Cisco flaw enables 'simulated' DDoS attack

Powered by SC Magazine
 

Patch Cisco routers immediately, expert warns.

Cisco has released a patch for IOS, the company's network operating system, to fix a flaw that could have allowed a remote attacker to shut down Cisco routers, simulating a distributed denial of service (DDoS) attack.

Ty Miller, chief technical officer at Pure Hacking, said the most recent IOS flaw was in Cisco's Border Gateway Protocol (BGP), which tells the router where to redirect traffic. By exploiting the flaw remotely, he said, criminals could recreate the effect of a DDoS attack, without requiring an army of zombie computers for assistance.

"It is a DDoS attack that caused the BGP service to forget where it is supposed to redirect traffic. You should be able to exploit it instead of using a botnet army -- you should be able to use just a few packets instead of flooding the network," Miller said.

DDoS attacks flood a company's network with a multitude of requests, which effectively slows the network to a crawl. Or in some instances forces the network to completely fall over, such was the case for Twitter and Facebook recently.

Miller said the prevalence of Cisco routers means a large number of companies will be affected and he advises companies to patch routers as soon as possible.

However, he said, by exploiting this flaw, although criminals would be able to effectively shut affected routers, they would not be able to steal corporate information.

"If I was vulnerable, I would be patching it straight away to protect myself. At this stage it is only a denial of service attack, which means they are not going to get any access to your systems or compromise your network.

"It is likely the flaw will be around for some time as companies generally do not like to update their router's OS," he said. 


Cisco flaw enables 'simulated' DDoS attack
 
 
 
Top Stories
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
The CISO’s dilemma: Do you trust your partner’s partner?
[Blog post] How far down the chain do you check?
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 317

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  57%
 
No
  43%
TOTAL VOTES: 121

Vote