It is a fact that older networks, developing over years, suffer not only capability issues as new services become available, but may have been built without using best practice. Our Network Audit service can advise on where future problems may occur, and where existing networks may develop issues (such as lack of firmware patching and upgrades; EOL equipment and hardware no longer supportable by vendor). Producing a design review document, our engineering teams consider availability, reliability, resilience, security, performance, and ease of management.

As part of our Audit service, we are often asked to validate 3^rd party work, particularly by public sector bodies. There can be the feeling that a scope of works delivered by a 3^rd party may not have followed Cisco Best Practice or has been configured inefficiently resulting in such things as QoS (Quality of Service) issues. There may be network issues or problems relating to certification, such as PCI DSS or ISO, or licensing; whatever the concerns we can objectively and impartially validate work and signpost areas for attention, as well as giving recommendation for remedial work – which we can also undertake if required. We can also act as your technical lead should you need, under contractual obligations, to use a 3^rd party for your ongoing support and remediation.

Cisco offer 5 levels of Cisco Network Certifications, Entry, Associate, Professional, Expert and Architect. The most common certifications are at the Associate, Professional and Expert levels and are the level of Engineer most commonly used by 4CornerNetworks. Each level of Certification has a specialised area of expertise (commonly known as a track) for example – CCNA Security is an Associate level certification, with a specialisation/track in Security.

Associate Level Certifications

What is a CCNA? CCNA = Cisco Certified Network Associate
The CCNA Certification demonstrates the competency of an Engineer in Network Installation, Operations and Troubleshooting. CCNA level Engineers are also known as Cisco SMARTHands as they are the boots on the ground who carry rack and stack physical Cisco equipment including installations, deployments and basic upgrades.

CCNA Specialisations:

• CCNA Cloud
• CCNA Collaboration
• CCNA Cyber Ops
• CCNA Data Centre
• CCNA Industrial
• CCNA Routing and Switching
• CCNA Security
• CCNA Service Provider
• CCNA Wireless

Professional Level Certifications:

What is a CCNP? CCNP = Cisco Certified Network Professional
The CCNP Certification demonstrates a more advanced level of competency in Networking Skills. CCNP is suitable for System Administrators, or those who work with (LAN/WAN) infrastructure. A CCNP Certification can only be achieved once an Engineer has gained the CCNA Certification.

CCNP Specialisations:

• CCNP Specialisations:
• CCNP Cloud
• CCNP Collaboration
• CCNP Data Centre
• CCNP Routing and Switching
• CCNP Security
• CCNP Service Provider
• CCNP Wireless

Professional Level Certifications:

What is a CCIE? CCIE = Cisco Certified Internetwork Expert
The CCIE Certification is known as the most prestigious worldwide with an estimated 3% of all Cisco Engineers obtaining a CCIE Certification. The CCIE demonstrates the skills of Network Engineers to Plan, Operate and Troubleshoot complex, converged network infrastructures on a wide variety of Cisco equipment.

CCIE Specialisations:

• CCIE Collaboration
• CCIE Data Centre
• CCIE Routing and Switching
• CCIE Security
• CCIE Service Provider
• CCIE Wireless

Cisco/Meraki Wireless Networks

Wireless networks facilitate business in the modern world. Generally, they allow us wi-fi coverage no matter where they are situated. However, one downside is that many production networks perform at sub-optimal level.

Common problems include:

• Issues with roaming
• Slow upload and download speeds
• Areas with zero or limited coverage
• Areas whereby if there are too many users (clients) you get kicked off the network?
• External radio interference

This does not mean that you need a new network – simply that your existing configuration might need some attention. To respond to this, we have put together a team of specialist engineers who can assist you by giving your WiFi a health check. This includes validation of what is already in place as well as troubleshooting problems and looking at new network requirements.

We also handle WiFi installations from greenfield site to office moves, cable deployment to delivery and validation reporting. If you want to ensure that your WiFi is giving you ‘best performance’ then why not call us and we can evaluate your business needs.

