IoT security Armis announced the discovery of five zero-day vulnerabilities in various implementations of the Cisco Discovery Protocol (CDP).
CDP is a Cisco Proprietary Layer 2 (Data Link Layer) network protocol that is used to discover information about locally attached Cisco equipment, which aids in mapping the presence of other Cisco products in the network.
All Cisco products, including Nexus switches, IOS XR routers, Cisco 7800 and 8800 IP phones and Cisco IP cameras, have this software, cannot be used without it and have no “off switch”. They can, therefore, be hacked via this zero-day vulnerability. [Get the full list here]
According to Cisco, 95%+ Fortune 500 companies use Cisco Collaboration solutions. The vulnerabilities, collectively called CDPwn, could allow an attacker to remotely take over tens of millions of devices.
Four of the vulnerabilities are critical Remote Code Execution (RCE) vulnerabilities and one is a Denial of Service (DoS) vulnerability that can lead to:
- Eavesdropping on voice and video data/calls and video feed from IP phones and cameras, capturing sensitive conversations or images.
- Theft of sensitive corporate data flowing through the corporate network’s switches and routers.
- Breaking network segmentation, allowing attackers to move laterally across the corporate networks to other sensitive systems and data.
- Compromise of device communications by leveraging man-in-the-middle attacks to intercept and alter traffic on the corporate switch.
Ben Seri, vp of Research at Armis, noted that these devices can, and do, connect to the enterprise network. Large numbers of these devices end up in places that attackers find extremely valuable.
“Layer 2 protocols are the underpinning for all networks, and as an attack surface are an under-researched area and yet are the foundation for the practice of network segmentation. Network segmentation is often utilized to provide security. Unfortunately, as this research highlights, the network infrastructure itself is at risk and exploitable by an attacker, so network segmentation is no longer a guaranteed security strategy,” he warned.
“The disclosure by Armis of the vulnerabilities relating to the CDP highlights the importance of taking a comprehensive approach towards security that includes all assets deployed within the enterprise,” said Tony Jarvis, chief technology officer, Asia-Pacific, with Check Point Software Technologies.
He warned that past attacks that targeted network devices such as switches and routers have been highly successful. He added that these devices become targets primarily due to the lack of attention from a security perspective. Coincidentally these same devices provide extensive connectivity throughout an organisation’s network.
CDP like any discovery protocol has an inherently tough job – be discoverable and secure at the same time. It is a problem as old as core networking protocols like Address Resolution Protocol (ARP) lamented Cameron Clifford, senior engineering manager at HackerOne.
“It is trivial for anyone on a wireless network to abuse the ARP to trick a router into believing their computer is Bob’s and also to trick Bob’s computer into thinking their computer is the router. This is essentially a Man-In-The-Middle (MITM) attack on Bob. Not 1:1 with CDP but another example of how discovery protocols have made trade-offs for utility versus security,” explained Clifford.
All is not lost. If you are lucky, Cisco may have already contacted you about the vulnerability and the patch on February 5, 2020. If you haven’t been told, best to check your emails or call whoever services your Cisco devices pronto.
In the meantime, Clement Lee, principal consulting security architect at Check Point Software, suggests that as a best practice, organisations maintain an inventory of all devices, with these devices configured according to a predefined security baseline.
“Such a baseline would make recommendations around approved software versions, services that should be either enabled or disabled and how to lock down various functions in order to prevent their misuse. Ideally, devices would be audited periodically to determine whether they comply with these guidelines and may form part of other security initiatives such as penetration tests,” he elaborated.
Documenting the various services enabled on each device will allow administrators to accurately determine whether vulnerabilities apply to specific deployments, and guide follows up actions that may be required. By making security an ongoing process that applies to all devices, organisations of all sizes can work towards continual improvement on an incremental basis.
