Salt Hurricane Didn’t Hack Their Approach In – They Logged In
The Salt Hurricane marketing campaign, a classy operation attributed to a state-sponsored actors, revealed a chilling actuality: attackers don’t at all times want exploits to breach crucial infrastructure. As an alternative, they used stolen credentials and protocol weaknesses to mix in seamlessly.
Right here’s how their playbook unfolded, based mostly on stories from Cisco Talos and different sources:
- Goal Directors: Attackers centered on community operators with excessive privileges, managing routers, switches, and firewalls.
- Harvest TACACS+ Site visitors: Conventional TACACS+ encrypts solely the password discipline, leaving usernames, authorization messages, accounting exchanges, and instructions in plaintext, weak to interception.
- Steal Credentials: Attackers captured TACACS+ site visitors to extract passwords (crackable offline) and different delicate knowledge, corresponding to machine configurations, to allow unauthorized entry.
- Exfiltrate Knowledge: TACACS+ periods and machine configurations have been quietly collected and despatched offshore for evaluation, masquerading as regular admin site visitors.
- Mix in as Admins: Utilizing stolen credentials, attackers authenticated like legit directors, issuing instructions and producing logs that appeared routine.
- Evade Detection: By analyzing plaintext accounting knowledge, attackers understood log patterns and cleared traces (e.g., .bash_history, auth.log) to cowl their tracks.
- Transfer Laterally and Persist: Over months or years, they expanded entry throughout gadgets, sustaining sturdy footholds in crucial infrastructure.
The brilliance of the marketing campaign wasn’t in breaking the system. It was in residing contained in the system by abusing weaknesses in an outdated protocol.
The marketing campaign’s success lay in exploiting TACACS+’s outdated safety mannequin, turning routine admin site visitors right into a goldmine for attackers.
The Legacy Downside: TACACS+ in a Trendy Menace Atmosphere
TACACS+ (Terminal Entry Controller Entry-Management System Plus) has been a cornerstone of machine administration for many years, offering authentication, authorization, and accounting (AAA). Nevertheless, its design displays a pre-Zero Belief period:
- Restricted Encryption: Solely the password discipline is encrypted; usernames, instructions, authorization replies, and accounting knowledge stay in plaintext.
- Replay Threat: With out cryptographic session binding, captured TACACS+ site visitors might theoretically be reused to authenticate or execute instructions, although particular proof of this in Salt Hurricane is restricted.
- Predictable Logs: Plaintext accounting messages enable attackers to check and anticipate log entries, aiding evasion techniques like log clearing.
- Trusted-Community Assumption: TACACS+ was constructed for inside networks, not fashionable environments with distant entry or untrusted connections.
These flaws make TACACS+ a legal responsibility in right this moment’s risk panorama, the place attackers exploit intercepted site visitors to impersonate admins.
Why Replay Assaults Are a Concern?
Whereas not explicitly confirmed in Salt Hurricane’s techniques, the danger of replay assaults in conventional TACACS+ is important attributable to its lack of session-specific cryptographic protections:
- Authentication Replay: Captured authentication exchanges might probably be reused to achieve entry.
- Authorization Replay: Stolen authorization tokens may enable attackers to execute privileged instructions.
- Command Replay: Recorded command strings could possibly be repeated to imitate legit admin actions.
This vulnerability stems from TACACS+’s absence of ephemeral keys or timestamps, making captured site visitors seem legitimate. Salt Hurricane’s credential theft and log manipulation spotlight how such weaknesses could be exploited to mix into regular operations.
Cisco’s Reply: TACACS+ Over TLS 1.3
Cisco has addressed these vulnerabilities with TACACS+ over TLS 1.3 in Cisco Identification Providers Engine (ISE) 3.4 Patch 2 and later releases, delivering a strong, standards-aligned resolution for securing machine administration. This implementation leverages TLS 1.3 to supply:
- Full-Session Encryption: All TACACS+ site visitors – usernames, authorization replies, instructions, and accounting knowledge is encrypted, eliminating plaintext publicity.
- Replay Safety: Ephemeral session keys guarantee every change is exclusive and non-replayable, rendering captured periods ineffective.
- Trendy Cipher Suites: TLS 1.3 makes use of safe, up-to-date ciphers, hardened in opposition to downgrade and interception assaults.
This resolution straight counters the vulnerabilities exploited by Salt Hurricane, corresponding to plaintext knowledge exfiltration and potential session reuse, guaranteeing admin site visitors stays confidential and tamper-proof.
Going Past Encryption: Stopping Credential Abuse with MFA
Encryption secures knowledge in transit, however stolen credentials stay a danger. Cisco’s ecosystem integrates Cisco ISE with Cisco Duo multi-factor authentication (MFA) to handle this:
- Duo MFA: Requires a second issue for machine admin logins, neutralizing stolen or intercepted credentials.
- Zero Belief Alignment: Steady verification ensures that even legitimate credentials can’t be used with out extra authentication, thwarting impersonation makes an attempt or credential theft.
This mixture strengthens administrative entry controls, aligning with Zero Belief ideas of by no means trusting and at all times verifying.
Why This Issues Now
Identification-based assaults, like Salt Hurricane, are more and more widespread amongst nation-state and prison actors. Slightly than counting on exploits, attackers goal protocols and credentials to achieve persistent entry. For organizations utilizing conventional TACACS+:
- You danger exposing usernames, instructions, and accounting knowledge in plaintext.
- You might be weak to credential theft and potential session replay.
- Your logs could be studied and manipulated by attackers.
- You could not meet fashionable compliance requirements, corresponding to NIST 800-53, FIPS 140-3, or PCI DSS, which require robust encryption and authentication.
Cisco’s TACACS+ over TLS 1.3, mixed with Duo MFA, presents a number one resolution to safe machine administration, supported by Cisco’s in depth expertise in community safety.
The Takeaway
Attackers like Salt Hurricane exploit weaknesses in outdated protocols to impersonate admins and persist undetected. Conventional TACACS+ leaves crucial knowledge uncovered and weak.
With Cisco ISE 3.4 Patch 2 and Duo MFA, you may:
- Encrypt all TACACS+ site visitors with TLS 1.3
- Forestall credential theft and session replay
- Block unauthorized entry with MFA
- Defend logs from evaluation and tampering
- Meet compliance necessities (e.g., NIST, FIPS, PCI DSS)
- Implement Zero Belief for machine administration
Safety threats evolve quickly. Your AAA technique should maintain tempo. Cisco’s resolution empowers you to safe your directors and shield your infrastructure from refined assaults.
Learn extra about Cisco ISE.
We’d love to listen to what you assume! Ask a query and keep related with Cisco Safety on social media.
Cisco Safety Social Media
Share: