Bug hunter unveils Cisco zero

Looks can be deceiving when a security researcher first studies a piece of code.

Looks can be deceiving when a security researcher first studies a piece of code.

What might seem mundane or straightforward on the surface — an insecure log-in page, for example — can lead to unexpected results when a security practitioner digs deeper. Without humans scanning for vulnerabilities, bugs are left to fester, and can be exploited to cause real issues if they fall into the wrong hands.

That lesson lingers in Ken Pyle’s mind.

During a security test for a client last year, Pyle, a partner at the security company DFDR Consulting, examined a networking switch made by Cisco. The equipment is popular with small businesses, including the managed service providers that handle remote connections, because it allows organizations to administer multiple devices across a network.

What started as a simple web application vulnerability, upon closer inspection, turned out to be two previously-unreported flaws affecting hundreds of thousands of devices, according to Pyle, from routers and printers to cable modems. One bug is a denial-of-service vulnerability that a hacker could use to take the switches, and the networks that rely on them, offline. Another flaw could reveal sensitive information about a switch’s configuration.

Cisco issued patches for the issues on Jan. 29, and the Department of Homeland Security has urged enterprises to apply those fixes.

“Someone else should’ve found this before I did,” Pyle told CyberScoop after presenting his research at ShmooCon, one of the few Washington, D.C., area conferences where attendees with neon-colored hair outnumber those wearing suits.

His presentation on the multiple vulnerabilities he found in Cisco devices served as a call to action for companies to use human researchers, rather than automated scanners, to search for possible security issues. In Pyle’s telling, human curiosity leads to the kind of creative threat hunting for which machines aren’t designed.

“None of this ever shows up on a vulnerability scanner,” Pyle told ShmooCon attendees. “This is stuff you’ve got to find by hand and start poking at.”

As his research progressed, Pyle realized that the Cisco switches were running on a web server called GoAhead, which is used by multiple companies. Some of the same issues Pyle found in the Cisco equipment were also present in Dell and Netgear switches.

A Dell spokesperson told CyberScoop the company is investigating the issues raised in Pyle’s presentation.

“[Y]ou can take over the arteries and veins of networks pretty easily” using the vulnerabilities, Pyle mused.

The level of exposure that organizations have to the attacks outlined by Pyle is entirely up to them.

“The ability to patch these things in real time is really slow because nobody wants to shut their network down,” Pyle said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure