Take Quiz

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1

According to the episode, what is the primary reason Salt Typhoon was able to maintain persistent access to multiple telecommunications networks for years?

The networks continued running older Cisco devices with unpatched, critical vulnerabilities like CVE-2018-0171 and CVE-2023-20198. The compromised telecom providers failed to use multi-factor authentication for device logins, allowing easy credential theft. Salt Typhoon implemented supply-chain attacks on Cisco to insert backdoors during manufacturing. Salt Typhoon exploited zero-day vulnerabilities in newly released Cisco firmware unknown to Cisco.

Question 2

What Cisco device configuration modification technique did Salt Typhoon use to evade detection and access other network devices?

Enabling default guest accounts with administrative privileges to gain broad access. Injecting code into Cisco IOS kernel modules to disable logging functions entirely. Changing routing protocols to reroute traffic through attacker-controlled VPNs without modifying interfaces. Modifying the loopback interface IP address on compromised switches to source SSH connections and bypass ACLs.

Question 3

Regarding the 2023 CVE-2023-20198 vulnerability exploited by Salt Typhoon, what is its CVSS score and what does that imply about its severity?

It has a CVSS score of 10.0, indicating the highest possible severity with no mitigations making it less critical. It has a CVSS score of 7.5, indicating a high severity but with some mitigations available to reduce risk. Cisco has not assigned a CVSS score to this vulnerability as it is considered non-critical. It has a CVSS score of 5.0, indicating medium severity typically requiring manual intervention.

Question 4

What key failure in Cisco's device design philosophy does the episode critique as contributing to Salt Typhoon's success?

Allowing default remote web management interfaces to be globally accessible without mandatory IP filtering by default. Using weak cryptographic algorithms for VPN tunnels by default in Cisco IOS XE devices. Requiring all devices to run Linux-based virtual environments susceptible to rootkit insertion. Not supporting multi-factor authentication on all management interfaces out of the box.

Question 5

What operational capabilities were observed by Cisco Talos in Salt Typhoon's custom tool 'JumbledPath' used on compromised Cisco devices?

Scanning local networks for IoT devices to expand the botnet for distributed denial of service (DDoS) attacks. Injecting kernel rootkits to hide network traffic and disable device logging permanently. Executing remote packet captures via jump hosts, compressing and encrypting data for covert exfiltration across multiple network hops. Remotely resetting routers and switches to factory defaults to erase forensic evidence instantly.

Cancel

Episode #1031 Quiz

Question 1

Question 2

Question 3

Question 4

Question 5