Vulnerable Router Services

Fri, 26 Feb 2016 | Wide Area Networks

• Disable unnecessary services and interfaces (BOOTP, CDP, FTP, TFTP, NTP, PAD, and TCP/UDP minor services)

• Disable commonly configured management services (SNMP, HTTP, and DNS)

• Ensure path integrity (ICMP redirects and IP source routing)

• Disable probes and scans (finger, ICMP unreachables, and ICMP mask replies)

• Ensure terminal access security (ident and TCP keepalives)

• Disable gratuitous and proxy ARP

• Disable IP directed broadcast

The services listed in the figure have been chosen for their vulnerability to malicious exploitation. These are the router services most likely to be used in network attacks. For ease of learning, they have been grouped as follows:

■ Unnecessary services and interfaces:

— Router interfaces: Limit unauthorized access to the router and the network by disabling unused open router interfaces.

— BOOTP server: This service is enabled by default. This service allows a router to act as a BOOTP server for other routers. This service is rarely required and should be disabled.

— Cisco Discovery Protocol (CDP): This service is enabled by default. CDP is used primarily to obtain protocol addresses of neighboring Cisco devices and discover the platforms of those devices. CDP can also be used to show information about the interfaces your router uses. CDP is media- and protocol-independent, and runs on most Cisco-manufactured equipment, including routers, bridges, access servers, switches, and IP phones. If not required, this service should be disabled globally or on a per-interface basis.

— Configuration auto-loading: This service is disabled by default. Auto-loading of configuration files from a network server should remain disabled when not in use by the router.

— FTP server: This service is disabled by default. The FTP server enables you to use your router as an FTP server for FTP client requests. Because it allows access to certain files in the router Flash memory, this service should be disabled when it is not required.

— TFTP server: This service is disabled by default. The TFTP server enables you to use your router as a TFTP server for TFTP clients. This service should be disabled when it is not in use because it allows access to certain files in the router Flash memory.

— Network Time Protocol (NTP) service: This service is disabled by default. When enabled, the router acts as a time server for other network devices. If configured insecurely, NTP can be used to corrupt the router clock and potentially the clock of other devices that learn time from the router. Correct time is essential for setting proper time stamps for IPsec encryption services, log data, and diagnostic and security alerts. If this service is used, restrict which devices have access to NTP. Disable this service when it is not required.

— Packet assembler and disassembler (PAD) service: This service is enabled by default. The PAD service allows access to X.25 PAD commands when forwarding X.25 packets. This service should be explicitly disabled when not in use.

— TCP and User Datagram Protocol (UDP) minor services: These services are enabled in Cisco IOS software releases prior to Cisco IOS software Release 11.3 and disabled in Cisco IOS software Release 11.3 and later. The minor services are provided by small servers (daemons) running in the router. They are potentially useful for diagnostics, but are rarely used. Disable these services.

— Maintenance Operation Protocol (MOP) service: This service is enabled on most Ethernet interfaces. MOP is a Digital Equipment Corporation (DEC) maintenance protocol that should be explicitly disabled when it is not in use.

■ Commonly configured management services:

— Simple Network Management Protocol (SNMP): This service is enabled by default. The SNMP service allows the router to respond to remote SNMP queries and configuration requests. If required, restrict which SNMP systems have access to the router SNMP agent and use SNMP version 3 whenever possible because this version offers secure communication not available in earlier versions of SNMP. Disable this service when it is not required.

— HTTP configuration and monitoring: The default setting for this service is Cisco device dependent. This service allows the router to be monitored or have its configuration modified from a web browser via an application such as the Cisco Security Device Manager (SDM). You should disable this service if it is not required. If this service is required, restrict access to the router HTTP service using access control lists (ACLs).

— Domain Name System (DNS): This client service is enabled by default. By default, Cisco routers broadcast name requests to 255.255.255.255. Restrict this service by disabling it when it is not required. If the DNS lookup service is required, make sure that you set the DNS server address explicitly.

■ Path integrity mechanisms:

— ICMP redirects: This service is enabled by default. ICMP redirects cause the router to send ICMP redirect messages whenever the router is forced to resend a packet through the same interface on which it was received. This information can be used by attackers to redirect packets to an untrusted device. This service should be disabled when not required.

Implementing Secure Converged Wide Area Networks (ISCW) v1.0

5-54

— IP source routing: This service is enabled by default. The IP protocol supports source routing options that allow the sender of an IP datagram to control the route that a datagram will take toward its ultimate destination, and generally the route that any reply will take. These options can be exploited by an attacker to bypass the intended routing path and security of the network. Also, some older IP implementations do not process source-routed packets properly, and it may be possible to crash machines running these implementations by sending datagrams with source routing options. Disable this service when it is not required.

■ Features related to probes and scans:

— Finger service: This service is enabled by default. The finger protocol (port 79) allows users throughout the network to get a list of the users currently using a particular device. The information displayed includes the processes running on the system, the line number, connection name, idle time, and terminal location. This information is provided through the Cisco IOS software show users EXEC command. Unauthorized persons can use this information for reconnaissance attacks. Disable this service when it is not required.

— ICMP unreachable notifications: This service is enabled by default. This service notifies senders of invalid destination IP networks or specific IP addresses. This information can be used to map networks and should be explicitly disabled on interfaces to untrusted networks.

— ICMP mask reply: This service is disabled by default. When enabled, this service tells the router to respond to ICMP mask requests by sending ICMP mask reply messages containing the interface IP address mask. This information can be used to map the network, and this service should be explicitly disabled on interfaces to untrusted networks.

■ Terminal access security:

— IP identification service: This service is enabled by default. The identification protocol (specified in RFC 1413) reports the identity of a TCP connection initiator to the receiving host. This data can be used by an attacker to gather information about your network, and this service should be explicitly disabled.

— TCP keepalives: This service is disabled by default. TCP keepalives help "clean up" TCP connections where a remote host has rebooted or otherwise stopped processing TCP traffic. Keepalives should be enabled globally to manage TCP connections and prevent certain DoS attacks.

■ Gratuitous and proxy Address Resolution Protocol (ARP):

— Gratuitous ARP: This service is enabled by default. Gratuitous ARP is the main mechanism used in ARP poisoning attacks. You should disable gratuitous ARPs on each router interface unless this service is otherwise needed.

— Proxy ARP: This service is enabled by default. This feature configures the router to act as a proxy for Layer 2 address resolution. This service should be disabled unless the router is being used as a LAN bridge.

■ IP directed broadcast: This service is enabled in Cisco IOS software releases prior to

Cisco IOS software Release 12.0 and disabled in Cisco IOS software Release 12.0 or later.

IP directed broadcasts are used in the common and popular smurf denial of service (DoS)

attack and other related attacks. This service should be disabled when not required.

Cisco Certified Expert

» Wide Area Networks