Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Security China

Backdoored Firmware Lets China State Hackers Control Routers With 'Magic Packets' (arstechnica.com) 52

An anonymous reader quotes a report from Ars Technica: Hackers backed by the Chinese government are planting malware into routers that provides long-lasting and undetectable backdoor access to the networks of multinational companies in the US and Japan, governments in both countries said Wednesday. The hacking group, tracked under names including BlackTech, Palmerworm, Temp.Overboard, Circuit Panda, and Radio Panda, has been operating since at least 2010, a joint advisory published by government entities in the US and Japan reported. The group has a history of targeting public organizations and private companies in the US and East Asia. The threat actor is somehow gaining administrator credentials to network devices used by subsidiaries and using that control to install malicious firmware that can be triggered with "magic packets" to perform specific tasks.

The hackers then use control of those devices to infiltrate networks of companies that have trusted relationships with the breached subsidiaries. "Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network," officials wrote in Wednesday's advisory. "To extend their foothold across an organization, BlackTech actors target branch routers -- typically smaller appliances used at remote branch offices to connect to a corporate headquarters -- and then abuse the trusted relationship of the branch routers within the corporate network being targeted. BlackTech actors then use the compromised public-facing branch routers as part of their infrastructure for proxying traffic, blending in with corporate network traffic, and pivoting to other victims on the same corporate network."

Most of Wednesday's advisory referred to routers sold by Cisco. In an advisory of its own, Cisco said the threat actors are compromising the devices after acquiring administrative credentials and that there's no indication they are exploiting vulnerabilities. Cisco also said that the hacker's ability to install malicious firmware exists only for older company products. Newer ones are equipped with secure boot capabilities that prevent them from running unauthorized firmware, the company said.
"It would be trivial for the BlackTech actors to modify values in their backdoors that would render specific signatures of this router backdoor obsolete," the advisory stated. "For more robust detection, network defenders should monitor network devices for unauthorized downloads of bootloaders and firmware images and reboots. Network defenders should also monitor for unusual traffic destined to the router, including SSH."

To detect and mitigate this threat, the advisory recommends administrators disable outbound connections on virtual teletype (VTY) lines, monitor inbound and outbound connections, block unauthorized outbound connections, restrict administration service access, upgrade to secure boot-capable devices, change compromised passwords, review network device logs, and monitor firmware changes for unauthorized alterations.

Ars Technica notes: "The advisory didn't provide any indicators of compromise that admins can use to determine if they have been targeted or infected."
This discussion has been archived. No new comments can be posted.

Backdoored Firmware Lets China State Hackers Control Routers With 'Magic Packets'

Comments Filter:
  • by Brain-Fu ( 1274756 ) on Wednesday September 27, 2023 @07:27PM (#63882187) Homepage Journal

    It is easy for government-backed actors to install backdoors in any foreign-made hardware, and cover it all up with government-issued gag orders. The only reasonable assumption is that anything foreign made is phoning home.

    Of course, made-in-America tech would be no better. It would just be the American government doing the spying. They have the means, motive, and opportunity, so it would be irrational for them not to.

    Private businesses do the same thing too. Our CPUs have backdoors baked right in to the hardware, for legitimate purposes of course. some info [sysjolt.com]. And the reason is the same. They have the means motive and opportunity, so that's that.

    Of course, most people don't care. Most people freely upload all kinds of sensitive information to their favorite social networks. Why would they care about China or AMD spying on their cat photos?

    Since the majority don't care, there is no pushback. Since there is no pushback, those of us who DO care are left powerless.

    No matter who wins, we lose.

    • This is why encryption helps a lot.
      Note that state actors are not too interested in cat photos but they are interested in what corporations are doing and gathering IP and other information from them.
      For example TSMC might be attracted to the US due to some tax break etc so China could offer them better (or visa versa.)

      With more and more data encrypted they just need to look for the weakest point to attack, I am no secruity expert but I think that the router may give up certain information but not give
      • by Z00L00K ( 682162 ) on Wednesday September 27, 2023 @10:26PM (#63882443) Homepage Journal

        I don't expect even encryption to help fully.

        There are so many holes that are known today in various kinds of equipment that a focused operation could get through given enough time and resources.

        Many companies also uses a proxy gateway where they re-package the encrypted https traffic so that they can scan for illegal stuff. The same can be done by malicious operators as well.

        • by AmiMoJo ( 196126 ) on Thursday September 28, 2023 @06:15AM (#63882897) Homepage Journal

          This is why End To End (E2E) encryption is important. While it's not unbreakable with a suitably massive supercomputer, it requires enough resources that bulk decryption of traffic is impossible. Any surveillance needs to be targeted.

          Scanning for illegal material has to be done in the app if E2E encryption is used, otherwise it's not E2E. Things like Skype do use an intermediary, they are not E2E. Look for apps that use the Signal protocol.

