Canada Warns Cyber Defenders to Buttress Edge Devices

The Canadian cybersecurity agency is urging cyberdefenders to beef up defenses in the wake of mounting Chinese hacks targeting misconfigured and unpatched edge devices.

See Also: Expert Panel | ANZ’s Guide to Data Classification: The Foundation of Cybersecurity Compliance

The Canadian Center for Cybersecurity on Tuesday said it has observed “increasing levels” of malicious cyberactivity from China-linked hackers, including the group tracked Salt Typhoon, which gained access to U.S. and other telecommunications networks by exploited known flaws in networking gear (see: Patching Lags for Vulnerabilities Targeted by Salt Typhoon).

“The Cyber Center is urging the Canadian cybersecurity community to bolster their awareness of threat actor activity targeting network edge routers,” the agency said.

The agency did not disclose any additional information on flaws exploited by the hackers. It warned that exposed edge devices are at risk of attacks from Chinese hackers since devices can be easily detected by mass scanning.

“Sensitive or administrative services such as management protocols are of particular interest to adversaries seeking to identify and exploit edge routers,” the agency added.

Salt Typhoon is among several state-backed hacking groups that have been targeting edge devices as part of the Chinese government’s strategy of gaining widespread access to Western critical infrastructure, such as the telecommunications sector.

Since virtual private networks and other edge devices often run for months without being rebooted or patched, hackers can remain inside victim networks without detection for long periods of time. Cyberdefenders have recently spotted Chinese hackers compromising Sophos, Cisco and Versa Networks devices.

Hackers target devices running on default security settings, such as insecure ports or protocols, and systems that are not updated, the Canadian agency said. If companies have failed to deploy adequate network segmentation or maintain access control, hackers can target these devices to move laterally, the Canadian agency said.

Once compromised, Chinese hackers have been observed altering configuration files within these devices for traffic forwarding and to create new administrative accounts. Hackers are also stealing configuration files to access sensitive files, identify more vulnerabilities and to extract deprecated hashing and password types to gain more access.

The agency tallied measures that companies can take to mitigate potential Chinese compromise, including:

• Disabling insecure Telnet, HTTP and simple network management protocol versions.
• Disabling unauthenticated router management protocols.
• Limiting access to network management systems only to administrators and preventing a direct internet connection to these systems.
• Using modern encryption standards and deprecating hashing mechanisms and password types.
• Relying on centralized logging, encrypting logging traffic and storing logs off-site.

The Canadian agency also recommended that companies not rely on weak passwords such as vendor-assigned default credentials, not use passwords exposed in data leaks or reuse the same credentials across different systems.