Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Is my router owned? How would I know?

  • From: Alexei Roudnev
  • Date: Sat Jan 14 05:03:34 2006

Some Cisco IOS'es have numerous bugs, related to SNMP (I watched few cases,
when all Cisco's 72xx lost configuration becuase of receivbing something
bogus), so SNMP should be filtered out from public internet.


----- Original Message ----- 
From: "Mikael Abrahamsson" <swmike@swm.pp.se>
To: "NANOG" <nanog@merit.edu>
Sent: Thursday, January 12, 2006 2:09 PM
Subject: Re: Is my router owned? How would I know?


>
> On Thu, 12 Jan 2006, Rob Thomas wrote:
>
> > If there are new or changed SNMP RW community strings, look out!
>
> If you have any SNMP v1/v2 RW communities what so ever, you're likely to
> be owned, at least if they're common to several units in your network and
> you don't limit what part of the tree the RW communities can access.
>
> Seems like a common attack vector is to send SNMP WRITE and upload the
> router configuration to a hacked tftp server, and then iterate thru the
> network as a lot of people have a single SNMP WRITE community in their
> network.
>
> -- 
> Mikael Abrahamsson    email: swmike@swm.pp.se





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.