          • by Z00L00K ( 682162 )

            Unfortunately that's the problem today - how to detect that it's a real E2E encryption when the proxy emulated the certificate of the server you connect to. You'll only be able to see that if you inspect the complete certificate chain.

            • by AmiMoJo ( 196126 )

              What does the server have to do with it? The point of E2E is that you don't have to trust anything but the other client.

        • All in one devices such as Cisco SourceFire are truly terrifying.

          It generally is run as an edge device.

          It runs Linux and does depend on sk_buff which may be the worst code in history in terms of security. The endless opportunities available to perform kernel level buffer overflow attacks are scary. The kernel itself is pretty hardened by now, but if you check out driver source, it gets pretty bad. The Cisco UCS VIC drivers may be the most criminally awful code accepted into the kernel. If you can't identify
    • Re: (Score:2, Insightful)

      by christoban ( 3028573 )

      The U.S. government cannot force companies to do this, and even software companies who did some minimal version of this were found out and now no one wants to buy them, so the practice has all but disappeared. The best the U.S. government can do these days is get warrants, which requires due process.

      Sorry, but there is no equivalence here.

      Cue the conspiratorial nonsense.

      • They can, and do. Cisco and the NSA work closely together.

      • by myowntrueself ( 607117 ) on Thursday September 28, 2023 @01:09AM (#63882627)

        The U.S. government cannot force companies to do this, and even software companies who did some minimal version of this were found out and now no one wants to buy them, so the practice has all but disappeared. The best the U.S. government can do these days is get warrants, which requires due process.

        Sorry, but there is no equivalence here.

        Cue the conspiratorial nonsense.

        China must be so far ahead of the USA on this sort of thing. The USA, being the good guys, don't even have an offensive cyber capability.
        And if you believe that, can I interest you in some cryptocurrency?

      • by AmiMoJo ( 196126 )

        This is a backdoor in Cisco gear. The NSA is known to have malware targeting Cisco systems, thanks to Snowden.

        It seems likely that the NSA knew about this and didn't tell Cisco, but instead quietly exploited it. Then the Chinese security services found it too.

        In China they don't need exploits, they just ask for the data and the holder is obliged to hand it over. Exploits are only needed for foreign data, and conveniently other countries ripped out Huawei gear so they only need to target Cisco and other West

        • by chill ( 34294 )

          No, this isn't a hidden "back door" that NSA knows about. Access is gained via traditional methods to the network environment and the router. Think phishing, social engineering, etc. The normal stuff.

          Custom firmware code is a rare skill, but using stolen digital code signing certificates is the magic sauce. That's not really a back door, that's the front door with a stolen master key. The system is working as it is designed to, and doing it securely.

          • yeah, upon reading the article, I believe that much of this access is due to lazy SysAdmin's using default passwords and such. It boggles my mind how many people do not change the defaults in their network gear when installing!
        • Cisco is a defense contractor [defense.gov], the idea that they're not working hand in hand with the NSA to perform unconstitutional spying is an absurd fantasy. Even if they didn't want to, they could be forced to in the interest of national security, but the fact is that Cisco has always been sleazy AF.

      • by irving47 ( 73147 )

        Oh, honey...

    • Are you sure? That would mean that every computer on the internet could be accessed through a hardware backdoor in the CPU. Does AMD have all the codes? Is it an unpatched zero day? I believe you, most devices can be remotely accessed and controlled with the right tools, I'm not convinced that all of the processors are there. Intel's processors have a "High Assurance Platform" mode, the NSA uses it to secure their computers. If every processor has a key, who administers the lists of keys?
  • Lots of open source routing, switching, and firewall packages out there these days. I'm not saying they do what every Cisco router or switch can do, but they can do a helluva lot these days including distance vector or link state routing, NIDS, and captures all with good performance. There are also some systems which are old and yet still have no significant vulnerabilities. Getting and using proven but older gear might be a solution in some cases. Sure state actors can probably backdoor open source, too. I
    • by christoban ( 3028573 ) on Wednesday September 27, 2023 @09:02PM (#63882319)

      Huwawei has been caught several times installing tiny, hidden chips in their routers after export controls have inspected them. That's why no one not in bed with Xi buys infrastructure from Chinese companies anymore. Their entire economy is an arm of the CCP and their is no comparison to anything any democratic government is doing.

      • by Z00L00K ( 682162 )

        Unfortunately a lot of well-known equipment is made in China or countries controlled by China.

      • Their entire economy is an arm of the CCP and their is no comparison to anything any democratic government is doing.

        Is that why they're winning?