We also offer and AI Driven WiFi Automation Toll that will allow our team, or indeed your own IT Team, to proactively monitor and resolve issues. This can also identify cause of network performance issues up to 30 days prior to reporting. This is a tool that operates 24/7/365 and can save days of troubleshooting on poorly performing WiFi networks.

Partner with 4CornerNetworks to give your WiFi the best performance

Foreword:

The FMC (Firepower Management Center) has a critical vulnerability in the web-based management interface that allows unauthenticated remote attacker to bypass authentication and get admin privileges that allows the attacker to run arbitrary code.

The vulnerability is due to bad handling of LDAP responses when the latter is being used for External Authentication. The bad actor can run the exploit by creating a crafted HTTP requests effectively bypassing authentication and getting administrative privileged access to the Web GUI. To break this down – anybody with HTTPS access to the management IP of your current FMC and some skills would be able to get in and change config or stop the Firepower Sensors, effectively compromising your security controls and leaving you exposed.

Who is affected:

Currently all unpatched FMC versions that use LDAP for external authentication are affected.

External authentication via LDAP is very common for Firepower clients due to the fact that Firepower is preferred choice for mid and large organization that tend to use central AAA to run its network (better security and scalability).

If you are running FMC and have LDAP enabled (how to check if you are using LDAP is mentioned inside the listed Cisco Advisory link), it is strongly recommended to patch the FMC as soon as possible.

How can we mitigate the risk before we patch?

Stop LDAP if possible, make sure you have a working local account before that.

Limit the HTTPS access to the management IP address of the FMC to only secure internal networks/addresses.

External sources:

Used materials:

Foreword:

Microsoft RDP protocol is one of the main focuses of bad actors in these days. There are reports for numerous successful breaches in small and medium sized organizations with heavy use of RDP from outside. The reasons for that is the protocol has security flaws, this article will cover the latest of them, but also most of the time it was setup some time ago and the authentication for it is weak which means it is prone to brute-force-attacks. Most modern IPS do not catch RDP based brute-force-attacks without any additional tuning or professional SoC, none of which is usually present or indeed a priority in small and mid-sized business due to costs.

New vulnerability, CVE-2019-0708, was found in the “remote desktop services” component built into supported versions of Windows, including Windows 7, Windows Server 2008 R2, and Windows Server 2008.

It also is present in older versions such as Windows XP and Windows 2003, operating systems for which Microsoft long ago stopped shipping security updates, but they are still frequently in use within organizations.

Microsoft director of incident response Simon Pope described the vulnerability with the following: “While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware,”

This vulnerability is marked as critical because of its nature – the vulnerability is at the pre-authentication level with means that strong credentials do not help, and it virtually requires NO user intervention. Also, the vulnerability in question is marked as wormable, which means when an exploit is created it can easily be incorporated into more complex malware and be used to automatically try to exploit and spread vertically inside an organization with RDP enabled and unpatched, quite similar to WannaCry EternalBlue SMB exploit. This scenario makes up for a potentially fast and wide spread malware.

Microsoft released 16 updates on the 19th of May targeting at least 79 security holes in Windows and related software — nearly a quarter of them earning Microsoft’s most dire “critical” rating. Critical bugs are those that can be exploited by malware or bad actors to break into vulnerable systems remotely, without any help from users.

Vulnerable products:

Windows 7, Windows Server 2008 R2, and Windows Server 2008, Windows XP and older versions of Windows

Non-vulnerable products:

Windows 10, Windows 8.1, Windows 8, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012.

How does the attack work?

The attackers send a large number of very small requests from a high-bandwidth pipe behind ISP(s), that allow ip spoofing, destined at a large list of publicly accessible application servers. The attacker is spoofing the source IP on all these requests to the target public IP address. All servers are made to respond with much larger packets to the requests, wrongfully directing all that traffic towards the unsuspecting target. The idea is to cripple either the target server/device or to congest its internet pipe, both causing Denial of Service.

How to protect yourself:

If any of the three components outlined above is not available, then there is no way to perform a successful Amplification attack.

