{"id":51645,"date":"2023-04-27T01:19:00","date_gmt":"2023-04-27T01:19:00","guid":{"rendered":"https:\/\/www.networkworld.com\/article\/3694848\/your-decommissioned-routers-could-be-a-security-disaster.html#tk.rss_security"},"modified":"2023-04-27T01:19:00","modified_gmt":"2023-04-27T01:19:00","slug":"your-decommissioned-routers-could-be-a-security-disaster","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/your-decommissioned-routers-could-be-a-security-disaster\/","title":{"rendered":"Your decommissioned routers could be a security disaster"},"content":{"rendered":"
<\/div>\n

Here’s bad news: It’s easy to buy used enterprise routers that haven\u2019t been decommissioned properly and that still contain data about the organizations they were once connected to, including IPsec credentials, application lists, and cryptographic keys.<\/p>\n

\u201cThis leaves critical and sensitive configuration data from the original owner or operator
accessible to the purchaser and open to abuse,\u201d according to a white paper by Cameron Camp, security researcher, and Tony Anscombe, chief security evangelist, for security firm Eset (See: Discarded, not destroyed: Old routers reveal corporate secrets<\/a>).<\/p>\n

The pair bought 18 used routers and from them gleaned administrator passwords, maps of specific applications, data that would allow third-party access to other companies’ networks, and enough information to identify the enterprises that once used them.<\/p>\n

Often, they included network locations and some revealed cloud applications hosted in specific remote data centers<\/a>, \u201ccomplete with which ports or controlled-access mechanisms were used to access them, and from which source networks.\u201d Additionally, they found firewall rules used to block or allow certain access from certain networks. Often specifics about the times of day they could be accessed were available as well.<\/p>\n

\u201cWith this level of detail, impersonating network or internal hosts would be far simpler for an attacker, especially since the devices often contain VPN<\/a> credentials or other easily cracked authentication tokens,\u201d according to the white paper.<\/p>\n

The routers<\/a>\u2014four Cisco ASA 5500 Series, three Fortinet Fortigate Series, and 11 Juniper Networks SRX Series Service Gateways\u2014were all bought legally through used-equipment vendors, according to the paper. \u201cNo procedures or tools of a primarily forensic or data-recovery nature were ever employed, nor were any techniques that required opening the routers\u2019 cases,\u201d yet the researchers said they were able to recover data that would be \u201ca treasure trove for a potential adversary\u2014for both technical and social-engineering attacks.\u201d<\/p>\n