Home page logo

nanog logo nanog mailing list archives

Re: router damaged by cracker?
From: Deepak Jain <deepak () ai net>
Date: Thu, 12 Oct 2000 12:42:20 -0400 (EDT)

By the way that article reads, I would guess the attack was not
exceptionally sophisticated. (Everyone's definition of sophisticated is

If one removed the config-reg (or renamed it) function on a small Cisco's
firmware one could quite effectively change the passwords and make it
difficult for a not very technical group of admins to take it back.

Since there is talk about moving their main router behind a firewall, my
guess is that they are using a routing appliance rather than any
sophisticated routing hardware. The $18,000 replacement is probably for a
different vendor, not because the hardware has lost function.

This is all wild conjecture because I haven't seen any alerts from vendors
in their normal channels. :)

Deepak Jain

On Thu, 12 Oct 2000, Kai Schlichting wrote:

If we assume that the router mentioned in the following cracking incident
is a popular model we all use: what other than zapping the FlashROM could
this attacker have done? We all know that <big popular vendor>'s firmware
source code has hit the pirate BBS's a year or two back : could someone have
compiled a rogue image that can actually fry some router components (I can
think of plenty of nasty things with serial ports transmitting too fast
for their own good - and burn the driver chips) ?


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]