      • by AmiMoJo ( 196126 )

        No they haven't. There was some stuff printed in a few newspapers, but none of it was ever verified. In fact it looked extremely questionable, the chips in question not having enough connectivity to other devices to do anything use. If it was such a chip, it would have been easy to x-ray it, or decap it to see the die inside.

        Don't misunderstand me, Huawei is legally required to assist the Chinese government if it asks, but the whole "spy chip" thing was BS. A far more likely attack vector would be to do wha

  • Huawei sales figures must be fire. I'd be disappointed my tax dollars DIDN'T do this.
    • This isn't about Huawei and new devices, but about devices compromised after sale. And the summary gives Cisco as an example. So more likely Cisco devices with security holes are exploited by this group.

  • Who leaves any kind of admin access open to the internet? In a truly secure environment routers are only accessible at worst on VPN or at best from serial connections. Even if those serial connections are network accessible through another device at least it's one more layer of crap malicious actors have to get through.
    • But if an actor get access to your networked computer it wouldn't matter, to the router the one changing the firmware is local. Until the device reboots and kicks them off your network, but when it comes back he can just access the router directly, since that would be part of the change.

    • Who leaves any kind of admin access open to the internet?

      An administrator who's relying on a firewall, possibly "cloud based", which has been compromised.

  • by sinkskinkshrieks ( 6952954 ) on Wednesday September 27, 2023 @09:59PM (#63882391)
    The problem is getting the damn updates and feature packs. Forget it. Old Cisco shit specifically isn't going to be secure. Get an OPNsense or pfSense for home.
    • by AmiMoJo ( 196126 )

      It's a shame that Cisco gear can't be easily repurposed to run open source operating systems, although even then you would have issues with Cisco firmware being insecure.

      Fortunately for home/small office stuff there are good alternatives now. You can get x86 router boards on AliExpress that run Coreboot, and use an open source OS like OpenWRT or pfSense.

  • by thesjaakspoiler ( 4782965 ) on Wednesday September 27, 2023 @10:00PM (#63882393)

    Do you trust your Cisco router as much as your Huawei router?
    Snowden confirmed it :
    https://www.infoworld.com/arti... [infoworld.com]
    but it seems that Cisco themselves were also moonlighting as backdoor installers :
    https://www.tomshardware.com/n... [tomshardware.com]

    • ... And isn't it trivial to fake this news anyway?

    • It’s always so easy to start relationship when two people are in love, so I met my partner and we were both In love with each other or so I thought until I realized something wasn’t right, he was just so good to be true, so I searched online on how to spy on my husband’s phone without touching it then I saw spyhackelite I contacted him via spyhackelite @gmail com and he did a very good job, I was able to find out my partner was two timing, I felt so betrayed by him
  • I thought that we had to stay away from Huawei products. Now it seems that by using American routers we get to be spied all the same? And by both the Americans and the Chinese: through official spying programs by the former, and through security vulnerabilities by the latter.
  • If router manufacturers, could just make a hardware button (or switch) on the device that needed to be pressed (or set) when writing to the device. That way you needed someone on location to actually create these sort of backdoors.

    Sure, it would be an inconvenience for those sysadmins working from home, but do you want your sysadmins to be a threat actor from abroad?

  • I saw a YouTube video of a Microsoft presentation where they were talking about all the security they have on the Xbox One to prevent piracy and cheating. The Microsoft guy was talking about things like hardware level crypto, proper hardware level secure boot, full verification that every single byte of code running on the machine comes from a source that has been digitally signed by Microsoft

    Do vendors like Cisco produce devices that have that kind of strong security against unauthorized code execution eve

    • by chill ( 34294 )

      From the CISA advisory linked in the Ars article:

      The actors also use stolen code-signing certificates to sign the malicious payloads, which make them appear legitimate and therefore more difficult for security software to detect.

      That's the magic sauce right there. What you're describing from Microsoft all relies on the code signing certificate being 100% secure. That's what determines "authorized" versus "unauthorized" code. The rest all comes into play AFTER that, physical access or not. Lose that signing cert, and ANYTHING can magically become "authorized" and that wonderful security chain is now working FOR the bad actors, not against them.

      That's why the Solarwinds hack was so dev

  • by gweihir ( 88907 ) on Thursday September 28, 2023 @08:50AM (#63883137)

    Lets be real here: All the NSA has is better control over the press and over what gets reported.

  • say no more if they aren't blaming the Chinese for the NSA's action then the chinese are likely using an NSA \ orhte US 3 letter Agency 'feature'.
  • "For your support of the Uyghur ethnicity against the communist tyrants."

  • So just like US does.
  • Ok, without too much aluminum deflector beanie, how difficult would it be for a gigantic network equipment manufacturer with dubious CCP regime ties to just delivers a similar feature preloaded on hardware shipped to government agencies and US infrastructure?
    And how hard to hide or detect it?

If all else fails, lower your standards.

Working...