Simple SNMP scans yield network data

Simple SNMP scans yield network data
Simple SNMP scans yield network data 

By Matthew Broersma
05 March 2008

System administrators have long been wary of the security implications 
of Simple Network Management Protocol (SNMP), but a recent experiment by 
"ethical hacking" group GNUCitizen has shown that many SNMP-enabled 
devices are left unguarded and may be prone to giving away sensitive 

In a random scan of 2.5 million IP addresses via SNMP, the group found 
that many devices gave away names, models and in some cases the patch 
state of the OS.

SNMP has a number of known security weaknesses, including the fact that 
it is susceptible to brute force and dictionary attacks, and is 
typically accessed over User Datagram Protocol (UDP), which is 
vulnerable to IP spoofing.

The use of UDP means that large numbers of systems can be scanned 
rapidly via SNMP, in a shorter time than with TCP-based protocols, 
according to GNUCitizen researcher Adrian Pastor.

Because of SNMP's weaknesses, gaining read-only access to such devices 
over the Internet is a potentially serious security problem, according 
to Pastor.

"Even if a cracker only gained read access to a device/server via a SNMP 
community string, sometimes it would be possible to extract sensitive 
information such as usernames and passwords which would eventually lead 
to a compromise of the targeted systems," he said in a post on 3 March 
2008. "In order to accomplish this, all that is needed by the attacker 
is knowledge of an interesting OID to query. My point is that SNMP read 
access could a enough to fully own a device."

GNUCitizen found that out of the 2.5 million random IP addresses 
scanned, 5,320 addresses responded to the submitted SNMP requests.

The low response rate is partly due to the fact that SNMP is supported 
mainly by embedded devices such as routers, which make up a small 
proportion of all IP addresses, Pastor said.

The top type of device responding was the Arris Touchstone Telephony 
Modem, a VoIP modem, which accounted for more than 35 percent of devices 

Other common devices discovered included Cisco routers, Apple AirPort 
wireless base stations, ZyXel Prestige routers, Netopia routers and 
Windows 2000 servers.

These responses alone could be interesting for research, Pastor said. 
"For instance, if researching remote SNMP vulnerabilities, it would make 
sense to focus on a type of device that is widely spread through the 
Internet," he wrote.

Interesting information yielded up included a Windows server giving a 
full list of usernames, a BT Voyager 2000 router leaking ISP credentials 
including password, a HP JetDirect printer leaking the administration 
password and Dynamic DNS credentials disclosed by ZyXel Prestige 

"Lots of devices leak way too much information via SNMP read access," 
Pastor said on the group's website.

The research isn't groundbreaking, the group admitted, but rather is 
meant to "get an idea of the current state of remote SNMP hacking", 
Pastor stated.

Among others, the SANS Institute has long warned about the dangers of 
SNMP, warning in a typical document that "sniffed SNMP traffic can 
reveal a great deal about the structure of your network, as well as the 
systems and devices attached to it," and that intruders can use the 
information to plan attacks.

SANS advises administrators to disable SNMP unless it is absolutely 
required, or alternatively to take care in configuration.

Subscribe to InfoSec News 

Site design & layout copyright © 1986-2014 CodeGods