The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
blogs.cisco.com
The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
1–10 of 36 posts
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#2It it yet another ASN.1-related exploit ?
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#3On thing I find odd is
"JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from a trusted source as claimed."
They claim that the implant is digitally signed, then they say that it shouldn't work because Cisco software is digitally signed also, and it's verified by the Cisco Secure Boot.
Isn't that a bit contradictory? sure they might have had flaws in their verification process (we've seen signature verifications that were nothing more than "is this a signed message" before) but since Cisco verifies the signature properly (as you haven't been able to binary patch Cisco boot images for 5+ years) doesn't this implies that the NSA got a hold of the signing keys used by Cisco or an authorized 3rd party?
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#4On thing I find odd is "JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from…
They clarified that the files are signed by PKI now. Notice the order of the words "digitally signed [files] are signed using secure [etc] in newer platforms"
It suggests to me that the previous signature style was a symmetric type, whereas now it's asymmetric.
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#5On thing I find odd is "JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from…
The advisory is saying that JETPLOW is not signed. And thus, in newer platforms where signing is implemented, it would prevent that type of attack.
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#6On thing I find odd is "JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from…
> They claim that the implant is digitally signed
Where do they claim that? Both occurrences of the words "digitally signed" in the quoted section refer to the new Cisco software and not to the JETPLOW payload.
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#7For being so smart why does every comment and article on this site lack proper English grammar?
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#8re: EXTRABACON
If you have SNMP listening on a public ipv4/ipv6 interface of a firewall (I don't care if it's an EOL/EOS PIX or not), you have done something fundamentally wrong from the start. As a network engineer seeing something like this in a business customer's equipment would cause me to seriously reconsider all other decisions/security configurations made by a predecessor or third party contractor.
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#9On thing I find odd is "JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from…
The advisory is saying that JETPLOW is not signed. And thus, in newer platforms where signing is implemented, it would prevent that type of attack.
[deleted]
Re: The Shadow Brokers EPICBANANAS and EXTRABACON Exploits
#10On thing I find odd is "JETPLOW is a persistent implant of EPICBANANA. Digitally signed Cisco software is signed using secure asymmetrical (public-key) cryptography in newer platforms prevents these types of attacks. The purpose of digitally signed Cisco software is to increase the security posture of Cisco ASA devices by ensuring that the software running on the system has not been tampered with and originated from…
It says in newer platforms. That said, a boot verification is kind of pointless in systems that are expected to run continuously for months. If you have code execution, you might be perfectly fine only having your in for months and not bother to patch the firmware.