- So you may ask, why hack network devices?
What is it that makes the network device so
attractive to an attacker or maybe even to
the defender who is defending against the attacker?
And really, when it gets down to the base of it,
it's the core of the network right?
This is where all of your packets are flowing through.
And really if you have a way of snooping
or injecting packets off the network,
you really have a way of controlling the end
points even without having to worry
about the endpoints themselves necessarily
individually if you have access to the entire network.
Another thing is it may not be
monitored as closely as your hosts.
We're all very familiar with how
we monitor our host today.
Really when it comes down to it though,
routers and switches and networking devices
may not be monitored that closely.
Your firewalls you probably are
monitoring those fairly closely,
but routers and switches maybe not as much.
They have a longer system life cycle.
What does that mean?
Well that means that you don't
replace them as often right?
A lot of times, sometimes I've
even heard people that just load
up the code that it came with,
you know that a switch or a router came with,
and that's what it runs for the rest of its life.
You know they don't keep it up to date,
they don't patch it.
They don't have any malware detection right?
You don't have any antivirus that runs
on a switch or on a router that makes sure
that it is free of any kind of malware.
Another issue is that it's antiquated.
A lot of the protocols that are on a
router or a switch they're running protocols
that were designed back in the 80s,
their IGP's maybe early 90s.
where the configuration stays static.
I can't tell you how many devices I've
seen where maybe they have an excel spreadsheet right,
and maybe you plug in some values in it
and it spits out a configuration and that's what you use.
It could be that simple.
Routers and switches, they have features
such as port mirroring, tunneling,
lawful intercept, where you can use
those as an attacker to infiltrate
and even exfiltrate data.
So and when I say infiltrate data,
you can inject packets that look
like they're coming from some host,
where in reality they're coming from
somewhere completely different.
And an example of this is
like using GRE tunneling.
If you can send packets directly to a router,
you can have that get stripped off,
that GRE tunnel get stripped off,
and then forwarded on to a host.
And then finally, some devices,
they have built in analysis tools.
Especially some of the newer switches and routers.
They have Wire Shark or TShark or something
like that built into them so that you can
analyze packets and flows directly on box
without having to copy them off and
look at them somewhere else.
So as far as the steps to owning a network,
we'll start out with you have an exploited vulnerability,
and this vulnerability could be a compromised credential,
could be an unpatched software,
the vulnerability is in the software
and there's just no patch that
has been applied to the device,
and then other times you'll have zero days,
which are genuine vulnerabilities that have
not been discovered and they have not been reported on,
and sometimes you find those.
Really what happens though more often than not,
are compromised credentials.
And you're gonna see this later on,
I'm actually going to show you how to copy
off credentials from other protocols like
triple A protocols like Radius or Tacacs.
Where you have access to a device,
and you wait for a legitimate
administrator to log into the device,
and then you'll get their password,
and then you'll be able to us that
access to pivot to other devices.
And then, the second step is,
is once you have access to the device
then you can start doing things like
configuration changes.
You can start turning on GRE tunnels,
you can turn on lawful intercept.
And then, if you're a lot more capable,
and you have more resources,
you can do things like in memory
network operating system modifications.
That's where you could patch the code
so that for instance you could turn off
all kinds of password checking so that
if you login you can give any password you
want and let you in for a particular account.
These are things that you can do.
Another thing that you can do is
let's say you wanted to make your change persistent.
Then you can change the code that's
actually on the disk of the network
operating itself so that when it boots
up the next time you have your change that you've made.
Another thing you could do is change the boot loader.
So what this applies for is not only for code
that has already been installed on the device,
but code that could be installed
in the future of the device.
So you could patch the boot loader so that
it goes through your code and as it boots up
it can change the code to do whatever it
is that the attacker wants when the system
boots up so that it comes up and it always
comes up in the same state.
And then finally the result.
Once you have this you can get persistence.
So by doing some of these in memory,
on disk and boot loader modifications
you can have persistence.
So even if the device is rebooted,
in some cases if it's reinstalled,
you have that access.
Another thing that is starting to become
a lot more serious is that now when
you have access to do things like boot
loader modifications is you can brick the hardware.
You could have a very, very expensive device
that sometimes costs upwards of hundreds of
thousands of dollars, and you can go through
every line card that's in that device and
just basically modify the boot loader so
that it doesn't boot.
And then later on when it gets rebooted
maybe by the attacker or maybe by some
kind of maintenance window that has been scheduled,
the device goes down and it never comes back up.
And then finally, you have data exfiltration right?
You have these features that are
built in such as lawful intercept,
and then that copies the data out of the network,
in some cases tunnels it over the
internet to a system that the attacker controls.