Critical SSH Backdoor in multiple Barracuda Networks Products

http://archives.neohapsis.com/archives/fulldisclosure/2013-01/0221.html

by alxndr • 14 years ago

98 51 14 years ago

archives.neohapsis.com

mpyne2• 14 years ago

I wonder how much it is worth to crack the root password that was left embedded in all the Barracuda devices even with the patch applied?

marshray3• 14 years ago

Is it the same in all devices? Is it ever changed? How many people know it?

sarabob• 13 years ago

To a competitor? Depends if people blame barracuda or can trace the cracking back to you.

Are you thinking of switching a bitcoin mining operation into a cracking-passwords-to-put-companies-out-of-business operation?

mpyne2• 13 years ago

I'm more afraid of the nebulous criminal underground or national entities than I am of Barracuda's competitors. I'm not referring at all to Bitcoin (or putting companies out of busines...), it's surely cheaper to just use available "cloud cracking" assets directly (which I'm also sure is already being done).

Since it's apparently unclear, I'm not talking about taking action myself, but I will say that due diligence for any company using Barracuda hardware means that they should be asking the same question themselves.

nwh• 13 years ago

There's services that already do this, but it's not really necessary in most cases. Even with my lonely workhorse I can smash through hundreds of millions of hashes a second. You only need additional reinforcements for more computationally harder hashes.

jtchang• 14 years ago

If you are going to put backdoors (I can't believe I am even saying this) on your product then it might be good to at least disable normal password logins and only do SSH key exchange.

That said why the hell are there UNDOCUMENTED backdoors? I mean it makes sense from a customer support perspective but really?

frozenport• 14 years ago

If you think thats bad, why are there undocumented backdoors that don't immediately trace back to Barracuda?

im3w1l2• 13 years ago

What do you mean?

djeikyb• 13 years ago

I briefly worked for Barracuda support a few years ago. I don't know how they market or publicly document the boxes, but it seemed common knowledge that we had ssh access. None of the customers I talked to blinked an eye. Most of them outright expected it. So I'm not sure it's so much "backdoor" as "feature".

rdl3• 14 years ago

Looks like it's worth avoiding Barracuda appliances even after this patch, since they're retaining the "remote" account.

As to why they did this -- feature checklist compatibility with Huawei and ZTE is my guess.

Remember most of these do intercept -- they have an SSL CA cert which is trusted by all your business client devices, to do MITM. So, if you pwn the box, you can pwn all the SSL traffic at the target company, too. It's an excellent place to attack.

jlgaddis4• 14 years ago

Wait, so is the private key for that certificate stored on the Barracuda device!?

If it's possible to become root on these devices, then ... wow.

tedunangst2• 14 years ago

Yes, it has to be able to sign all the fake certs it generates.

atamyrat• 14 years ago

> Remember most of these do intercept -- they have an SSL CA cert which is trusted by all your business client devices, to do MITM. So, if you pwn the box, you can pwn all the SSL traffic at the target company, too. It's an excellent place to attack.

I really hope this certificate is not installed/trusted by default on major browsers. Can somebody confirm it?

EDIT:

https://www.barracudanetworks.com/news/press_release/33

"Transparent deployment of this enhanced SSL Inspection feature requires deployment of a trusted root certificate on client Web browsers."

lawnchair_larry2• 14 years ago

No, the way these work is your IT deploys the internal CA cert as trusted on all systems in the enterprise.

alistair77• 13 years ago

I believe IE and Chrome use the operating systems list of certs. So your corporate IT dept can deploy the trusted certificates pretty easily. Firefox has it's own list of certificates so in theory is less susceptible to these corporate MITM attacks.

tptacek• 13 years ago

In reality, the CA=YES cert loaded onto a Barracuda MITM proxy at an enterprise would be a second-tier trophy in the biennial internal network penetration test.

Internal netpens for F-500 companies are often (maybe usually) considered failures for the pentest team if they don't yield mass server compromises from an unprivileged starting point.

If you can log into a middlebox like a MITM proxy from the Internet at all, you now have an Internet to internal-network pivot. You are at the "unprivileged starting point" of an internal net pentest. Go ahead and grab the CA=YES cert, but then get on with owning up the whole network.

Internal network security at large enterprise networks (the kinds that routinely MITM intercept SSL traffic) is extremely bad.

darkarmani3• 14 years ago

Here is the timeline if you're interested - 14 days from contact to publication:

2013-01-10: Sending advisory and proof of concept exploit via encrypted channel.

2013-01-14: Vendor confirms receipt and provides BNSEC IDs.

2013-01-14: Vendor sends listing of reported vulnerabilities and release schedule.

2013-01-21: Conference call - discussing implemented solutions.

2013-01-23: Barracuda Networks releases alert & secdef

2013-01-24: SEC Consult releases coordinated security advisory.

jlgaddis4• 14 years ago

From the post to f-d:

> 2012-11-29: Contacting vendor. > 2012-11-29: Sending advisory and proof of concept exploit via encrypted channel.

darkarmani3• 13 years ago

Oops. You are completely correct. I posted the timeline for the follow-up advisory! And it's too late to edit.

darkarmani3• 13 years ago

Oops! This is the correct timeline (the other one is a followup advisory):

2012-11-29: Contacting vendor.

