Cisco IOS Flaw and Worm Potential

At this past week's Blackhat Briefings in Las Vegas, Michael Lynn gave a detailed presentation on how to reliably exploit Cisco IOS-based devices (ie routers). For some background on this, read Security researcher causes furor by releasing flaw in Cisco Systems IOS, by Victor R. Garza, posted on 28 July 2005, and this blog post by Matt Webb. Lynn's presentation is akin to Shok's piece on reliable Windows-based heap overflow exploits from some years ago. The trick in successful exploitation on the IOS device is to fool the OS into thinking that it doesn't need to crash the system when it detects memory corruption. This has traditionally been the bane of anyone wanting to exploit an IOS device, because the system would often reboot after an attack, creating a Denial of Service (DoS) condition. Lynn's presentation has the possibility to change that.

In my research on wormability, I found a number of IOS exploits which were listed as DoS conditions because of this. Because of this, IOS devices have rarely been considered for successful worms when used with memory corruption attacks (ie stack or heap overflows). This may now change, and future IOS overflows may be stronger candidates for worms. Lynn noted this, as well:

Later in his presentation, Lynn theorized that a worm using just this type of flaw could be written and create a "digital Pearl Harbor" effectively disabling the Internet globally. Mentioning that corporations utilizing other routers may state that they would be unaffected by such a flaw, should it be utilized, were not being reasonable as those same routers would ultimately be connected to Cisco hardware and thereby effected.

Source: Security researcher causes furor by releasing flaw in Cisco Systems IOS, Victor R. Garza, 28 Jul 2005, posted to SearchSecurity.com.

So, do I think we'll see an IOS worm in the near future? Probably not, if only because of the difficulty in getting the values right for all of the different IOS version and hardware combinations (a micro-diversity situation, if you will). This should make it difficult for one piece of software to migrate from router to router. Instead, I expect we'll see pointed, directed attacks using these techniques. Now, this doesn't mean that some smart attacker could come along and use a worm to successfully spread on IOS devices, I just think it's unlikely given past events and demonstrated capabilities and interests.

With respect to the specific vulnerability involved in this research, it requires link-local access with respect to the router. Very few people have that kind of access to arbitrary vulnerable routers, which helps to mitigate the potential for any such worm.