[walrus01]

re: EXTRABACON

If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.

[Shank]

It's a pivot though. If you can compromise anything that's on the LAN you can pivot inside with this. The sample files provide prove that they have working exploits, that they're NSA-grade, and that they function. The actual auction files are probably much more "fire and forget" grade -- either acting over the internet or doing privilege escalation combined with these attacks.

[walrus01]

yes, absolutely true. If the exploit is running on a non-Cisco compromised device that's in RFC1918 IP space somewhere that it can reach internal, SNMP-listening interfaces of the device, that's a good way to attack it.

[zengid]

IT student here. Genuinely curious: could you explain why this is a fundamental error?

[wepple]

Other people have given good, specific answers. Let me generalize from a security perspective:

Having a port listening on the internet means you've exposed (usually) tens or hundreds of thousands of lines of code to anyone with an internet connection. One vulnerable line of code or mis-configuration could be an entry point into your network for an attacker.

The key then, is deciding what absolutely needs to be exposed. If you run a website, you're going to need to expose your web server to the internet. Need access for remote workers? You'll open up a VPN. There are a bunch of things that generally have no place being exposed to the internet: SNMP, SMB, afp, RDP, Telnet, Any admin console, etc.

[oogali]

A former, pissed-off employee who still remembers all of your routers' IP addresses and SNMP communities can issue a SNMP request to shut down all network interfaces and disable your network to the outside world.

A former employee who tells someone else your SNMP communities...

A current employee who in a moment of laziness, inadvertently leaves your SNMP community in a public pastebin or Github Gist...

So on and so forth.

[nathanlied]

I'd further elaborate on your answer with:

Even if you can only monitor things, instead of directly issuing commands, it's still information you're leaking.

Information leaks are still a class of vulnerability for a reason. It can give an attacker information on your network topology that he wouldn't usually have.

The less attack surface exposed, the better. Generally, if something is exposed to the Internet that has no (good) reason to be, it's a vulnerability.

[walrus01]

SNMP is used for internal management/monitoring of network-enabled devices, which you don't expose to the public internet.

The SNMP supported on old PIX is SNMPv1/SNMPv2 which sends the community string in plaintext, and the reply is similarly unencrypted, so its basically the same security level as telnet or regular http (none).

[zengid]

Thank you for explaining!

[tptacek]

The point of EXTRABACON isn't to break into networks protected by an ASA; it's to persist onto that network by infecting the firewall after you manage somehow to bypass it. It's of a kind with exploits for other firewalls through management interfaces that can't be reached on the public interface.

[moyix]

Still, I wonder how long before we see it weaponized by adding this as a payload to ordinary desktop malware. A nice trick would be something that scans the local network, infects the ASA (people are pretty good about keeping SNMP off the internet, possibly less good about keeping it off the internal interfaces), and then does HTTP injection from the ASA with SecondDate of either a malicious or advertising payload.

[arca_vorago]

I agree but if there is one lesson I've learned, its that often when you find such environments it is due to failure of the management/execs to properly support the IT team, so they cut corners, halfass it, or hire contractors as you mentioned. True it shouldnt be done, but if you are selling equipment to a business who has had this failing, its just something to be aware of.

Im so damn tired of companies underfunding IT and then roasting some director or other alive when the technical debt inevitably bites them in the ass.

[walrus01]

Usually when I see something like SNMP listening to the public internet, I treat it like this:

http://www.compliancebuilding.com/2009/08/03/compliance-van-...

[Spooky23]

No way. That's straight up incompetence.

[tgsovlerkhgsel]

If you have a sufficiently large network, for a sufficiently long time, someone, somewhere, will fuck up an ACL.

[tptacek]

This isn't an ACL setting. You have to specifically ask an ASA to bind SNMP to the external interface.