Red Balloon Security, a leading embedded device security firm, has
discovered a high-risk vulnerability in Cisco’s secure boot process
which impacts a wide range of Cisco products in use among enterprise and
government networks, including routers, switches and firewalls.
The vulnerability, codenamed “Thrangrycat,” is caused by a series of
hardware design flaws within Cisco’s Trust Anchor module. First
commercially introduced in 2013, Cisco Trust Anchor module (TAm) is a
proprietary hardware security module that is used in a wide range of
Cisco products, including enterprise routers, switches and firewalls.
TAm is the root of trust that underpins all other Cisco security and
trustworthy computing mechanisms in these devices. The Thrangrycat
vulnerability allows an attacker to make persistent modification to the
Trust Anchor module via remote exploitation, thereby defeating the
secure boot process and invalidating Cisco’s chain of trust at its root.
While the flaws are based in hardware, Thrangrycat can be exploited
remotely without any need for physical access. Since the Thrangrycat
flaws reside within the hardware design, it is unlikely that any
software security patch will fully resolve the fundamental security
vulnerability.
“This is a significant security weakness which potentially exposes a
large number of corporate, government and even military networks to
remote attacks,” said Dr. Ang Cui, founder and chief scientist of Red
Balloon Security. “We’re talking about tens of millions of devices
potentially affected by this vulnerability, many of them located inside
of sensitive networks. These Cisco products form the backbone of secure
communications for these organizations, and yet we can exploit them to
permanently own their networks. Fixing this problem isn’t easy, because
to truly remediate it requires a physical replacement of the chip at the
heart of the Trust Anchor system. A firmware patch will help to offset
the risks, but it won’t completely eliminate them. This is the real
danger, and it will be difficult for companies, financial institutions
and government agencies to properly address this problem.”
Thrangrycat is remotely exploitable and provides attackers with a
reliable backdoor into highly secure networks, allowing them to bypass
even rigorous cybersecurity defenses in order to gain full and
persistent access inside the network. An attacker could remotely exploit
this vulnerability to intercept communications, steal or manipulate
data, install stealthy implants and carry out further attacks on other
connected devices. Red Balloon Security researchers have demonstrated
physical destruction of Cisco routers by leveraging Thrangrycat via
remote exploitation.
Red Balloon Security has been working closely with Cisco’s Product
Security Incident Response Team (PSIRT) to address this vulnerability,
and commends PSIRT for its fast and diligent response.
For more technical details about Thrangrycat, visit www.thrangrycat.com.
About Red Balloon Security
Founded in 2011, Red Balloon Security (www.redballoonsecurity.com)
is a leading cybersecurity provider and research firm that specializes
in the protection of all embedded devices regardless of industry. The
New York City-based company secures embedded systems with a suite of
host-based firmware security solutions that continuously monitor
critical elements of firmware and report indications of attempted
intrusions throughout runtime.
View source version on businesswire.com: https://www.businesswire.com/news/home/20190513005742/en/