Re: Router worm exploiting poor SNMP security.

["Charles C. Lindsay" <lindsay () MAIL TOPLAYER COM>]

> > The only apparent and widely exploitable way to do this is to replace the
> > firmware. While not trivial, this is doable. Existing firmware already
> > supports sending SNMP packets, we only need change the data and type.

Assuming of course that the download isn't checked for a crypt sig.
Of course, that means that somewhere in the running code, however
disguised, is a key, and to change keys you have to follow a trail of
firmware updates... you obviously can't depend on being able to access
a "known site" for "known good" sigs...


--
Charles C. Lindsay            TopLayer Networks, Inc.         508-870-1300 x147
lindsay () TopLayer com "Perfecting the Art of Network Security"  508-870-9797 FAX
                     2400 Computer Drive, Westboro, MA  01581