2012-11-29: Sending advisory and proof of concept exploit via encrypted channel.

2012-12-04: Vendor confirms receipt and provides BNSEC IDs.

2012-12-05: Requesting further coordination (conference call).

2012-12-13: Sending reminder regarding SEC Consult disclosure policy.

2012-12-15: Vendor responds - arranging conference call.

2012-12-18: Conference call: Addressing the risks the discovered vulnerabilities pose to customers and release schedule.

2013-01-14: Vendor sends listing of reported vulnerabilities and release schedule.

2013-01-21: Conference call - discussing implemented solutions.

2013-01-21: Vendor provides information about some questions which came up.

2013-01-22: Asking for definitive listing of affected appliances.

2013-01-23: Barracuda Networks releases alert & secdef

2013-01-24: SEC Consult releases coordinated security advisory.

dsl• 14 years ago

The "patch" disables some but not all backdoor accounts on the machine. The root account is still present with password auth.

martinced• 14 years ago

Knowing not much about network appliances and their role etc., when you're building a company, starting from scratch, are there good rule of thumb to not fall for the "enterprisey compromisey" piece of junk that such companies (Huawei -- state-sponsored espionnage-- ZTE, Barracuda, etc.) do sell?

Is there anything you can do to be at least a little bit safe?

Are there vendors that still value security or is it just accepted now that MITM and state-sponsored attacks are a normal way of operating?

rdl3• 13 years ago

In the long run, I have more faith in software defined networking to de-shitify this space than any other single solution.

We're actually working on some tech solutions which might help in the software defined networking security area, but it'll be 6-12 months. Ideally some of it will be open sourced and/or standardized.

papsosouid2• 13 years ago

The easiest way is to just not buy that crap at all. Computers are cheap, open source software is available, put the two together.

danielweber• 13 years ago

People do not want to maintain that stuff. Your comparative advantage as a startup is not running your own firewall.

Nb: I am employed by a Barracuda competitor, but would probably still advise against trying to run things on your own.

EvanAnderson• 13 years ago

It's unfathomable to me why any company in the IT security industry would ship a product with an undocumented remote access mechanism built-in. This seems like a sure way, when the mechanism is inevitably discovered, to cause harm to your company's reputation.

I've always felt vaguely distrustful of Barracuda anyway, but it's nice to have some facts to cite when not recommending their products.

absconditus• 13 years ago

I attempted to view this URL at work. It was blocked by our Barracuda filter.

"The link you are accessing has been blocked by the Barracuda Web Filter because it contains spyware. The name of the spyware is: Spyware.Exploit.Misc.MWBR"

0x0• 13 years ago

This is highly suspicious!

obituary_latte• 13 years ago

Well, now you know how to fix that.

With a properly formatted request to the department responsible for maintaining the web filter, of course.

btb• 13 years ago

Wow thats amazing. Honestly feel bad for any IT admin who bought any of their products not knowing about those backdoors(assuming they arent disclosed anywhere). I personally would be extremely upset to read that A)they had backdoors in the box they sold me, and that B)they intend to keep them intact for "customer support"!

d0c5• 13 years ago

Why did they write pubic key in the solutions bit? Surely a sly joke..

neonkiwi• 13 years ago

There's a very unfortunate [dead] comment by Intermernet in this thread. Unfortunate because it might be a good solution for someone who administers the affected hardware and wants to remove the backdoor after patching (as per the Workaround section in the OP, "Barracuda Networks offers an expert option that disables the SSH daemon. For assistance contact the Barracuda Networks Support.")

Note, I have no idea why the user is dead, nor if this solution actually works, but I'm posting Intermernet's post below:

The workaround mentioned involves:

1. Log in to the device and go to the "Advanced" tab on the web GUI.

2. Add "&expert=1" to the end of the URL.

3. Click on the red "Expert" button.

4. Scroll to the bottom and disable remote support.

You will need to reverse this process if you ever actually require the barracuda remote support.

Aloha• 13 years ago

I worked for Barracuda, I left, because I felt the company was slimy. On the other hand, from a customer service point of view, this supposed back door is great, it makes the product much easier to support, for a customer base who is honestly, most of the time not that technically astute. If they were more astute, they would have bought a different product.

mcpherrinm• 13 years ago

I've had an upswing in spam today on my systems, and it looks like a lot of them have headers indicating they've gone through a Barracuda device. It doesn't surprise me that spammers are all over this.

dredmorbius3• 13 years ago

Monitoring and support backdoors are common and pervasive in most networking gear. This isn't something that should be considered lightly.

There's been some hullaboo about Chinese manufacturers putting backdoor access into their devices, Huawei Technologies and ZTE Corporation particularly: http://www.infosecisland.com/blogview/21930-China-Has-Backdo...

Legally mandated backdoors exist on Cisco gear as well: http://www.forbes.com/2010/02/03/hackers-networking-equipmen...

Critical SSH Backdoor in multiple Barracuda Networks Products

Related Stories