|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |
X-Original-To: nanog@nanog.org X-Envelope-To: nanog@nanog.org Date: Mon, 13 Apr 2015 23:55:23 +0200 From: Nick Hilliard <nick@foobar.org> To: Rashed Alwarrag <rali.ahmed@gmail.com> In-Reply-To: <CAEwtr5pKjvoogZOPvOux1Gm=xdd2c7ugOOyNvDvx-t_Ee=97tQ@mail.gmail.com> Cc: "nanog@nanog.org" <nanog@nanog.org> Errors-To: nanog-bounces@nanog.org On 13/04/2015 23:48, Rashed Alwarrag wrote: > It's reported by different customers in different locations so I don't > think it's password compromised Have you checked? If the routers had vty access open (ssh or telnet) and the passwords were easy to guess, then it's more likely that this was a password compromise. You can test this out by getting a copy of one of the configs and decrypting the access password. Or by asking your customers whether their passwords were dictionary or simple words. It's possible that there was a remotely accessible vulnerability, but ios isn't known for this. Nick
|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |