A rootkit for Cisco routers

28th May 2008

The transfer of most online traffic via routers attracted the attention of researchers in security. A representative of Core Security Technologies, Sebastian Muniz, has managed to create a rootkit for Cisco routers. Rootkits imply the maximum hidden presence of a malicious module in the system, this type of threat is wide-spread in the Windows environment. In the case of Cisco, the rootkit was written under the Internetwork Operating System, a system of routers for a company. Cisco controls two-thirds of the world routers market; therefore, it is not surprising that the companies software was chosen as the object of potential attacks.
Earlier, there has already been some attempts to create rootkits for routers with IOS, but they were compatible only with certain versions of IOS, while the invention of Muniz is meant for several versions simultaneously. His rootkit sits in the flash-memory, where router boot commands are located. Muniz is not going to disclose the code. On May, 22 he is going to demonstrate the rootkit at the EuSecWest conference in London and reveal the principles of its creation.