IOS Rookit: the sky isn't falling (yet)

Thu May 29 13:47:50 UTC 2008

On May 29, 2008, at 9:37 AM, Jim Wise wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Thu, 29 May 2008, Fred Reimer wrote:
>
>> plaintext (the IOS code) and the hash.  It is not trivial to be  
>> able to
>> make changes in the code and maintain the same hash value, but  
>> there has
>> been at least limited success in doing so.
>
> Has there?  My understanding is that constructing a new image to match
> an existing MD5 checksum (vs. constructing two new images with  
> matching
> MD5 checksums) was still not feasible.  Did I miss something?

	I think the point here is that most (read: average) consumers don't  
verify the md5/sha1/gpg/pgp signatures of the binaries they run.  If  
that was the case, we wouldn't have problems quite as bad as we do  
today.

>> It may not be possible to replace the boot ROM, because presumably  
>> the new
>> hardware would check the ROM code hash before loading it and also
>> presumably the ROM code does not have quite as much text messages  
>> that can
>> be changed to generate the same hash value, thereby bypassing the  
>> security
>> checks.
>
> This may be an obvious question, but given that the code which  
> verifies an
> IOS image would (presumably) be part of the boot ROM, where would  
> you put
> the code which verifies the boot ROM?  What does it mean to say `the
> hardware' should check the boot ROM?

I agree with you here.  Cisco even ships methods to do a field-upgrade  
of the rommon on a variety of platforms and linecards.  There are  
numerous challenges when talking about how to prevent these types of  
updates.  I could imagine a case where you leverage the current  
'phlashing' stuff to "brick" your router rommon so it won't boot.   
Once again it gets to the how do you obtain an exploit path to perform  
these actions on the device?  I always have said physical access =  
"root".  Perhaps the path is that oob modem?  You need to think about  
these things, but unless you have a mission dealing with state secrets  
or your corporate IP (not the protocol) guys treat everything like it  
is (eg: pharmaceutical companies), you're likely to not notice the  
router in the closet has a 2 year old bogon filter list installed.

	- Jared