Cisco Routers Compromised by Malicious Code Injection Attack
Fourteen Cisco routers in Ukraine, the Philippines, Mexico and India were implanted with malicious code by way of the new SYNful Knock attack, FireEye finds.Hacking routers is a crime in most jurisdictions and, in at least 14 known cases around the world, it's also the result of a SYN (pronounced "sin"), which is a TCP packet synchronization component. In fact, FireEye's Mandiant division reported this week that it found at least 14 incidents in which a so-called "SYNful Knock" attack impacted Cisco routers in Ukraine, the Philippines, Mexico and India. With the SYNful Knock, the default Cisco IOS router firmware is somehow replaced or tampered with, enabling an attacker to implant a backdoor. Cisco is already taking action to protect its customers and has published guidance on how to detect and mitigate the attack. Mandiant found and reported the SYNful Knock attack to Cisco prior to publishing details about the vulnerability on Sept. 15. "These attacks do not exploit vulnerabilities, but instead use compromised credentials or physical access to install malware on network devices," a Cisco spokesperson told eWEEK. "We've shared guidance on how customers can harden their network, and prevent, detect and remediate this type of attack. We thank Mandiant/FireEye for their additional focus on protecting our shared customers, and for adding their voice to calls for greater focus on network security."
While the SYNful Knock attack is first being reported against Cisco devices, it is not unique to anything specific that Cisco does on its hardware. FireEye is also emphasizing that the users didn't load a malicious firmware image on their own either.