For the past few weeks attackers have been probing networks for switches that can potentially be hijacked using the Cisco Smart Install (SMI) protocol. Researchers from Cisco's Talos team have now released a tool that allows network owners to discover devices that might be vulnerable to such attacks.
The Cisco SMI protocol is used for so-called zero-touch deployment of new devices, primarily access layer switches running Cisco IOS or IOS XE software. The protocol allows newly installed switches to automatically download their configuration via SMI from an existing switch or router configured as an integrated branch director (IBD).
The director can copy the client's startup-config file or replace it with a custom one, can load a particular IOS image on the client and can execute high-privilege configuration mode commands on it. Because the SMI protocol does not support any authorization or authentication mechanism by default, attackers can potentially hijack SMI-enabled devices.
This is an abuse of a feature that works as intended, so there is no vulnerability to be patched, but Cisco has published a security advisory and blog post with information about how customers can detect and block such attacks.
The company has provided a new IPS (intrusion prevention system) signature and Snort rules to detect the use of Smart Install in customer networks.
The recent Smart Install scanning activity observed in the wild might be related to the recent release of an open-source tool called the Smart Install Exploitation Tool (SIET).
Customers who don't need the Cisco Smart Install functionality should simply disable the feature in their switches. Those who do need it, should follow Cisco's mitigation advice.
The team from Cisco Talos has developed and released its own scanning tool that customers can use to find switches with Smart Install enabled on their networks. The tool is called the Smart Install Client Scanner and was published on GitHub.