Simple steps can make a bit difference.

1. First never use or allow open to everyone RDP access from outside. Check your current Firewall settings for allowing RDP connections from ANY on the outside. Use alternative access into your organization via corporate Remote VPN with 2 Form-factor authentication.
2. Disable unused applications.
3. If application needs to be used make sure it regularly patched and has all security updates
4. Have a second layer of security – up to date endpoint protection, advanced network threat protection to stop the spread in case of breach
5. Backup your servers and valuable data regularly – this would help you recover of problem in case the security updates/patches break something or in case of a breach (ransomware or destruction of information).

Used materials:

https://krebsonsecurity.com/2019/05/microsoft-patches-wormable-flaw-in-windows-xp-7-and-windows-2003/

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708

Foreword:

At the end of Oct, Cisco announced a vulnerability in its ASA OS and Firepower FTP running products.

The vulnerability is based on the SIP inspection code that handles SIP signaling packets.

The vulnerability:

The FW do inspection on protocols for various reasons, NAT fixup, added security, discovery of dynamic port connections and allowing traffic to pass via the firewall etc. The SIP inspection is part of the default Global Inspection Policy that is enabled on the device, meaning all firewalls with default configuration for inspection are affected.

A bombardment of a high-rate specifically crafted SIP requests can impact the firewall (high CPU load) and cause legitimate traffic to cease hence causing a Denial of Service.

There is currently no software updates from Cisco to address this vulnerability. All mitigation options are based on additional configuration and listed below

Affected Products:

• Vulnerable Products

This vulnerability affects Cisco ASA Software Release 9.4 and later and Cisco FTD Software Release 6.0 and later on both physical and virtual appliances if SIP inspection is enabled and the software is running on any of the following Cisco products. Worth noticing is that SIP inspection is enabled by default

• 3000 Series Industrial Security Appliance (ISA)
• ASA 5500-X Series Next-Generation Firewalls
• ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
• Adaptive Security Virtual Appliance (ASAv)
• Firepower 2100 Series Security Appliance
• Firepower 4100 Series Security Appliance
• Firepower 9300 ASA Security Module
• FTD Virtual (FTDv)

NOTE: Older (EOL) Cisco ASA 5500 series are NOT affected (due to older code). Also the Virtual ASA (ASA 1000V) is not affected

Determining if your product is vulnerable:

Check your current running software versions

For ASA:

ciscoasa# show version | include Version

If version is above 8.4 then it is vulnerable

For Firepower FTD:

> show version

If version is above 6.0 then it is vulnerable

Is my firewall under attack?

During an active attack you will be able to see large number of connections coming to your firewall on port 5060 (traditional SIP port and the one the Cisco devices are listening to in order to perform the inspection).

The following command will show the current SIP connections, they will be listed as incomplete as the source of the DoS only actively bombards the firewall without closing the SIP connection.

show conn port 5060

Another useful command is:

show processes cpu-usage non-zero sorted

This will show you the current cpu usage per process. Typical high CPU values will be observed during the attack. A continuous exploit of this vulnerability will cause continues high-CPU and could cause the device to crash and reload itself

Another indicator of compromise for this attack is a sudden reload after a network slowdown and the presence of a crashfile

show crashinfo

After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread

Workaround (Mitigation):

There are several options, all limiting the allowance of these SIP packets to reach or overwhelm the device

1. Disable SIP inspection

Have SIP inspection only if you are actively using it. Our experience with SIP inspection is that usually it is not required (not all customers are doing SIP trunks from inside the organization to a IP Telephony provider in the cloud). Even if SIP is in use, most SIP providers would actively ask you to disable the SIP inspection as Cisco is slow on updating it comparing to how fast SIP protocol changes. SIP providers would ask you just to open specific port ranges and not rely on this inspection due to multiple reasons.

To disable SIP inspection, configure the following:

For Cisco ASA Software
policy-map global_policy
class inspection_default
no inspect sip

For Cisco FTD Software Releases
configure inspection sip disable

Note: This command is issued from the FTD CLI.

