Now, it's Cisco's turn (at least for its older hardware).

[L&LD]

Backdoored firmware lets China state hackers control routers with “magic packets”

The modified firmware used by BlackTech is hard to detect.

arstechnica.com

The only thing we know for sure is that we don't know anything for sure.

 

[drinkingbird]

Backdoored firmware lets China state hackers control routers with “magic packets”

The modified firmware used by BlackTech is hard to detect.

arstechnica.com

The only thing we know for sure is that we don't know anything for sure.

I mean if your corporate network is in a position for someone to gain admin access to your router remotely, and not detect the reboot when the IOS is changed, you've got bigger issues.

It's funny that one of their recommendations is to disable outbound telnet/ssh connections (pretty standard practice) - if they have admin access, they can turn that right back on.....

 

[Tech9]

I know one of the threat actors. The article is talking about Field Upgradeable ROMMON Integrity test. @Viktor Jaep is involved here...

 

[OzarkEdge]

It's funny that one of their recommendations is to disable outbound telnet/ssh connections (pretty standard practice)

Another...

"In particular, highly prioritize replacing all end-of-life and unsupported equipment as soon as possible."

OE

 

[Viktor Jaep]

I know one of the threat actors. The article is talking about Field Upgradeable ROMMON Integrity test. @Viktor Jaep is involved here...

Nah. Great name though!!

 

[Tech9]

Just in case - don’t touch my RV320. Thank you. WAN IP 192.168.132.100.

 

[Viktor Jaep]

Just in case - don’t touch my RV320. Thank you. WAN IP 192.168.132.100.

Dude you are totally getting hacked now after providing your private WAN IP! lol

 

[coxhaus]

This is very vague with the only issue being they are gaining admin privileges and going from there using old hardware and code that is not upgraded. Hardware needs to be replaced when it has reached EOL.

• There is no indication that any Cisco vulnerabilities were exploited. Attackers used compromised credentials to perform administrative-level configuration and software changes.
• Modern Cisco devices include secure boot capabilities, which do not allow the loading and executing of modified software images. For more information on secure boot, see the Cisco Trustworthy Technologies Data Sheet.
• The stolen code-signing certificates mentioned in the report are not from Cisco. Cisco does not have any knowledge of code-signing certificates being stolen to perform any attack against Cisco infrastructure devices.