Cisco fixes critical IOS XE bug but malware crew way ahead of them

After a six-day wait, Cisco started rolling retired a spot for a captious bug that miscreants had exploited to instal implants successful thousands of devices. Alas, it seems, nan information results person been mixed since nan attackers sewage wise.

The flaw successful nan networking giant's IOS XE software, which allowed criminals to hijack thousands of Cisco switches and routers, first came to ray last Monday. On Friday, Cisco said it hoped to person a hole fresh connected Sunday, ruining nan play for galore admins. 

The bully news: Cisco kept its Sunday committedness and made disposable nan first fixed package release, 17.9.4a, pinch much updates to travel astatine a still undisclosed date.

The bad news: besides complete nan weekend, those who had been exploiting nan vulnerabilities upgraded nan implant to evade detection. New scanning methods show thousands of devices stay compromised.

On Monday, Cisco updated its information advisory to supply "enhanced guidance to observe nan beingness of nan implant, aft uncovering a caller version that hinders recognition of compromised systems," a spokesperson told The Register.

This guidance, besides updated successful Cisco Talos' blog astir nan exploit, includes a curl bid that tin place implant variants employing nan attackers' caller HTTP header checks.

As Cisco noted successful its original update, location were really two zero-days successful nan IOS XE software. Intruders first exploited CVE-2023-20198 to summation entree to nan devices and rumor a privilege 15 command, frankincense creating a normal section personification account.

Next, they exploited CVE-2023-20273, a bug successful nan web UI characteristic that allowed nan section personification to elevate privileges to root, constitute nan implant to nan record system, and hijack nan device.

The first fixed release, 17.9.4a, addresses some flaws, and updates for earlier versions will beryllium made available, according to Cisco.

As of Thursday, astir 36,541 Cisco devices had been compromised, according to vulnerability guidance outfit Censys. This was much than 5,000 little than nan time prior. 

And then, arsenic nan play hit, nan number of compromised devices plummeted to 1,200, according to onslaught aboveground guidance patient Onyphe, leaving information researchers scratching their heads arsenic to what happened.

Security patient Fox-IT, portion of nan NCC Group, says it has an answer: nan implant developers simply changed nan code. "We person observed that nan implant placed connected tens of thousands of Cisco devices has been altered to cheque for an Authorization HTTP header worth earlier responding," nan analysts xeeted connected Monday.

"This explains nan overmuch discussed plummet of identified compromised systems successful caller days," it continued. "Using a different fingerprinting method, Fox-IT identifies 37,890 Cisco devices that stay compromised."

The patient besides suggested companies that person had a Cisco IOS XE WebUI exposed to nan net execute a forensic triage, and released a scanning and discovery tool connected GitHub.

• After six days and thousands of pwned users, Cisco poised to spot IOS XE flaw
• Cisco's captious zero-day bug gets moreover worse – 'thousands' of IOS XE devices pwned
• Cisco zero-day bug allows router hijacking and is being actively exploited
• Routers person been rooted by Chinese spies, US and Japan warn

VulnCheck main exertion serviceman Jacob Baines told The Register that his patient altered its scanner to usage nan Fox-IT method, "and we are seeing fundamentally what we saw past week: thousands of implanted devices."

Baines said he's "surprised" nan attacker modified nan implant alternatively of abandoning nan campaign.

"Normally, erstwhile an attacker is caught, they spell quiet and revisit nan affected systems erstwhile nan particulate has settled," he said. "This attacker is attempting to support entree to implants that dozens of information companies now cognize exist. To me, it seems for illustration a crippled they can't win."

The updated implant appears to beryllium "a short-term fix," Baines said, adding that it will either allows nan criminals to "hold connected to nan systems for a fewer much days — and execute immoderate extremity — aliases conscionable a stop-gap until they tin insert a much stealthy implant." ®