Attackers Install Highly Persistent Malware Implants On Cisco Routers

itwbennett writes: Researchers from Mandiant have detected a real-world attack that has installed rogue firmware on Cisco business routers in four countries. The router implant, dubbed SYNful Knock, implements a backdoor password for privileged Telnet and console access and also listens for commands contained in specifically crafted TCP SYN packets — hence the name SYNful Knock. In the cases investigated by Mandiant the SYNful Knock implant was not deployed through a vulnerability, but most likely through default or stolen administrative credentials.

Comments

Re:'highly persistent'

[bobbied]

Hyperbole much?

Yes, we ALWAYS do, EVERY time, without fail and without exception.