[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[NANOG] IOS rootkits

Subject: [NANOG] IOS rootkits
From: fw at deneb.enyo.de (Florian Weimer)
Date: Sat, 17 May 2008 23:03:12 +0200
In-reply-to: <[email protected]> (Joel Jaeggli's message of "Sat, 17 May 2008 07:48:23 -0700")
References: <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]>

* Joel Jaeggli:

> The existence proof of a root kit does little if anything to change how 
> one protects and secures the control plane.

| Network administrators are not able to observe Lawful Intercept is
| enabled. No Lawful Intercept program messages or error messages are ever
| displayed on the console.

<http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/lawf_int.html>

This is a Sony-style rootkit, but it certainly demonstrate that the
concept is feasible (surprise).

Follow-Ups:
- [NANOG] IOS rootkits
  - From: jbates at brightok.net (Jack Bates)

References:
- [NANOG] IOS rootkits
  - From: fergdawg at netzero.net (Paul Ferguson)
- [NANOG] IOS rootkits
  - From: pauldotwall at gmail.com (Paul Wall)
- [NANOG] IOS rootkits
  - From: mmc at internode.com.au (Matthew Moyle-Croft)
- [NANOG] IOS rootkits
  - From: simon at slimey.org (Simon Lockhart)
- [NANOG] IOS rootkits
  - From: ge at linuxbox.org (Gadi Evron)
- [NANOG] IOS rootkits
  - From: mmc at internode.com.au (Matthew Moyle-Croft)
- [NANOG] IOS rootkits
  - From: mmc at internode.com.au (Matthew Moyle-Croft)
- [NANOG] IOS rootkits
  - From: ge at linuxbox.org (Gadi Evron)
- [NANOG] IOS rootkits
  - From: joelja at bogus.com (Joel Jaeggli)

Prev by Date: [NANOG] financing IRU purchase
Next by Date: [NANOG] IOS rootkits
Previous by thread: [NANOG] IOS rootkits
Next by thread: [NANOG] IOS rootkits
Index(es):
- Date
- Thread