We (Could Have) Cracked Open the Network for Under $100

### Overview In this RSA Conference presentation, Tony Anscombe (Chief Security Evangelist at ESET) and Cameron Camp (Security Researcher at ESET) present findings from an accidental research project examining hardware purchased on the secondary market. While attempting to source affordable, real-world networking gear to build a threat research lab, the researchers discovered that a substantial number of used enterprise routers retained sensitive internal corporate configurations. With the secondary electronics market valued at $24.5 billion globally ($6.4 billion in the US), improper hardware disposal introduces systemic security risks, enabling attackers to acquire extensive internal network roadmaps for under $100.

### Key Topics - **Secondary Market Risks**: Used enterprise hardware (including Cisco ASA, Fortinet, and Juniper SRX devices) frequently reaches resellers and recyclers without being wiped. - **Sensitive Data Exposure**: The retained configurations contained authentication credentials, full LDAP directories, partner peering data, internal topologies, and software lists. - **Vulnerability Disclosure Hurdles**: Security researchers faced significant friction notifying non-vendor corporate entities of data exposure, encountering corporate sales walls, unresponsive PR teams, and disconnected IT units. - **Hardware Decommissioning & Governance**: Organizations frequently lack enforced chain-of-custody policies and rarely audit third-party sanitization and e-waste vendors.

### Technical Details The researchers evaluated multiple used routers off lease or from secondary markets: - **Device State Breakdown**: Out of the sample analyzed, 56% of routers still contained organizational data. Five routers were securely wiped, two showed decent diligence, and one arrived dead-on-arrival (DOA). - **Observed Configurations**: The researchers did not require advanced firmware reversing or chip extraction to access data. Exposed configuration files revealed: - Site-wide admin accounts and crackable encrypted root authentication password hashes. - RADIUS authentication settings and complete LDAP directory structures. - Customer data and internal/external backup storage locations (observed in 22% of devices analyzed). - Third-party peering information, connected businesses, and communications with outside legal counsel (found in 33% of devices). - Certificates, cryptographic tokens, and pre-shared IPsec/IKE keys (present in 44% of devices). - Router-to-router and machine-to-machine authentication topologies, including physical locations of offsite manufacturing plants (present in 89% of devices). - Specific on-premises and cloud hybrid applications and public-to-internal firewall rules (present in 89% of devices). - **Exploitation Scenarios**: The authors noted that access to cryptographic hashes and router configurations enables adversary-in-the-middle attacks, direct impersonation, pass-the-hash attacks, and insider recon. Furthermore, specific application versions visible in firewall configs corresponded directly to known CVEs (including vulnerabilities ranked up to CVSS 8.3 and 9.0), eliminating the need for attackers to conduct noisy external reconnaissance. - **Dark Web Economics**: The speakers highlighted that while initial network access credentials sell on dark web forums for approximately $2,800 (referencing figures from Keyless Cyber Crime Prevention), fully configured core routers bought for around $75 offer far deeper credential access and reconnaissance.

### Takeaways - **Adhere to Established Standards**: Organizations should implement formal hardware disposal checklists based on NIST SP 800-88 Rev. 1 guidelines for media and hardware sanitization. - **Audit Sanitization Vendors**: Organizations using third-party disposal, leasing companies, or e-cycling services must actively audit vendor sanitization workflows to ensure decommissioned devices are actually cleared before resale. - **Maintain Strict Chain of Custody**: Document who decommissions equipment, what data and roles it had, where it was racked, and verify erasure before equipment leaves the premises. - **Establish Inbound Reporting Channels**: Organizations need clear, externally accessible mechanisms for outside researchers to reach security and IT teams regarding data exposure without getting blocked by sales filters. - **Leverage CISA When Blocked**: If an external researcher or organization discovers exposed corporate configurations on hardware and cannot reach the owner, CISA regional offices can assist in facilitating notification.