# MA-634.092016: MyCERT Alert - The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

**Date:** 09 Sep 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-634.092016  
**Advisory ID:** MA-634.092016

---

**1.0     Introduction**
The advancing capabilities of organized hacker groups and cyber adversaries create an increasing global threat to information systems. The rising threat levels place more demands on security personnel and network administrators to protect information systems. Protecting the network infrastructure is critical to preserve the confidentiality, integrity, and availability of communication and services across an enterprise.
To address threats to network infrastructure devices, this Alert provides information on recent vectors of attack that advanced persistent threat (APT) actors are targeting, along with prevention and mitigation recommendations.
**2.0     Impact**
These updates address if network infrastructure is compromised could potentially allow an attacker to gain full control of the network infrastructure enabling further compromise of other types of devices and data and allowing traffic to be redirected, changed, or denied. Possibilities of manipulation include denial-of-service, data theft, or unauthorized changes to the data.
**3.0     Affected Products**
Network Infrastructure Devices such as routers, firewall, switches, load-balancers, intrusion detection systems, etc.
**4.0     Recommendation**
MyCERT highly recommend administrators to ensure proper configuration and control of network devices : â€¨
**4.1 Proliferation of Threats to Information Systems**
- SYNful Knock
Detail info:
[http://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices](http://www.cisco.com/c/en/us/about/security-center/event-response/synf)
- Cisco Adaptive Security Appliance (ASA)
Detail info :
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141008-asa>
**4.2 Solution4.2.1 Segregate Networks and Functions**
- Physical Separation of Sensitive Information
Recommendations:
- Implement Principles of Least Privilege and need-to-know when designing network segments.
- Separate sensitive information and security requirements into network segments.
- Apply security recommendations and secure configurations to all network segments and network layers.
- Virtual Separation of Sensitive Information
Recommendations:
- Use Private Virtual LANs to isolate a user from the rest of the broadcast domains.
- Use Virtual Routing and Forwarding (VRF) technology to segment network traffic over multiple routing tables simultaneously on a single router.
- Use VPNs to securely extend a host/network by tunneling through public or private networks.
**4.2.2 Limit Unnecessary Lateral Communications**
> Recommendations:
>
> - Restrict communications using host-based firewall rules to deny the flow of packets from other hosts in the network. The firewall rules can be created to filter on a host device, user, program, or IP address to limit access from services and systems.
> - Implement a VLAN Access Control List (VACL), a filter that controls access to/from VLANs. VACL filters should be created to deny packets the ability to flow to other VLANs.
> - Logically segregate the network using physical or virtual separation allowing network administrators to isolate critical devices onto network segments.
**4.2.3 Harden Network Device**
> Recommendations:
>
> - Disable unencrypted remote admin protocols used to manage network infrastructure (e.g., Telnet, FTP).
> - Disable unnecessary services (e.g. discovery protocols, source routing, HTTP, SNMP, BOOTP).
> - Use SNMPv3 (or subsequent version) but do not use SNMP community strings.
> - Secure access to the console, auxiliary, and VTY lines.
> - Implement robust password policies and use the strongest password encryption available.
> - Protect router/switch by controlling access lists for remote administration.
> - Restrict physical access to routers/switches.
> - Backup configurations and store offline. Use the latest version of the network device operating system and update with all patches.
> - Periodically test security configurations against security requirements.
> - Protect configuration files with encryption and/or access controls when sending them electronically and when they are stored and backed up.
**4.2.4 Secure Access to Infrastructure Devices**
> Recommendations:
>
> - Implement Multi-Factor Authentication
> - Manage Privileged Access
> - Manage Administrative Credentials
**4.2.5 Perform Out-of-Band Management**
> Recommendations:
>
> - Segregate standard network traffic from management traffic.
> - Enforce that management traffic on devices only comes from the OoB.
> - Apply encryption to all management channels.
> - Encrypt all remote access to infrastructure devices such as terminal or dial-in servers.
> - Manage all administrative functions from a dedicated host (fully patched) over a secure channel, preferably on the OoB.
> - Harden network management devices by testing patches, turning off unnecessary services on routers and switches, and enforcing strong password policies. Monitor the network and review logs Implement access controls that only permit required administrative or management services (SNMP, NTP SSH, FTP, TFTP).
**4.2.6 Validate Integrity of Hardware and Software**
> Recommendations:
>
> - Maintain strict control of the supply chain; purchase only from authorized resellers.
> - Require resellers to implement a supply chain integrity check to validate hardware and software authenticity.
> - Inspect the device for signs of tampering.
> - Validate serial numbers from multiple sources.
> - Download software, updates, patches, and upgrades from validated sources.
> - Perform hash verification and compare values against the vendor’s database to detect unauthorized modification to the firmware.
> - Monitor and log devices, verifying network configurations of devices on a regular schedule.
> - Train network owners, administrators, and procurement personnel to increase awareness of grey market devices.
â€¨Generally, MyCERT advises the administrators to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#2f4c564d4a5d1616166f4c564d4a5d5c4a4c5a5d465b56014256) or [[email protected]](/cdn-cgi/l/email-protection#2a4753494f585e6a4753494f585e0445584d044753) â€¨
Phone : 1-300-88-2999 (monitored during business hours)â€¨
Fax : +603 89453442 â€¨
Handphone : +60 19 2665850 (24x7 call incident reporting)â€¨
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888â€¨
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYTâ€¨
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
> - The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations:
>   <https://www.us-cert.gov/ncas/alerts/TA16-250A>
> - Cisco Event Response: SYNful Knock Malware:
>   <http://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html>
> - Evolution of attacks on Cisco IOS devices:
>   <https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices>