Security Activity Bulletin
Evolution in Attacks Against Cisco IOS Software Platforms
IntelliShield ID: 40411
First Published: 2015 August 11 18:17 GMT
Cisco PSIRT has released information regarding increasingly complex attacks against platforms running Cisco IOS Software. Cisco PSIRT has contacted customers to describe an evolution in attacks against Cisco IOS Classic platforms. Cisco has observed a limited number of cases where attackers, after gaining administrative or physical access to a Cisco IOS device, replaced the Cisco IOS ROMMON (IOS bootstrap) with a malicious ROMMON image. In all cases seen by Cisco, attackers accessed the devices using valid administrative credentials and then used the ROMMON field upgrade process to install a malicious ROMMON. Once the malicious ROMMON was installed and the IOS device was rebooted, the attacker was able to manipulate device behavior. Utilizing a malicious ROMMON provides attackers an additional advantage because infection will persist through a reboot. No product vulnerability is leveraged in this attack, and the attacker requires valid administrative credentials or physical access to the system to be successful. The ability to install an upgraded ROMMON image on IOS devices is a standard, documented feature that administrators use to manage their networks. No CVE ID will be assigned. The Cisco PSIRT has recently updated a number of technical documents to include information regarding the ROMMON attack as well as other threats to Cisco IOS devices. The following white papers are publicly available and provide information for preventing, detecting, and remediating potential compromise on Cisco IOS devices.
Cisco IOS Software Integrity Assurance
Cisco Guide to Harden IOS Devices
Telemetry-Based Infrastructure Device Integrity Monitoring
Read Cisco’s full announcement:
http://tools.cisco.com/security/center/viewAlert.x?alertId=40411
http://www.pcworld.com/article/2970952/cisco-warns-customers-about-attacks-installing-rogue-firmware-on-networking-gear.html
https://threatpost.com/cisco-warns-customers-about-attacks-installing-malicious-ios-bootstrap-images/114250
http://www.infoworld.com/article/2970500/network-security/cisco-warns-customers-about-attacks-installing-rogue-firmware-on-networking-gear.htm
Firmware Security 