2. Actively block IP address(es) of the attackers

You can always actively block (by ACL) the offending IP address that you are seeing via the show conn port 5060. You need also to clear the existing connection issuing clear conn address

Other option is the old shun command that blocks all traffic from certain source IP

shun

This does not survice a reload

3. Filter out based on the SIP attributes

Most observed attacks use an SIP attribute of Sent-by Address that is set to 0.0.0.0. That is not typical behavior for a valid SIP communication, the attack can also be confirmed by doing a packet capture and noticing the amount of packets arriving from a SIP address you are not expecting. You can read the packet captures, check for the Sent-by address and if values are set to 0.0.0.0 and previous methods of mitigation are not valid for your environment then you can proceed and implement this change

regex VIAHEADER "0.0.0.0"

policy-map type inspect sip P1
parameters
match message-path regex VIAHEADER
drop

policy-map global_policy
class inspection_default
no inspect sip
inspect sip P1

4. Rate limit all SIP traffic

Not a great option as that could also influence legitimate traffic, however SIP is the signaling protocol for setting up voip connections, so in nature it should not be very chatty.

You can use the Cisco MPF (Modular Policy Framework) to create a policy and match the SIP traffic and then set a rate limit on this traffic so it would not cause the high cpu spike. Configuration can vary here, so it needs to be done by an expert on product or an external capable consultant.

Resources:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181031-asaftd-sip-dos

https://www.theregister.co.uk/2018/11/02/cisco_sip_warning/

New vulnerability discovered in Cisco ASA, ASAx and Firepower devices

A new vulnerability was publicly announced last Friday (22th of June). It effects all current Cisco ASA devices (all models) and Firepower appliances (please see full list below).

It allows a remote attacker to execute a DoS (Denial-Of-Service) attack towards the vulnerable device and potentially extract sensitive data from the device (credential usernames and active sessions). It exploits the HTTP(S) service on the devices and uses directory traversal to try to gather sensitive data and potential reload the device. The vulnerability is possible due to lack of proper input validation of the HTTP URLs.

The discovery was made by a Polish Security researcher named Michal Bentkowski and was initially shared only with Cisco, giving time for Cisco to prepare patches and updates to its software. There have already been real-life attempts in exploiting this vulnerability due its lack of complexity and how easy it is to do it – there is already a couple of scripts on the internet to automate the process (see links below). Cisco states there is no work-around for this problem and all its customers are urged to upgrade to the patched software that Cisco has released prior to the unveiling of the vulnerability.

How to check if your devices are vulnerable:

If you have not patched your devices since the 22th of June and are using ASDM/CSM or Anyconnect on a publicly facing interface then it is very likely you are affected.

Simple steps to validate if your devices are vulnerable

1. Check if your devices is listening on SSL ports

 ciscoasa# show asp table socket | include SSL|DTLS

Look for open sockets on public facing interfaces

2. Check for presence of a process called Unicorn Proxy Thread, if this process is present, your device is considered vulnerable

ciscoasa# show processes | include Unicorn

Mwe 0x0000557f9f5bafc0 0x00007f62de5a90a8 0x0000557fa52b50a0

 3632 0x00007f62c8c87030 30704/32768 Unicorn Proxy Thread 218

Look for open sockets on public facing interfaces

Affected models:

• 3000 Series Industrial Security Appliance (ISA)
• ASA 1000V Cloud Firewall
• ASA 5500 Series Adaptive Security Appliances
• ASA 5500-X Series Next-Generation Firewalls
• ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
• Adaptive Security Virtual Appliance (ASAv)
• Firepower 2100 and 4100 Series Security Appliance
• Firepower 9300 ASA Security Module
• FTD Virtual (FTDv)

Fixed Releases:

Customers should upgrade to an appropriate release as indicated in the following tables.

