Re: SNMP read-only opens up... what?

[Thomas Cannon <tcannon () noops org>]

lee.e.rian () census gov said:

> Say I configure a router with a read-only SNMP community of "public" and
> make it Internet accessible.  What vulnerabilities or information
> disclosure does that open up that would be better left closed?  A switch?
>
> Thanks,
> Lee

Well, they'd probably get the firmware version -- instantly giving info on what
may possibly be known as exploitable. They'd get the system's contact
information, if it's in there (frequently with email address and phone number)
which is handy if you're doing any social engineering.

You'd also get the exact hardware spec, it's uptime, how many interfaces it has,
and with what IPs (to maybe get around ACLs; something folks often want to do).
You learn all the MAC addresses, as well -- if you can get on a local subnet and
start spoofing that, you can basically shut down the network. You get the
system's name, which is handy, too. Say it's "vodka" -- there's a strong chance
there's also a "gin", "scotch", or "brandy" elsewhere on the network that they
may not havefound yet. You get ther status of all the interfaces, and how much
traffic is going through them (probably not too useful). 

You also learn it's CAM table (the MAC addresses of the machines it sees at
layer-2) which is handy for spoofing and sniffing.

I can go on, and on, and on. Why not get a copy of snmpwalk, and check out what
your equipment shows you, and think like an attacker would. There's a lot there.
A whole lot.

Cheers,

-tcannon
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html