Cisco security flaw impacts critical SA infrastructure

r00igev@@r said:
+1
I liked cockpit for a while but had to move back to cli because it hasn't weaned itself off iptables and network manager is a dog's breakfast.
Click to expand...
Feck.

I made a typo. I meant to type WebFig, not WebMin :X3:
 
PhireSide said:
Feck.

I made a typo. I meant to type WebFig, not WebMin :X3:
Click to expand...
Well, Webmin sucks worse than Webfig and I haven't used it since 2009. What can I say, I used it when I first tried some Linux stuff and it was also the last year I renewed my MCSE.

Also use Winbox but exposing that on the Internet is just dom. I help guys out because its basically iptables.

If you manage Mikrotiks take a look at https://www.mikrocloud.com/ Written by a South African and secures management of your Mikrotik for mahala.
 
r00igev@@r said:
The 4548 never had SSH - only telnet. Never put the management interface on the Internet though!
Click to expand...
Ja, but that is an enterprise switch, and besides it harks from the day when real men pulled real copper wire when the boss wanted another LAN. The edge router's LAN port was configured with a crossover cable to ensure that no-one installed a switch between the edge router and the FW.

Mystic Twilight said:
The italics are there for a reason :laugh:.
Real REAL men use the serial port.
Click to expand...
I get you.
They also don't forget to disable CDP, and never, ever enable automatic routing protocols on stub networks.
 
So our company's labs have been running a lot of scans for this.

Unfortunately results are often skewed because there's honeypots popping up like nobody's business. Cisco Talos' method for detection also needs work, because it assumes a certain length in the results will indicate possible compromise but there's a lot of webservers out there answering rubbish on any request and that rubbish is short enough or equal to the length needed to be a possible compromise.

Also a big bunch of IP blocks supposedly belonging to ZA are returning a string of chinese characters as the only response to a request on port 80/443. Odd behavior but its triggering false-positives too.
 
RonSwanson said:
Ja, but that is an enterprise switch, and besides it harks from the day when real men pulled real copper wire when the boss wanted another LAN. The edge router's LAN port was configured with a crossover cable to ensure that no-one installed a switch between the edge router and the FW.


I get you.
They also don't forget to disable CDP, and never, ever enable automatic routing protocols on stub networks.
Click to expand...
LLDP is most useful in a network. No reason to block it. Stupid idea. Like blocking ICMP.
 
neoprema said:
So our company's labs have been running a lot of scans for this.

Unfortunately results are often skewed because there's honeypots popping up like nobody's business. Cisco Talos' method for detection also needs work, because it assumes a certain length in the results will indicate possible compromise but there's a lot of webservers out there answering rubbish on any request and that rubbish is short enough or equal to the length needed to be a possible compromise.

Also a big bunch of IP blocks supposedly belonging to ZA are returning a string of chinese characters as the only response to a request on port 80/443. Odd behavior but its triggering false-positives too.
Click to expand...
What are you IPs?
Excellent idea to send back 四 四 on port 80.
 
r00igev@@r said:
LLDP is most useful in a network. No reason to block it. Stupid idea. Like blocking ICMP.
Click to expand...
CDP only has utility in very specific scenarios. The vast majority of enterprise networks (that have proper change control) do not need it.
 
RonSwanson said:
CDP only has utility in very specific scenarios. The vast majority of enterprise networks (that have proper change control) do not need it.
Click to expand...
Show me one enterprise network that has a real time updated topology diagram and I'll eat my vellies.

They so obfuscated they don't know how their own networks are interconnected and as a result lateral movement over an extended period occurs.

Patented Gartner Magic Quadrant recommendations below:

Code: 
function haveibeenhacked(TRUE) { echo "FOCUS error: No visibility on layer 2 or layer 3}
function diagnose() { result="Blame the network"; return result }
function callISP() { fix(Plug_Ethernet_Into_ONT); result="Best effort"; return result }

operations=/enterprise/network

while true do
   readfile()

   for i in operations do
       readline()

       if [ ! ICMP || ! LLDP ] then
              if [ haveibeenhacked() ] then
                    if [ diagnose() == "Blame the network" ] then
                        fix(Create_any_any_rule_in_firewall)
                    fi
                    callISP()

              fi

       fi

done
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X