Nasty Cisco attack

Topic

New Reply

Nasty Cisco Attack

Schneier on Security

https://www.schneier.com/blog/archives/2015/08/nasty_cisco_att.html

This is serious: Cisco Systems officials are warning customers of a series of attacks that completely hijack critical networking gear by swapping out the valid ROMMON firmware image with one that’s been maliciously altered…. [continue reading at above link if interested]

Reply | Quote

Replies

My Realtek wireless driver includes Cisco Modules – wonder if Realtek are doing anything about it.

Reply | Quote

Needs admin password or physical access though.

Reply | Quote

I don’t know which firmware my TalkTalk router uses but they can access it remotely using TR069.

Reply | Quote

I don’t know which firmware my TalkTalk router uses but they can access it remotely using TR069.

Without a password?

Reply | Quote

Without a password?

Yes – I’ve seen there is an Admin URL path they can use in the router Tools section, although I have the option to turn TR069 off.

This router gets auto firmware updates when there are any and on one occasion when I noticed that Interleaving was Off, I phoned TT and they enabled it although I think that is something they have to do at their end rather than a setting in the router, as I haven’t seen any UI settings for that.

Reply | Quote

Well if you are already exec you already own it.

:cheers:

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote