Re: IOS Rookit: the sky isn't falling (yet)

[Jared Mauch]

On May 29, 2008, at 9:37 AM, Jim Wise wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 29 May 2008, Fred Reimer wrote:

plaintext (the IOS code) and the hash.  It is not trivial to be  
able to
make changes in the code and maintain the same hash value, but  
there has
been at least limited success in doing so.

Has there?  My understanding is that constructing a new image to match
an existing MD5 checksum (vs. constructing two new images with  
matching
MD5 checksums) was still not feasible.  Did I miss something?

	I think the point here is that most (read: average) consumers don't  
verify the md5/sha1/gpg/pgp signatures of the binaries they run.  If  
that was the case, we wouldn't have problems quite as bad as we do  
today.

It may not be possible to replace the boot ROM, because presumably  
the new
hardware would check the ROM code hash before loading it and also
presumably the ROM code does not have quite as much text messages  
that can
be changed to generate the same hash value, thereby bypassing the  
security
checks.

This may be an obvious question, but given that the code which  
verifies an
IOS image would (presumably) be part of the boot ROM, where would  
you put
the code which verifies the boot ROM?  What does it mean to say `the
hardware' should check the boot ROM?

I agree with you here.  Cisco even ships methods to do a field-upgrade  
of the rommon on a variety of platforms and linecards.  There are  
numerous challenges when talking about how to prevent these types of  
updates.  I could imagine a case where you leverage the current  
'phlashing' stuff to "brick" your router rommon so it won't boot.   
Once again it gets to the how do you obtain an exploit path to perform  
these actions on the device?  I always have said physical access =  
"root".  Perhaps the path is that oob modem?  You need to think about  
these things, but unless you have a mission dealing with state secrets  
or your corporate IP (not the protocol) guys treat everything like it  
is (eg: pharmaceutical companies), you're likely to not notice the  
router in the closet has a 2 year old bogon filter list installed.

        - Jared