<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msochpdefault, li.msochpdefault, div.msochpdefault
{mso-style-name:msochpdefault;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.emailstyle17
{mso-style-name:emailstyle17;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-AU" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">I just found it amusing that Cisco’s wording is, it’s bad, but it’s designed to work that way.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">Insecure by Design.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">Sigh…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">As a minor point of comparison, we do zero touch deployment for our VoIP handsets, but we basically scan the mac address of the pickingslip/side of box, then dump that into our provisioning
system, which is advertised to the phones via DHCP option. This at least requires to be in the L2 broadcast domain to poke these.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">This a routable L3 auto-configure, which strikes me personally, as incredibly stupid. But smarter heads than mine must know better.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US">-M<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Michael Junek [mailto:michael@juneks.com.au]
<br>
<b>Sent:</b> Wednesday, 9 May 2018 2:27 PM<br>
<b>To:</b> Michael J. Carmody <michael@opusv.com.au>; ausnog@lists.ausnog.net<br>
<b>Subject:</b> Re: Bouncing Cisco Equipment and "Smart Install"<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">Hi Michael,<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">When I recently deployed a few 9300's in our DC, this feature was disabled before bringing in external connectivity because one of our engineers here was aware of this vulnerability and removed it.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">It's enabled out of the box because the idea is that it's for zero-touch initial provisioning of the switch. The above engineer was working on a large infrastructure project for a govt department,
which involved deploying approximately 600x 3850 switches. These were set up in a central system and when powered on, the configs were delivered, rather than having to console into every switch and deploy the configuration.<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">Michael<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;color:#212121">
<hr size="2" width="98%" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> AusNOG <<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>> on behalf of Michael J. Carmody <<a href="mailto:michael@opusv.com.au">michael@opusv.com.au</a>><br>
<b>Sent:</b> Wednesday, 9 May 2018 14:21<br>
<b>To:</b> <a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a><br>
<b>Subject:</b> [AusNOG] Bouncing Cisco Equipment and "Smart Install"</span><span style="font-size:12.0pt;color:#212121">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#212121"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:#212121">Hey All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">Just a feeler to see if anyone else is seeing this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">We have some Cisco switches we use as Layer 2/3 NTU’s to talk to client equipment on the far ends of fibre links.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">As of yesterday morning, all of these switches started a roughly 1-2 hour reboot outage.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">All smartnet’ed, running latest recommended stable from cisco, and nothing in the logs other than a hard reset just occurred.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">We have been additionally hardening the exposure of various interfaces (attacks were captured coming from resi ISP looking .mx domains), and it appears the one that has stopped the rot is disabling the “Smart
Install” feature with a “no vstack” command, reload config from out config store and back to work…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">TBH I didn’t even know this protocol existed… a non-authenticated, on by default protocol that allows you to configure and image deploy on network equipment.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">Like, its our own fault, but what the hell is this doing on by default?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">Anyone else with Cisco or “Smart Install” equipment seeing an uptick in scanning/poking activity?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">-Michael Carmody<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#212121">(Ref: <a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi">
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi</a> )<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>