- Cisco reveals salt Typhoon used CVE-2018-0171 to violate target networks
- Login -Legitimation was needed, first
- The attackers are very sophisticated and well -financed, Cisco said
Chinese state-sponsored threat actor Salt Typhoon abused a vulnerability in the SMART Install feature of Cisco iOS software and Cisco iOS XE software to compromise US telecommunications networks has confirmed experts.
In a new blog post, Cisco said it found proof that Salt Typhoon abuses CVE-2018-0171, a 9.8/10 (critical) vulnerability that allows threat actors to perform arbitrary code on a affected device.
“The threat actor then demonstrated their ability to continue in target environments across equipment from multiple suppliers for extended periods and maintain access in one case for over three years,” Cisco Talos said.
Large scale espionage
The researchers described threat actors as “very sophisticated” and “well -funded” and added “The long timeline of this campaign suggests a high degree of coordination, planning and patience standard characteristics of advanced sustained threat (APT) and State -sponsored actors.”
To be able to exploit this vulnerability, Salt Typhoon had first needed valid login credentials that it was somehow able to acquire. The researchers have their suspicion of how: “In addition, we have observed the threat actor who catches SNMP, Tacacs and Radius traffic, including the secret keys used between network units and tacacs/radius servers,” Cisco said. “The purpose of this traffic catch is almost certain to enumerate further credentials for follow -up.”
At the end of October 2024, the FBI and CISA warned of several major US telecommunications providers that had been broken by salt Typhoon.
The statement noted, “The US Government is investigating unauthorized access to commercial telecommunications infrastructure of actors affiliated with the People’s Republic of China.”
As the study progressed, researchers found in December 2024 that at least eight major US telecommunications communications were broken, including T-Mobile, Verizon, AT&T and Lumen Technologies along with countless others worldwide.
Via Hacker the news