Cisco ASA Software

Cisco FTD Software

Related articles:

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd
• https://www.helpnetsecurity.com/2018/06/26/cisco-asa-firepower-flaw/
• https://milo2012.wordpress.com/2018/06/21/cve-2018-0296-script-to-extract-usernames-from-cisco-asa-devices/
• https://www.bleepingcomputer.com/news/security/cisco-asa-flaw-exploited-in-the-wild-after-publication-of-two-pocs/

If  you would like any help or guidance please contact www.4cornernetworks.com today.

Foreword:

Malware has evolved so much in recent years and the trend is to keep evolving with ever increasing pace. Traditional Firewalls that use old technologies such as stateful firewalling are not capable of detecting / preventing most of the modern threats. The restricted use of traditional firewalls to lower the attack surface is not sufficient and not effective anymore. Vulnerabilities get discovered every day, many of them critical, server administrators often lack the required knowledge to protect/patch their devices. Endpoints (desktops/laptops/smartphones) are constantly at risk due to the fact bad “actors” are constantly coming up with clever ways to bypass traditional defenses and deliver malware, quite often exploiting the weakest link (the users), companies cannot cope with training users in the field of IT security quick enough.

Before, now and future

It is obvious that additional security on the network layer is mandatory. But the controls that are to be used must meet certain criteria, they must be what the industry call Next-Generation Firewall, meaning the device should be able to identify users, applications, do advanced threat protection using different methods (signatures, reputation, sandboxing) and provide detailed reports/logs for pro-active and reactive (forensics) purposes. All current high-end vendors on the market provide this Next-Gen FW capability. Cisco has done something very clever, it decided many years ago (after the purchase of Sourcefire) that it would integrate the Sourcefire functionality into its Firewall technology and is dominating the market with its next generation ASA products. The result was a very flexible solution, albeit a bit cumbersome to configure. The client has the option to enable just the ASA functionality and hence have only a stateful Firewall, or also add the advanced Sourcefire Next-Gen FW capabilities. Cisco even sells all current devices (the 5500 X series) with a built in Firepower (Cisco rebranded Sourcefire into Firepower) capability. A significant number of customers are actively replacing the older ASAs with new X series ones. Many without enabling the Firepower capability. As mentioned briefly above, the reasons for this decision vary but the main one was the added complexity and the separate management that the Firepower needed. This translates into added cost, as usually these skills are not available internally and had to be sourced from outside consulting companies. Also, the Firepower product cannot just be configured and forgotten about but needs small adjustments and manual intervention from time to time, again adding to the operational costs.

With more customers adopting and embracing the Firepower solution, the solution has matured, especially after the introduction of Firepower 6.1. Installation, integration and support have become more user friendly. Which meant operational costs have reduced significantly. Transition between pure ASA and ASA + Firepower was streamlined and could be done within days and without any downtime for the customer. A small investment in purchasing the licenses for Firepower, as customers already had the hardware, and the additional consulting services could in fact be the difference between a secure network and a compromised one. We all know that this is a very bad and expensive experience. This investment made would immediately start to pay off and ensure a completely different way of securing your network that cannot be compared to the archaic traditional firewalls. In the future Cisco and many other vendors will completely get remove stateful only Firewall devices. Cisco is going to replace all ASA with the new appliances capable of running a united operating system – the Firepower Threat Defense. The switch to this is inevitable, so there are no benefits whatsoever for waiting. The work for the transition/migration must be done and the sooner the better. Simply put, there is more protection and security provided to all resources behind the Firewall.

Conclusion:

We urge to our customers not to wait until it is too late. Don’t be reactive to a compromised network, take the initiative today and avoid the inevitable.

If you already have the ASA X series deployed there are just a few simple steps to attain all the benefits from the most advanced Intrusion Prevention system at the moment.

Why wait? Contact 4CornerNetworks today to discuss.

https://4cornernetworks.com/contact/

The Russia bear is having a snack out of Ukraine it seems but also more than 100 other countries are involved. Cisco devices are NOT vulnerable but for me that is a valuable marketing as it shows the value of actually having a nice vendor and not a cheap one.

→ https://blog.talosintelligence.com/2018/05/VPNFilter.html

Foreword:

On the 29th of March a company that deals with security in embedded devices, called Embedi published their discovery about a critical vulnerability in most Cisco Switch devices (both running IOS and XE).

