Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cisco Warns Of Malicious Firmware

Cisco issued a security alert this week to warn customers that it's seen cases in which attackers are hijacking its networking devices using malicious firmware.

The number of attacks is limited, but the cases involve intruders replacing the Cisco IOS ROMMON with a malicious image to gain administrative or physical access to a Cisco IOS device. ROMMON, or ROM Monitor, is a program used to boot the Cisco IOS operating system on its switches and routers.

According to the Cisco security bulletin, attackers accessed the IOS devices using valid administrative credentials and then installed a malicious ROMMON by using the ROMMON field upgrade process.

"Once the malicious ROMMON was installed and the IOS device was rebooted, the attacker was able to manipulate device behavior. Utilizing a malicious ROMMON provides attackers an additional advantage because infection will persist through a reboot," Cisco said.

The attacks don't involve a product vulnerability -- the ability to install a ROMMON image on IOS devices is a standard management feature, the company said. Plus, the attacks require valid administrative credentials or physical access to the device, according to Cisco.