Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

blogs.cisco.com

Post reply on HN
Print view View original

11–20 of 36 posts

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#11

Post by Shank »

walrus01 wrote: post #8

re: EXTRABACON If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.

It's a pivot though. If you can compromise anything that's on the LAN you can pivot inside with this. The sample files provide prove that they have working exploits, that they're NSA-grade, and that they function. The actual auction files are probably much more "fire and forget" grade -- either acting over the internet or doing privilege escalation combined with these attacks.

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#12

Post by zengid »

walrus01 wrote: post #8

re: EXTRABACON If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.

IT student here. Genuinely curious: could you explain why this is a fundamental error?

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#13

Post by walrus01 »

zengid wrote: post #12
walrus01 wrote: post #8

re: EXTRABACON If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.

IT student here. Genuinely curious: could you explain why this is a fundamental error?

SNMP is used for internal management/monitoring of network-enabled devices, which you don't expose to the public internet.

The SNMP supported on old PIX is SNMPv1/SNMPv2 which sends the community string in plaintext, and the reply is similarly unencrypted, so its basically the same security level as telnet or regular http (none).

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#14

Post by walrus01 »

Shank wrote: post #11
walrus01 wrote: post #8

re: EXTRABACON If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.

It's a pivot though. If you can compromise anything that's on the LAN you can pivot inside with this. The sample files provide prove that they have working exploits, that they're NSA-grade, and that they function. The actual auction files are probably much more "fire and forget" grade -- either acting over the internet or doing privilege escalation combined with these attacks.

yes, absolutely true. If the exploit is running on a non-Cisco compromised device that's in RFC1918 IP space somewhere that it can reach internal, SNMP-listening interfaces of the device, that's a good way to attack it.

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#15

Post by oogali »

zengid wrote: post #12
walrus01 wrote: post #8

re: EXTRABACON If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.

IT student here. Genuinely curious: could you explain why this is a fundamental error?

A former, pissed-off employee who still remembers all of your routers' IP addresses and SNMP communities can issue a SNMP request to shut down all network interfaces and disable your network to the outside world.

A former employee who tells someone else your SNMP communities...

A current employee who in a moment of laziness, inadvertently leaves your SNMP community in a public pastebin or Github Gist...

So on and so forth.

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#16

Post by arca_vorago »

walrus01 wrote: post #8

re: EXTRABACON If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.

I agree but if there is one lesson I've learned, its that often when you find such environments it is due to failure of the management/execs to properly support the IT team, so they cut corners, halfass it, or hire contractors as you mentioned. True it shouldnt be done, but if you are selling equipment to a business who has had this failing, its just something to be aware of.

Im so damn tired of companies underfunding IT and then roasting some director or other alive when the technical debt inevitably bites them in the ass.

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#18

Post by lallysingh »

dogma1138 wrote: post #3

On thing I find odd is "JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from…

It's just poor grammar. Here's the fixed sentence, replacing a confusing proper noun: "PROPERNOUN Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms [that] prevents these types of attacks."

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#19

Post by nathanlied »

oogali wrote: post #15
zengid wrote: post #12

Earlier quoted context omitted.

IT student here. Genuinely curious: could you explain why this is a fundamental error?

A former, pissed-off employee who still remembers all of your routers' IP addresses and SNMP communities can issue a SNMP request to shut down all network interfaces and disable your network to the outside world. A former employee who tells someone else your SNMP communities... A current employee who in a moment of laziness, inadvertently leaves your SNMP community in a public pastebin or Github Gist... So on and so…

I'd further elaborate on your answer with:

Even if you can only monitor things, instead of directly issuing commands, it's still information you're leaking.

Information leaks are still a class of vulnerability for a reason. It can give an attacker information on your network topology that he wouldn't usually have.

The less attack surface exposed, the better. Generally, if something is exposed to the Internet that has no (good) reason to be, it's a vulnerability.

Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits

#20

Post by tater_sent_me »

dogma1138 wrote: post #3

On thing I find odd is "JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from…

Isn't it interesting how JETPLOW is an anagram for JEWPLOT?
Post reply on HN