LiPari_Assignment8
- 1. Phillip LiPari, Writing for Intelligence 23 September 2015 Routers Hijackings pose new Threatto Cybersecurity Executive Summary: Malware that hijacks and replaces the integrated operating system (IOS) of internet routers is likely to become a more commonplace tactic among threat actors. By hijacking routers, threat actors create a beachhead for further cyber-attacks and can view all data accessed via the internet. Countermeasures for these attacks are currently ineffective due to their unique and unprecedented nature. Discussion: SYNful Knock is the name given to the malware used in router hijacking attacks through default login codes. Default login codes are the maintenance usernames and passwords to routers. These logins have long been areas of concern for cybersecurity professionals but went unexploited prior to SYNful.1 Rewriting a router`s IOS allows SYNful to become integrated within the infected router. The SYNful software updates itself regularly once inside the router to ensure an appearance of normal operations.2 These factors allow SYNful to remain undetected for undetermined periods of time. Router based cyber-attacks were only theorized prior to the SYNful attacks on Cisco brand routers revealed on 15 September 2015. The initial estimate of routers compromised was 14 routers in four countries but it has since risen to over 200 routers in 31 countries. As many as 60 of these routers are located in the US and so far they have only been found in networks used by private companies.3 “This attack vector is very much a reality and will most likely grow in popularity and prevalence” stated David Dewalt, CEO of the cybersecurity firm FireEye. 4 Dewalt also stated that Cisco brand routers were not the only brand susceptible to these attacks. Due to the complexity and scope of the attacks, Dewalt claims a state actor is likely responsible. 5 Thus far there have been no accusations toward any specific state or group. Infected routers send data to the threat actors controlling them as well as the intended destination via the internet. In addition to compromising massive amounts of data, infected routers serve as a beachhead for further attacks on a network.6 Reformatting infected routers is Basic diagram of a router connected to the internet, SYNful would have access to anything connected to the router (in this case the two computers)
- 2. the only way to eliminate SYNful due to the IOS integration. FireEye recommends a thorough examination of networks compromised by infected routers.7 Cisco stated that routers are both valuable to threat actors as well as key points of defense within a network. Since SYNful and router attacks in general are still vague and difficult to prevent, they will remain an effective attack method.8 Considering the lack of a defensive strategy, Cisco`s security division is currently developing methods to detect and repel router attacks.9 Source Reliability: Moderate With questions or concerns, please contact the author: Email: plipar35@lakers.mercyhurst.edu Phone: (585) 752-9449 Peer reviewed by: Austin Wood Graphic source: http://www.microsoft.com/library/media/1033/windowsxp/images/using/networking/setup/68573- router-diagram.gif Endnotes 1 http://news.softpedia.com/news/some-wifi-routers-can-be-hacked-using-a-hard-coded-default-login- 490207.shtml (L) 2 http://searchsecurity.techtarget.com/news/4500253817/Cisco-router-malware-in-the-wild-more-widespread- than-first-believed (H) 3 http://fcw.com/articles/2015/09/15/cisco-router.aspx (M) 4 http://www.networkworld.com/article/2984124/security/attackers-can-take-over-cisco-routers-other-routers- at-risk-too.html (M) 5 http://www.fierceenterprisecommunications.com/story/even-more-cisco-devices-found-be-infected-synful- knock/2015-09-21 (M) 6 http://www.crn.com/news/networking/300078193/hundreds-of-cisco-routers-infected-with-synful-knock- partners-say-attack-changing-sales-strategy.htm (M) 7 http://www.infosecurity-magazine.com/news/cisco-synful-knock-threat-victims/ (M) 8 http://www.ibtimes.com/router-hack-creates-ultimate-listening-device-monitor-countrys-entire-internet- 2097511 (M) 9 http://www.eweek.com/security/synful-knock-malware-found-on-almost-200-cisco-routers.html (M)