The vulnerability (CVE-2018-0171) is based on stack buffer overflow and is possible due to improper validation of packet data in Smart Install Client, a plug-and-play configuration and image-management feature that helps administrators to deploy (client) network switches easily. The service is running on TCP 4786, opened by default and listening when service is enabled (which is by default).

Yet again a new functionality that is meant for easier deployment and potential less operational costs during deployment poses a serious security risk. The vulnerability is deemed as critical because it gives complete access to the device or be used to do a DoS on the device, meaning it can crash the device. What makes the case even worse is that the Smart Install Client functionality is enabled by default.

Initially researchers believed that the vulnerability could only be used for attacks inside an enterprise network due to the communication ports usually not exposed to the Internet or to the fact that many of switch or other devices are only internal, because in a securely configured networks because the recommendation is that Smart Install technology participants should not be accessible through the Internet.

However during a short scan of the Internet, researchers detected over 250,000 vulnerable devices and 8,5 million devices that have a vulnerable port open.

Which Cisco devices are affected:

The vulnerability was proven to work on the following devices: Catalyst 4500 Supervisor Engines, Cisco Catalyst 3850 Series Switches, and Cisco Catalyst 2960 Series Switches.

• Cisco Catalyst 4500 Supervisor Engine 6L-E
  • Cisco IOS 15.2.2E6 (Latest, Suggested)
    • cat4500e-entservicesk9-mz.152-2.E6.bin (23-DEC-2016)
• Cisco Catalyst 2960-48TT-L Switch
  • Cisco IOS 12.2(55)SE11 (Suggested)
    • c2960-lanbasek9-mz.122-55.SE11.bin (18-AUG-2016)
  • Cisco IOS 15.0.2-SE10a (Latest)
    • c2960-lanbasek9-mz.150-2.SE10a.bin (10-NOV-2016)
• Cisco Catalyst 3850-24P-E Switch
  • Cisco IOS-XE 03.03.05.SE
    • cat3k_caa-universalk9.SPA.03.03.05.SE.150-1.EZ5.bin (03-NOV-2014)

And here are all devices that may fall into the Smart Install Client type and can be considered potentially vulnerable:

• Catalyst 4500 Supervisor Engines
• Catalyst 3850 Series
• Catalyst 3750 Series
• Catalyst 3650 Series
• Catalyst 3560 Series
• Catalyst 2960 Series
• Catalyst 2975 Series
• IE 2000
• IE 3000
• IE 3010
• IE 4000
• IE 4010
• IE 5000
• SM-ES2 SKUs
• SM-ES3 SKUs
• NME-16ES-1G-P
• SM-X-ES3 SKUs

Cisco’s reaction:

The original researchers reached Cisco with their finding before going public with it and the vendor had enough time to patch their software. Official releases after March have been patches against the vulnerability and available for download.

How does the attack work?

The attackers send a large number of very small requests from a high-bandwidth pipe behind ISP(s), that allow ip spoofing, destined at a large list of publicly accessible application servers. The attacker is spoofing the source IP on all these requests to the target public IP address. All servers are made to respond with much larger packets to the requests, wrongfully directing all that traffic towards the unsuspecting target. The idea is to cripple either the target server/device or to congest its internet pipe, both causing Denial of Service.

How to determine if your device is affected:

Issue the following command:

show vstack config

If the output shows that SmartInstall is enabled then proceed with the checks

Check your current running software versions

show version

Use a Cisco official tool to check the vulnerabilities on your Cisco IOS/XE via the following link:

https://tools.cisco.com/security/center/softwarechecker.x

General recommendations:

• Do not expose unnecessary any communication channels (services/ports) to unsecure networks such as the internet. Keep your devices behind firewalls in order to reduce the potential attack service.
• Remember to patch your systems regularly

Resources:

https://thehackernews.com/2018/04/cisco-switches-hacking.html

https://embedi.com/blog/cisco-smart-install-remote-code-execution/

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2