Cisco Flaws Put Millions of Workplace Devices at Risk
Credit to Author: Lily Hay Newman| Date: Wed, 05 Feb 2020 16:56:40 +0000
Five vulnerabilities in Cisco Discovery Protocol make it possible for a hacker to take over desk phones, routers, and more.
Workplace phones and routers have a long, storied history of very bad vulnerabilities. Now it's time again to add to the list: Researchers say that a crop of recently discovered flaws in Cisco enterprise products—like desk phones, web cameras, and network switches—could be exploited to penetrate deep into corporate networks. Because Cisco dominates the network equipment market, the bugs impact millions of devices.
All software has flaws, but embedded device issues are especially concerning given the potential for espionage and the inherent complexity of patching them. These particular vulnerabilities, found by the enterprise security firm Armis, can also break out of the "segmentation" IT managers use to silo different parts of a network, like a guest Wi-Fi, to cause widespread issues. Attackers could target a vulnerable Cisco network switch—which moves data around an internal network—to intercept large amounts of unencrypted, internal information and move between different parts of a target's system. Attackers could use related flaws, also disclosed by Armis, to attack batches of Cisco devices at once—like all the desk phones or all the webcams—to shut them down or turn them into eyes and ears inside a target organization.
“Network segmentation is a key way to secure IoT devices,” says Ben Seri, vice president of research at Armis. “But sometimes we can poke holes. And we know that enterprise devices are being targeted in the world. If they have this type of vulnerability, unfortunately that can be very powerful for a group like an APT.”
The flaws lie in the implementation of a mechanism known as the Cisco Discovery Protocol, which allows Cisco products to broadcast their identities to each other within a private network. CDP is part of a network's "Layer 2," which establishes the foundational data link between network devices. All devices use some sort of identity broadcasting mechanism, but CDP is Cisco’s proprietary version.
"You’re going to have to own a lot of devices, but once you own all of them you’ve literally taken over every single piece of the network."
Ang Cui, Red Balloon
Separating Cisco products out by having them use CDP has some logistical benefits, but Seri points out that it also creates an easy way for attackers to find Cisco products once they're inside a network. And since all Cisco products use CDP, one vulnerability can be used to automatically and simultaneously target many devices at once, or to take over crucial devices like network switches and move laterally from there. Any Layer 2 protocol can have bugs; vulnerabilities in CDP simply provide a particularly efficient route to attacking ubiquitous Cisco products.
Armis disclosed its findings to Cisco at the end of August, and today the networking giant is releasing patches for all five vulnerabilities. There are so many because Cisco implements CDP in slightly different ways depending on the product; Armis found related bugs throughout the disclosure process and worked with Cisco to patch them all.
"On February 5, we disclosed vulnerabilities in the Cisco Discovery Protocol implementation of several Cisco products along with software fix information and mitigations, where available," a Cisco spokesperson said in a statement. "We are not aware of any malicious use of the described vulnerabilities."
To exploit the bugs, attackers would first need a foothold inside a target's network, but from there they could fan out quickly, compromising one vulnerable Cisco device after another to bore deeper into a system. And once attackers controlled a switch or router they could start to intercept unencrypted network data, like files and some communications, or access a company's "active directory," which manages authentication for users and devices.
“It’s still hop by hop. As a hacker, you still need an initial attack vector into the network,” says Ang Cui, founder of the IoT security firm Red Balloon, who has disclosed numerous Cisco bugs. “But once you’re there, at each hop you have the same vulnerability present—all the switches, firewalls, and routers in a network could be affected by this. So you’re going to have to own a lot of devices, but once you own all of them you’ve literally taken over every single piece of the network.”
Cui also notes that there's a decades-long history of researchers discovering CDP vulnerabilities and calling attention to them, so Cisco can fix them before they're ever exploited or to minimize exploitation. Concern about exploitation of such enterprise IoT bugs is not just theoretical. In August, researchers at Microsoft spotted suspected state-sponsored Russian hackers attacking desk phones, printers, and other office IoT devices to infiltrate corporate networks. And the Department of Homeland Security has warned about the importance of defending enterprise network infrastructure.
While the patches Cisco has released are important, Seri notes that most of the vulnerable devices don’t auto-update, and need manual patching to receive protection. That's especially difficult on enterprise switches and routers, which need to be patched carefully so the process doesn’t cause network downtime. There are also other mitigations companies can consider that involve disabling CDP on devices like switches, but this can eventually create other problems.
Given the ubiquity of Cisco equipment in enterprise networks worldwide, though, the first step is always just getting fixes out there.