill all of your connectivity. Even more destructive would be p2p built into it, so all of the infected hosts could coordinate before the attack on what networks each one would handle. Someone is likely going to attempt something similar, it's just a matter of time before it happens. Luckily this Cisco problem didn't come out around the same time as the slammer worm. Jay
-----Original Message----- From: jgraun@comcast.net [mailto:jgraun@comcast.net] Sent: Tuesday, July 22, 2003 9:58 AM To: Adam Maloney Cc: nanog@merit.edu Subject: Re: Cisco vulnerability and dangerous filtering techniques
That is a bit paranoid, but it could happen. I have not seen anybody do anything that intelligent in the past couple of years. Not to say that there arent people out there that couldn't do that but I think many have thought of using one exploit to expose another, DDoS is the closest I have seen on any of my honeypots. I have learned many things about what most people will try to get into a box from the honeypots, but that is a good point. Filtering or patching should take place on the edge and on the most critical spots on your network.
Good Luck
I had a passing thought over the weekend regarding Thursday's cisco vulnerability and the recent Microsoft holes.
The next worm taking advantage of the latest Windows'
more or less inevitable. Someone somewhere has to be writing it. So why not include the cisco exploit in the worm payload?
Based on past history, there will be plenty of vulnerable Windows hosts to infect with the worm. I would also guess that there are lots of organizations and end-users that have cisco devices that haven't patched their IOS. Furthermore, I wonder how many people have applied filtering only at their border? But packets from an infected host inside the network wouldn't be stopped by filtering applied only to
side.
Basically, if you're filtering access to your interface IP's rather than upgrading IOS, remember that the internet isn't the only
vulnerabilities is the external source of danger
to your network.
Adam Maloney Systems Administrator Sihope Communications
Austad, Jay wrote:
I was thinking about this the other day. The most efficient way to make this work would be to spread using some vulnerability (like the Microsoft DCOM vulnerability released last week), and then at a predetermined time, start DoS'ing routers in the IP space of major providers, and then work your way towards the "edges." You can pretty much safely assume that most of your infected machines are going to basically be on the edges of the internet, so if you start with major providers, you won't kill all of your connectivity. Even more destructive would be p2p built into it, so all of the infected hosts could coordinate before the attack on what networks each one would handle.
Imagine generalizing that to phases - build a virus that uses several different modes of propagation to different platforms - virulent, but not too violent (ie: not like SQL slammer), then phase it to DOS various services, including the routers. You might come in one morning to find your entire network infested with a multi-phasic virus which has destroyed whatever it could, DDOS'd everything it couldn't, and big chunks of your network are dead. On multiple platforms simultaneously. You're in a mode where everything has to be unplugged, and scrubbed before reconnecting. Ugh. SQL slammer was inadvertently almost there. We're not an SQL shop, but a few machines here and there had it enabled for one reason or another. The propagation flood itself was so violent it took out non-Windows services.
I was thinking about this the other day. The most efficient way to make this work would be to spread using some vulnerability (like the Microsoft DCOM vulnerability released last week), and then at a predetermined time, start DoS'ing routers in the IP space of major providers, and then work your way towards the "edges."
Pray tell, the virus will also get BGP feeds to determine where the edges are? Alex
participants (3)
-
alex＠yuriev.com -
Austad, Jay -
Chris Lewis