Cisco: Security devices are vulnerable to SNIcat data exfiltration technique

guest · Aug 19, 2021

Cisco: Security devices are vulnerable to SNIcat data exfiltration technique
August 18, 2021
https://therecord.media/cisco-security-devices-are-vulnerable-to-snicat-data-exfiltration-technique/

Networking equipment vendor Cisco said today that some of its security products fail to detect and stop traffic to malicious servers that abuse a technique called SNIcat to covertly steal data from inside corporate networks.

Affected devices include Cisco firewalls running FTD (Firepower Threat Defense) software, devices running the WSA (Web Security Appliance) modules, and all ISA3000 (Industrial Security Appliance) firewalls.

First disclosed in August 2020, SNIcat is a data exfiltration technique discovered by Norwegian security firm mnemonic.
In particular, mnemonic researchers discovered that many popular network security devices were checking user traffic against their block-lists after the user’s device negotiated a TLS handshake.
Click to expand...

Last year, mnemonic said they had limited resources at their disposal and were only able to test a handful of devices for SNIcat exfiltration; however, they said that more vendors were also likely to be blind to this technique.

Today, Cisco became the fourth major network security vendor—after F5 Networks, Fortinet, and Palo Alto Networks—to formally admit that its devices can be bypassed using the SNIcat technique.
Check Point said its devices were not vulnerable.
Click to expand...

Cisco is currently investigating several other device models and is expected to release patches and detection rules. See the company’s official advisory for future updates.
Click to expand...

Log in or Sign up

Cisco: Security devices are vulnerable to SNIcat data exfiltration technique

guest Guest

Log in or Sign up

Cisco: Security devices are vulnerable to SNIcat data exfiltration technique

guest Guest

Useful Searches