Oh man, this would be horrible if it was released and recoded for various scenarios. The question is, how exactly would it get on your router? Maybe they bind it into a firmware update.
edit: just read this part from article.
Quote:
The software cannot be used to break into a Cisco router -- an attacker would need to have some kind of attack code, or an administrative password on the router to install the rootkit, but once installed it can be used to silently monitor and control the device.
The rootkit runs in the router's flash memory, which contains the first commands that it uses to boot up, said EuSecWest conference organizer Dragos Ruiu.
|
Quote:
Still, the rootkit comes at a sensitive time for Cisco. Last week, The New York Times reported that the U.S. Federal Bureau of Investigation considers the problem of fake Cisco gear a critical U.S. infrastructure threat.
In late February the FBI culminated a two-year investigation by breaking up a counterfeit Cisco distribution network and seizing an estimated $3.5 million worth of components manufactured in China. According to an FBI presentation on Operation Cisco Raider, fake Cisco routers, switches and cards were sold to the U.S. Navy, the U.S. Marine Corps., the U.S. Air Force, the U.S. Federal Aviation Administration, and even the FBI itself.
|
Wow, so imagine a big coporation buying a bunch of fake cisco gear that's already been infected with this rootkit. No one would need physical access :-x.
[NW] Hacker Writes Rootkit for Cisco's Routers
05-16-08
Fold For The People 
