Dive Brief:
-
The process of installing rogue firmware on embedded devices appears to be gaining popularity among hackers.
-
Cisco Systems issued an advisory on Tuesday warning customers of cases where attackers have replaced the boot firmware on devices running its IOS operating system.
- Hackers use valid administrative credentials to conduct the attacks, Cisco said.
Dive Insight:
To conduct the attacks, hackers are replacing the ROM Monitor (ROMMON) — the low-level firmware that initializes the hardware and boots up IOS (which runs on most Cisco routers and offers a set of networking tools) — with a malicious version. It’s not yet clear how hackers are obtaining the administrative credentials used to carry out the attacks.
“No product vulnerability is leveraged in this attack, and the attacker requires valid administrative credentials or physical access to the system to be successful,” Cisco said in its advisory. “The ability to install an upgraded ROMMON image on IOS devices is a standard, documented feature that administrators use to manage their networks.”
Cisco said the attacks should serve as a warning for companies with IOS equipment that network administrators can be a target.
