0

Assume a network fault monitoring tools is deployed to monitor a subset of routers.

What an attacker can do by exploiting a network monitoring system like OpenNMS?

  1. Can they learn about the topology of the network?

  2. Can they find systems interest? (servers, switches, etc)

  3. What else may be possible to discover?

I believe it depends on the configuration of the NMS system, and what traffic is flowing across. Am I correct?

I am interested in finding out what sensitive information a network/fault monitoring system is vulnerable to.

2

Many NMS systems work better when deployed using simple network management protocol (SNMP). SNMP allows for greater detail in data versus inference. E.g. without SNMP, the NMS tool relies on aggregating bandwidth and connections it sees, versus using SNMP where it can access the router and query an interface. So what is at risk here:

Routes: In segregated environments, there are VLANs, multiple routes sometimes to different providers, destinations, and so forth. As an attacker, I would always be interested in those routes, it helps me discover more of an attack surface.

Systems: Where I would have to manually discover what is on the network, the NMS makes is simple for me because it is a single source of discovery versus me having to fire off say NMAP to discover everything on my own. This keeps my network noise minimal.

Versions: Along with systems, and routes, the NMS makes my life simpler as an attacker since most NMS systems contain versions of software and systems. Rather than performing system fingerprints, I can just query the NMS system for specifics. E.g.: "Which of these 1000 systems are Windows 2003 systems, and what is their patch level? (To be used for isolating exploits).

Credential Reuse: Many organizations forget about credential re-use. The more accounts on the NMS the higher the likelihood someone is re-using their credentials. E.g. username (on NMS): jsmith password: Passw0rd1 in this situation a junior admin has an account on the NMS. His password was cracked, and now I as an attacker can use that password to pivot around the organization. Depending on how you have your NMS configured, it may be possible to access an NMS, and get all the data I need without accessing say an Active Directory server.

There are plenty of issues with NMS systems regarding what, and how an attacker can leverage that data. I love targeting NMS based systems, and often find that organizations who deploy them, do not address these issues. (Segregation, isolation, monitoring)

  • Introducing an NMS in your network may give you a few new threats "one" system has access to all your other devices, has knowledge about your network and may have some credentials stored in them to access other devices. But it also solves/reduces some threats in the same way and you have to take them into account as well when doing a threat analyses as introducing two new threats can be beneficial when your solve/reduce more then you introduce. – hspaans Apr 27 '16 at 22:15
  • Credential Reuse- this seems to be a threat in all softwares where there would be multiple levels (priveleges) but not specific to NMS. – user1493834 Apr 28 '16 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.