urlscan.io logo urlscan.io
SecurityTrails logo

www.cisa.gov Open in urlscan Pro
2a02:26f0:3500:88d::447a  Public Scan

Back to summary
URL: https://www.cisa.gov/uscert/ncas/alerts/TA17-156A
Submission: On February 19 via api from US — Scanned from DE

Form analysis 3 forms found in the DOM

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id1">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id2">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

https://public.govdelivery.com/accounts/USDHSCISA/subscribers/qualify

<form action="https://public.govdelivery.com/accounts/USDHSCISA/subscribers/qualify"><label class="visually-hidden" for="email-address-field">Enter your email address</label> <input class="signup-form" id="email-address-field" name="email"
    placeholder=" Enter your email address" title="Enter your email address" type="text"><br><input class="btn btn-primary" name="submit" title="Sign up for alerts" type="submit" value="Sign Up">&nbsp;</form>

Text Content

Skip to main content

An official website of the United States government Here's how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share
sensitive information only on official, secure websites.
×

search
 

CISA.gov Services Report

--------------------------------------------------------------------------------

Toggle navigation

×

search
 

CISA.gov
Services
Report


CERTMAIN MENU

 * Alerts and Tips
 * Resources
 * Industrial Control Systems

--------------------------------------------------------------------------------



 1. National Cyber Awareness System    >
 2. Alerts    >
 3. Reducing the Risk of SNMP Abuse

More Alerts


ALERT (TA17-156A)


REDUCING THE RISK OF SNMP ABUSE

Original release date: June 05, 2017



SYSTEMS AFFECTED

SNMP enabled devices


OVERVIEW

The Simple Network Management Protocol (SNMP) may be abused to gain unauthorized
access to network devices. SNMP provides a standardized framework for a common
language that is used for monitoring and managing devices in a network.

This Alert provides information on SNMP best practices, along with prevention
and mitigation recommendations.


DESCRIPTION

SNMP depends on secure strings (or “community strings”) that grant access to
portions of devices’ management planes. Abuse of SNMP could allow an
unauthorized third party to gain access to a network device. 

SNMPv3 should be the only version of SNMP employed because SNMPv3 has the
ability to authenticate and encrypt payloads. When either SNMPv1 or SNMPv2 are
employed, an adversary could sniff network traffic to determine the community
string. This compromise could enable a man-in-the-middle or replay attack.

Although SNMPv1 and SNMPv2 have similar characteristics, 64-bit counters were
added to SNMPv2 so it could support faster interfaces. SNMPv3 replaces the
simple/clear text password sharing used in SNMPv2 with more securely encoded
parameters. All versions run over the User Datagram Protocol (UDP).

Simply using SNMPv3 is not enough to prevent abuse of the protocol. A safer
approach is to combine SNMPv3 with management information base (MIB)
whitelisting using SNMP views. This technique ensures that even with exposed
credentials, information cannot be read from or written to the device unless the
information is needed for monitoring or normal device re-configuration. The
majority of devices that support SNMP contain a generic set of MIBs that are
vendor agnostic. This approach allows the object identifier (OID) to be applied
to devices regardless of manufacturer.


IMPACT

A remote attacker may abuse SNMP-enabled network devices to access an
organization’s network infrastructure.


SOLUTION

A fundamental way to enhance network infrastructure security is to safeguard
networking devices with secure configurations. US-CERT recommends that
administrators:

 * Configure SNMPv3 to use the highest level of security available on the
   device; this would be authPriv on most devices. authPriv includes
   authentication and encryption features, and employing both features enhances
   overall network security. Some older images may not contain the cryptographic
   feature set, in which case authNoPriv needs to be used. However, if the
   device does not support Version 3 authPriv, it should be upgraded.
 * Ensure administrative credentials are properly configured with different
   passwords for authentication and encryption. In configuring accounts, follow
   the principle of least privilege. Role separation between polling/receiving
   traps (reading) and configuring users or groups (writing) is imperative
   because many SNMP managers require login credentials to be stored on disk in
   order to receive traps.
 * Refer to your vendor’s guidance for implementing SNMP views. SNMP view is a
   command that can be used to limit the available OIDs. When OIDs are included
   in the view, all other MIB trees are inherently denied. The SNMP view command
   must be used in conjunction with a predefined list of MIB objects.
 * Apply extended access control lists (ACLs) to block unauthorized computers
   from accessing the device. Access to devices with read and/or write SNMP
   permission should be strictly controlled. If monitoring and change management
   are done through separate software, then they should be on separate devices.
 * Segregate SNMP traffic onto a separate management network. Management network
   traffic should be out-of-band; however, if device management must coincide
   with standard network activity, all communication occurring over that network
   should use some encryption capability. If the network device has a dedicated
   management port, it should be the sole link for services like SNMP, Secure
   Shell (SSH), etc.
 * Keep system images and software up-to-date.


REFERENCES

The Interfaces Group MIB using SMIv2


REVISIONS

June 5, 2017: Initial Release

This product is provided subject to this Notification and this Privacy & Use
policy.

Please share your thoughts.

We recently updated our anonymous product survey; we'd welcome your feedback.


CONTACT US

(888)282-0870

Send us email(link sends email)

Download PGP/GPG keys

Submit website feedback


SUBSCRIBE TO ALERTS

Receive security alerts, tips, and other updates.

Enter your email address
 


HSIN
Report

--------------------------------------------------------------------------------

Home   Site Map   FAQ   Contact Us   Traffic Light Protocol   PCII  
Accountability   Disclaimer   Privacy Policy   FOIA   No Fear Act  
AccessibilityPlain WritingPlug-ins   Inspector General   The White House  
USA.gov
 

CISA is part of the Department of Homeland Security