nanog mailing list archives
Re: Is my router owned? How would I know?
From: Mikael Abrahamsson <swmike () swm pp se>
Date: Thu, 12 Jan 2006 23:09:53 +0100 (CET)
On Thu, 12 Jan 2006, Rob Thomas wrote:
If there are new or changed SNMP RW community strings, look out!
If you have any SNMP v1/v2 RW communities what so ever, you're likely to be owned, at least if they're common to several units in your network and you don't limit what part of the tree the RW communities can access.
Seems like a common attack vector is to send SNMP WRITE and upload the router configuration to a hacked tftp server, and then iterate thru the network as a lot of people have a single SNMP WRITE community in their network.
-- Mikael Abrahamsson email: swmike () swm pp se
Current thread:
- Re: Cisco, haven't we learned anything? (technician reset), (continued)
- Message not available
- Re: Cisco, haven't we learned anything? (technician reset) Rob Thomas (Jan 12)
- Re: Cisco, haven't we learned anything? (technician reset) Jared Mauch (Jan 12)
- RE: Cisco, haven't we learned anything? (technician reset) Scott Morris (Jan 12)
- Re: Cisco, haven't we learned anything? (technician reset) Martin Hannigan (Jan 12)
- Is my router owned? How would I know? Rob Thomas (Jan 12)
- Re: Is my router owned? How would I know? goemon (Jan 12)
- Re: Is my router owned? How would I know? Florian Weimer (Jan 12)
- Re: Is my router owned? How would I know? Martin Hannigan (Jan 12)
- Re: Is my router owned? How would I know? Christopher L. Morrow (Jan 12)
- Re: Is my router owned? How would I know? Joseph S D Yao (Jan 13)
- Re: Is my router owned? How would I know? Mikael Abrahamsson (Jan 12)
- Re: Is my router owned? How would I know? Alexei Roudnev (Jan 14)
- Re: Is my router owned? How would I know? Mikael Abrahamsson (Jan 14)
- Re: Is my router owned? How would I know? Alexei Roudnev (Jan 14)
- Re: Cisco, haven't we learned anything? (technician reset) Brett Frankenberger (Jan 12)
- Re: Cisco, haven't we learned anything? (technician reset) John Kinsella (Jan 12)
- Re: Cisco, haven't we learned anything? (technician reset) william(at)elan.net (Jan 12)
- Re: Cisco, haven't we learned anything? (technician reset) Jay Hennigan (Jan 12)