IOS Rookit: the sky isn't falling (yet)

Alexander Harrowell a.harrowell at gmail.com
Tue May 27 12:42:23 UTC 2008


>An alternative rootkit ? Privilege level 16 used by the Lawful Intercept
>[12] feature could be abused to do some of this too. Or the other way
>around: use a "patched" IOS to keep an eye on Law Enforcement's >operations
on the router as privilege level 15 doesn't allow it and the only
>alternative is to sniff the traffic export.

The combination of rootkits and specially privileged Lawful Intercept
functions is a very dangerous one. This was precisely what was exploited in
the now-legendary and still unsolved Vodafone Greece hack.

Alex



More information about the NANOG mailing list