Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

2 days ago, we had a maintenance checkup in our server room. I noticed that the inspector was carrying a 6 meter fiber-optic cable, and a handheld strobe light with his equipment.

Now, I had an external email sent to me saying that our network has been compromised, as well as quite a few internal IP's, Computer Names, and Login Passwords.

Can this router be hacked using a fiber-optic cable and a strobe light?

(Quoted on behalf of a friend)

share|improve this question
1  
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore –  Iszi Sep 17 '12 at 17:25
    
Typically the strobe and attached fiber is for tracing fiber connections visually. –  matt marcaccini Nov 9 '12 at 2:36
add comment

3 Answers

up vote 5 down vote accepted

With physical access, so many parts of your network could be compromised. I'm not sure I would be looking at the cable and light, but at more basic things, like USB drives, rogue wifi access points, computers left logged in...

share|improve this answer
2  
Agreed- a strobe isn't going to be useful (unless it can talk FDDI or similar:) –  Rory Alsop Sep 17 '12 at 14:57
add comment

The strobe light was likely a prop rather than a useful piece of equipment. With physical access all an attacker needs to gain control of any Cisco device is a console cable and a terminal program. Simply restart, send a break, then you can set the device to boot without the configuration.

Most likely the attacker didn't even need to do that as many people don't set a console password, and gaining physical access would give him instant enable level access with no work at all.

Can you log into the router anymore? If so I doubt that anyone's taken it over as the first thing they'd do is change the passwords to lock you out. More likely they used their network access to load malware on your computers.

share|improve this answer
add comment

The basic rule says that he who as access to hardware owns the hardware. :)

So if you do not properly implemented security hardening on the hardware it will be difficult to fell confident in your equipment security.

The hardening only makes difficult for the attacker to compromise the hardware and the main objective is to alert us that something is wrong before anything bad happens.

We can make it difficult for the attacker to fulfil this rule. And some of the actions described in the earlier posts can be neutralized with this simple commands:

  • no service-password recovery
  • Login Password Retry Lockout

Here is a complete how-to to begin hardening your cisco devices.

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.