170
this post was submitted on 28 Sep 2023
170 points (97.8% liked)
Technology
58431 readers
4426 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is the best summary I could come up with:
The threat actor is somehow gaining administrator credentials to network devices used by subsidiaries and using that control to install malicious firmware that can be triggered with “magic packets” to perform specific tasks.
In an advisory of its own, Cisco said the threat actors are compromising the devices after acquiring administrative credentials and that there’s no indication they are exploiting vulnerabilities.
Cisco also said that the hacker’s ability to install malicious firmware exists only for older company products.
Newer ones are equipped with secure boot capabilities that prevent them from running unauthorized firmware, the company said.
BlackTech members use the modified firmware to override code in the legitimate firmware to add the SSH backdoor, bypass logging, and monitor incoming traffic for “magic packets.” The term refers to small chunks of data the attackers send to the infected routers.
While they appear random and innocuous in system logs, these packets allow the attackers to surreptitiously enable or disable the backdoor functionality.
The original article contains 522 words, the summary contains 160 words. Saved 69%. I'm a bot and I'm open source!