By Matthew Broersma
05 March 2008
System administrators have long been wary of the security implications
of Simple Network Management Protocol (SNMP), but a recent experiment by
"ethical hacking" group GNUCitizen has shown that many SNMP-enabled
devices are left unguarded and may be prone to giving away sensitive
In a random scan of 2.5 million IP addresses via SNMP, the group found
that many devices gave away names, models and in some cases the patch
state of the OS.
SNMP has a number of known security weaknesses, including the fact that
it is susceptible to brute force and dictionary attacks, and is
typically accessed over User Datagram Protocol (UDP), which is
vulnerable to IP spoofing.
The use of UDP means that large numbers of systems can be scanned
rapidly via SNMP, in a shorter time than with TCP-based protocols,
according to GNUCitizen researcher Adrian Pastor.
Because of SNMP's weaknesses, gaining read-only access to such devices
over the Internet is a potentially serious security problem, according
"Even if a cracker only gained read access to a device/server via a SNMP
community string, sometimes it would be possible to extract sensitive
information such as usernames and passwords which would eventually lead
to a compromise of the targeted systems," he said in a post on 3 March
2008. "In order to accomplish this, all that is needed by the attacker
is knowledge of an interesting OID to query. My point is that SNMP read
access could a enough to fully own a device."
GNUCitizen found that out of the 2.5 million random IP addresses
scanned, 5,320 addresses responded to the submitted SNMP requests.
The low response rate is partly due to the fact that SNMP is supported
mainly by embedded devices such as routers, which make up a small
proportion of all IP addresses, Pastor said.
The top type of device responding was the Arris Touchstone Telephony
Modem, a VoIP modem, which accounted for more than 35 percent of devices
Other common devices discovered included Cisco routers, Apple AirPort
wireless base stations, ZyXel Prestige routers, Netopia routers and
Windows 2000 servers.
These responses alone could be interesting for research, Pastor said.
"For instance, if researching remote SNMP vulnerabilities, it would make
sense to focus on a type of device that is widely spread through the
Internet," he wrote.
Interesting information yielded up included a Windows server giving a
full list of usernames, a BT Voyager 2000 router leaking ISP credentials
including password, a HP JetDirect printer leaking the administration
password and Dynamic DNS credentials disclosed by ZyXel Prestige
"Lots of devices leak way too much information via SNMP read access,"
Pastor said on the group's website.
The research isn't groundbreaking, the group admitted, but rather is
meant to "get an idea of the current state of remote SNMP hacking",
Among others, the SANS Institute has long warned about the dangers of
SNMP, warning in a typical document that "sniffed SNMP traffic can
reveal a great deal about the structure of your network, as well as the
systems and devices attached to it," and that intruders can use the
information to plan attacks.
SANS advises administrators to disable SNMP unless it is absolutely
required, or alternatively to take care in configuration.
Subscribe to InfoSec News