Backdoored firmware lets China state hackers control routers with “magic packets”::The modified firmware used by BlackTech is hard to detect.

  • Optional@lemmy.world
    link
    fedilink
    English
    arrow-up
    17
    ·
    1 year ago

    Cisco also said that the hacker’s ability to install malicious firmware exists only for older company products. Newer ones are equipped with secure boot capabilities that prevent them from running unauthorized firmware, the company said.

    To install their modified bootloader, the US and Japanese advisory said, the threat actors install an older version of the legitimate firmware and then modify it as it runs in memory. The technique overrides signature checks in the Cisco ROM monitor signature validation functions, specifically functions of Cisco’s IOS Image Load test and the Field Upgradeable ROMMON Integrity test. The modified firmware, which consists of a Cisco IOS loader that installs an embedded IOS image, allows the compromised routers to make connections over SSH without being recorded in event logs.

  • spacecadet@lemm.ee
    link
    fedilink
    English
    arrow-up
    12
    ·
    1 year ago

    In an advisory of its own, Cisco said the threat actors are compromising the devices after acquiring administrative credentials and that there’s no indication they are exploiting vulnerabilities.

    If they aren’t exploiting vulnerabilities (and this is all because of mishandling of admin creds) then why are only Cisco routers being targeted?

    • Darkard@lemmy.world
      link
      fedilink
      English
      arrow-up
      14
      ·
      1 year ago

      They are loadi g in modified firmware apparently. Will be specific to Cisco hardware.

      It’s all kinda irrelevant though. If they managed to figure out your weak ass admin creds and you left your router open to access with no ACLs then installing some sneaky firmware is the least of your worries

  • PlexSheep@feddit.de
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    I suppose magic packets are not the packets for wake over lan, right? Because wol packages are commonly called magic packages too.

  • AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    4
    ·
    1 year ago

    This is the best summary I could come up with:


    The threat actor is somehow gaining administrator credentials to network devices used by subsidiaries and using that control to install malicious firmware that can be triggered with “magic packets” to perform specific tasks.

    In an advisory of its own, Cisco said the threat actors are compromising the devices after acquiring administrative credentials and that there’s no indication they are exploiting vulnerabilities.

    Cisco also said that the hacker’s ability to install malicious firmware exists only for older company products.

    Newer ones are equipped with secure boot capabilities that prevent them from running unauthorized firmware, the company said.

    BlackTech members use the modified firmware to override code in the legitimate firmware to add the SSH backdoor, bypass logging, and monitor incoming traffic for “magic packets.” The term refers to small chunks of data the attackers send to the infected routers.

    While they appear random and innocuous in system logs, these packets allow the attackers to surreptitiously enable or disable the backdoor functionality.


    The original article contains 522 words, the summary contains 160 words. Saved 69%. I’m a bot and I’m open source!

  • const_void@lemmy.ml
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    11
    ·
    1 year ago

    PC firmware is also largely written in China. Think about this the next time you’re considering a “cheap” Lenovo laptop.