Dozens of successful attacks detected that install malicious code on company portals.
Attackers are infecting a widely used virtual private network product sold by Cisco Systems to install backdoors that collect user names and passwords used to log in to corporate networks, security researchers said.
A researcher from security firm Volexity told Ars that he’s aware of about a dozen attacks successfully infecting Cisco’s Clientless SSL VPN, but he said he suspects the total number of hacks is higher. The attacks appear to be carried out by multiple parties using at least two separate entry points. Once the backdoor is in place, it may operate unnoticed for months as it collects credentials that employees enter as they log in to company networks.
The Clientless SSL VPN is a virtual private network product that works with Cisco’s Adaptive Security Appliance. Once users have authenticated themselves, the Web-based VPN allows employees to access internal webpages and internal file shares plus launch plug-ins that allow them to connect to other internal resources through telnet, SSH, or similar network protocols.
“This is certainly not a resource to which you want an attacker to gain access,” Volexity researchers wrote in a blog post published Wednesday. “Unfortunately, Volexity has found that several organizations are silently being victimized through this very login page.”
The report comes a month after researchers from a separate firm detected active and highly clandestine attacks hitting networks routers that Cisco sells to customers. The router backdoors have been installed on at least 79 devices in 19 countries, including on 25 boxes hosted by a US-based ISP. The full-featured SYNful Knock malware supports as many as 100 modules that give attackers remote control over infected devices.
The backdoor installed on the Cisco VPNs, by contrast, is significantly less developed. It consists of malicious JavaScript code that gets loaded into webpages that employees use when logging in. The attack is hard to detect because the JavaScript is hosted on external websites and accessed through HTTPS-encrypted connections. The code differs from infection to infection, but generally it looks something like this script.
Volexity researchers said the backdoor is installed through at least two different entry points. The first is a critical vulnerability in the Clientless SSL VPN that Cisco patched more than 12 months ago. The other infection method relies on attackers gaining administrator access through other means and using it to load the malicious code.
Infected organizations include think tanks, universities and academic institutions, multinational electronics manufacturers, and non-governmental organizations. To evade detection, the malicious JavaScript in some cases has been hosted on the compromised site of a non-governmental organization and is called though an HTML iframe tag inserted into the webpage of the compromised VPN. The VPN, in turn, connects to the compromised NGO site and downloads the JavaScript over an encrypted connection.
The attention on infections hitting Cisco products may lead some people to think that the company’s networking gear is somehow an easier target than competing wares. There’s no evidence to support such a conclusion. If Cisco hardware and software are being successfully infected, it’s a fair bet that the same thing is happening industry wide. A Cisco spokesperson said officials are aware of the Volexity report and thanked researchers for bringing awareness to the patches the company released last year. The official said that Cisco customers can also protect themselves from such threats by following these Firewall best practices.
The Volexity blog post has several suggestions for detecting and removing the VPN infections. Since the backdoors are easily missed by antivirus programs, intrusion prevention systems, and other security measures, administrators should take the time to check their gear periodically for signs of compromise.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
