IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Cisco customers targeted using leaked NSA hacking tools

Networking giant says there isn’t a workaround for the issue

Man typing code on a laptop

Hackers have targeted some Cisco customers using a new vulnerability found thanks to leaked NSA cyber tools.

The tools were released in August by a hacker group dubbed ShadowBrokers and are confirmed to belong to the Equation Group which has strong ties with the NSA. It is the second such vulnerability to be found by Cisco as a result of the data dump made by the hackers; Cisco has already fixed a flaw in the SNMP implementation in its ASA firewalls.

Cisco has warned its customers that all versions of its IOS, IOS XE and IOS XR software are vulnerable to one of the many exploits released on August 15. The networking firm hasn't revealed which of its customers may have already been breached but the issue impacts firewalls, routers and switches made by the firm, enabling hackers to get hold of critical and confidential information from its customers.

"The vulnerability is due to insufficient condition checks in the part of the code that handles IKEv1 security negotiation requests. An attacker could exploit this vulnerability by sending a crafted IKEv1 packet to an affected device configured to accept IKEv1 security negotiation requests," the firm said in a security advisory blog.

But despite stating that its incident response team was aware of exploitation of the vulnerabilities of those customers running affected platforms, Cisco hasn't yet developed a patch for the flaw and has said no workarounds are available. Instead, it has released IPS signatures and Snort rules to mitigate the risks for its customers.

The exploit is called BENIGNCERTAIN and is made up of three binaries, each of which can be exploited to obtain RSA private key data and VPN configuration details if used against Cisco PIX firewalls.

Cisco isn't the only networking company to have exploits revealed. The ShadowBrokers data dump included exploits for Juniper and Fortinet, amongst others.

French Caldwell, former Gartner fellow and chief evangelist at GRC apps company MetricStream, warned other spy agencies particularly the other Five Eyes members that they too are vulnerable to a similar hack.

"If the NSA was hacked, the chances that they too have been targeted are certainly more than 50-50," he said.

Featured Resources

Big data for finance

How to leverage big data analytics and AI in the finance sector

Free Download

Ten critical factors for cloud analytics success

Cloud-native, intelligent, and automated data management strategies to accelerate time to value and ROI

Free Download

Remove barriers and reconnect with your customers

The $260 billion dollar friction problem businesses don't know they have

Free Download

The future of work is already here. Now’s the time to secure it.

Robust security to protect and enable your business

Free Download

Recommended

Escape the ransomware maze
Whitepaper

Escape the ransomware maze

23 Aug 2022
Twilio account breach result of sophisticated social engineering campaign
Security

Twilio account breach result of sophisticated social engineering campaign

9 Aug 2022
Over 200,000 DrayTek routers vulnerable to total device takeover
Security

Over 200,000 DrayTek routers vulnerable to total device takeover

3 Aug 2022
Data on 69 million Neopets users stolen and listed for sale on hacker forum
Security

Data on 69 million Neopets users stolen and listed for sale on hacker forum

21 Jul 2022

Most Popular

Why collaboration is key to digital transformation
Sponsored

Why collaboration is key to digital transformation

13 Sep 2022
Anonymous hacks Iranian government and state broadcasters
cyber attacks

Anonymous hacks Iranian government and state broadcasters

22 Sep 2022
What your hybrid workforce needs from their laptops
Advertisement Feature

What your hybrid workforce needs from their laptops

21 Sep 2022