Cisco warns of hijack code for VPN gear

Cisco warns of hijack code for VPN gear

Cisco Systems has warned that hacker software now exists that allows attackers to break into a Cisco-based VPN by intercepting VPN logon/password data.

The hacker code takes advantage of a previously reported vulnerability in Cisco VPN hardware and software, where Group Passwords are used instead of Public Key Infrastructure (PKI) certificates to authenticate a VPN user. The exploit code affects the Cisco VPN 3000

Concentrator, the Cisco VPN client software for Windows and Linux PCs, and the VPN 3002 hardware client - a small appliance for connecting remote PCs to a Cisco VPN through broadband links.

The exploit code could be used to emulate an enterprise VPN termination device, such as the Cisco VPN Concentrator, and glean VPN usernames and passwords from end-users. The code could also be used to hijack Cisco VPN connections directly from end-users.

According to a Cisco statement, “the Group Password used by the Cisco IPSec VPN client is scrambled on the hard drive, but unscrambled in memory. This password can now be recovered on both the Linux and Microsoft Windows platform implementations of the Cisco IPSec VPN client.”

This so-called “man-in-the-middle” attack only affects Cisco VPN gear using Group Passwords. This is considered a less-secure authentication method than PKI certificate exchanges.

Cisco said there were no workarounds for this problem, and recommended that users implement PKI instead of Group Passwords for VPN authentication.

The company said it would release software that would fix the Group Password problem on the VPN 3000 Concentrator, client software and hardware client in the third quarter of this year.

The news of hacker software for this Cisco VPN weakness comes a week after Cisco warned of a software flaw that could leave the IPSec VPN Module for the Catalyst 6500 switch and 7600 series router susceptible to a denial-of-service attack.

Follow Us

Join the newsletter!

Error: Please check your email address.
Show Comments