While developers around the world are discovering potential sue cases for blockchain technology, security analysts have disclosed multiple SSH key vulnerabilities plaguing Cisco’s network security virtual appliances. Exploiting these vulnerabilities could give hackers unlimited access to these virtual appliances.
Also read Popular Android Apps Vulnerable to HTTPS Bug, More Education on Technology Needed?
Cisco’s Two SSH Vulnerabilities
Cisco is one the world’s leading companies as far as networking capabilities is concerned. With most of our technology taking on a cloud platform allure, Cisco has developed network security virtual appliances for different use cases. However, an SSH vulnerability was discovered, because virtual machines running on VMWare and KVM virtualization platforms share a default authorized SSH key.
Originally, these pre-authorized SSH keys were intended for “customer support” level of access only. However, if these keys were to be used for malicious purposes, they will grant an intruder unlimited access and control. Services affected include Cisco Web Security Virtual Appliance, Email Security Virtual Appliance, and Security Management Virtual Appliance.
On June 25, Cisco released an advisory on the SSH vulnerability, which stated:
“IP address connectivity to the management interface on the affected platform is the only requirement for the products to be exposed to this vulnerability. No additional configuration is required for this vulnerability to be exploited.”
In saying so, Cisco admits that an attacker would only need to obtain one type of SSH key from any of their virtual appliances. Once that SSH key has been obtained, the attacker can access any [unpatched] virtual appliance reachable over the internet, regardless of its location or purpose.
To make matters even worse, a second SSH vulnerability was discovered shortly afterwards. The aforementioned virtual appliances are vulnerable due to a “pre-installed set of SSH host keys that allow access to communication secured by those keys.” These pre-installed SSH host keys are put in place to protect appliance-to-appliance communication.
“Because all deployments of WSAv or ESAv use the same set of default SSH host keys, accessing any of the private keys on a single deployment could allow an attacker to decrypt communication on WSAv, ESAv, or SMAv. An attacker with possession of compromised keys, who is able to intercept traffic between the WSAv or ESAv and a host it is communicating with, would be able to decrypt the communication with a man-in-the-middle attack.”
Security Remains Key, In Both Old & New Technology
Bitcoin and blockchain technology are often scrutinized for their lack of security. But these security vulnerabilities on Cisco virtual appliances are a strong indication that security is always a concern, f or both old and new technology. Plus, these vulnerabilities give blockchain developers a new idea for a use case of this disruptive technology to improve the security features we use to this very day.
What are your thoughts on these Cisco SSH vulnerabilities? Let us know in the comments below!
Source: Ars Technica
Images courtesy of Cisco