CISCO urges Network Administrators to validate their Router Software
Posted by Doug Spear on Sun, Mar 22, 2009
Earlier this year at EuSecWest 08, Sebastian Muñiz of Core Security has
demonstrated how to unpack and repackage Cisco IOS binaries. Effectively this showcases how rootkits can be embedded inside a valid Cisco IOS image. There are valid uses for this, especially when it comes to debugging, troubleshooting or penetration testing. But the upside potential is staggering, especially given the proliferation of fake Cisco hardware sporting fake CISCO software. Even US Government is aware of tainted hardware that has made it into Government purchasing streams.
In their defense, Cisco has published a
guide for Network Administrators urging them to double check MD5 hashes of their router software. Now what happens if Cisco OS components are customized?