Routers and switches run their own operating systems, and those images can be altered. MITRE ATT&CK technique T1556.004, Network Device Authentication, covers hard coding a password into a device operating system so native local account authentication is bypassed. The tactics are defense impairment, persistence and credential access, and the platform is Network Devices.
How attackers use it
MITRE points to Patch System Image (T1601.001) as the way in, and to Modify System Image (T1601) more generally. The implanted code gives access to adversaries who know a specific password. The password is embedded in the operating system image by the patch.
During an authentication attempt, the inserted code first checks whether the user input is that password. If it is, access is granted. If not, the code passes the credentials on to the normal verification path, so real users notice nothing.
How to detect it
MITRE lists no data sources here. Because the backdoor lives in the image, detection is mostly about image integrity: compare running image hashes with vendor published values, review unexpected image changes or reloads, and look for logins that do not appear in your central authentication server logs. A local account login that works with no matching record elsewhere is a clue.
How to reduce the risk
MITRE lists two mitigations.
- Privileged account management. Restrict administrator accounts to as few people as possible, following least privilege. Avoid credential overlap between administrator and privileged accounts across systems, particularly between network platforms and non-network platforms such as servers or endpoints.
- Multi-factor authentication. Use MFA for user and privileged accounts. Most embedded network devices support TACACS+ and RADIUS. Follow vendor hardening guidance for access control.
Central authentication also gives you one log to watch instead of one per device.
Quick check
Why do real users not notice a hard coded password backdoor?
The implanted code passes non-matching credentials to normal verification, so valid logins still work as before.
