TFTP Boot (MITRE ATT&CK T1542.005) is a persistence and stealth technique that targets network devices such as routers and switches. It sits under Pre-OS Boot, because the abuse happens before the device operating system is running.
Netbooting is a normal feature. Administrators use it to load configuration-controlled device images from a central management server, so every device boots the same approved image. That convenience is also the opening.
How attackers use it
MITRE describes the technique in two steps. First, an adversary changes the configuration on a network device so it points at a TFTP server the adversary controls. Second, that server supplies a modified image at startup or reset. MITRE notes this is often combined with Modify System Image (T1601).
The result is a device running an unauthorized operating system. That image can change the device configuration, add malicious capabilities and install backdoors. Because the device is using a standard boot feature to do it, the activity can blend in. MITRE compares it to ROMMONkit (T1542.004), which also ends with a device running a modified image.
How to detect it
MITRE's detection strategy for this technique has no listed data sources, but it names three things worth watching:
- Unauthorized changes to boot configurations that point to a TFTP server.
- Unusual firmware loads during netbooting.
- Suspicious TFTP traffic on the network.
The useful move is correlation. A boot configuration change, the command history that produced it and an unexpected system image hash are far stronger together than any one of them. If you already collect device command logs through AAA accounting, you have the history half of that picture.
How to reduce the risk
The mitigations MITRE lists are plain network hygiene:
- Network intrusion prevention. Use signatures that recognize TFTP traffic and alert or block it where it should not appear.
- Harden the device. Follow vendor hardening guidance, turn off unused features and services, avoid default configurations and passwords, and add logging and auditing.
- Control administrators. Use AAA systems, for example TACACS+, to limit which commands each administrator can run and to keep a history of what they did.
- Limit management access. Restrict protocols that lack encryption or authentication, and keep administrative interfaces away from untrusted networks.
- Audit integrity. Periodically check the running configuration and the system image to confirm neither has been modified.
Quick check
Why is a TFTP server a risk if it is a normal boot feature?
TFTP has no built-in authentication or encryption, so a device that is told to boot from an attacker's server will load whatever image it receives. Restricting TFTP and checking image integrity closes that gap.
