Compromise Infrastructure: Network Devices (T1584.008) is a resource development technique tagged PRE. The adversary compromises network devices that belong to someone else, such as small office and home office routers.
The target is often not the organization that owns the device. The device is a stepping stone.
How attackers use it
MITRE says the adversary's ultimate goal is not initial access to the environment that owns the device but using the device to support more targeting.
Once in control, adversaries can use the devices to launch more operations. MITRE lists hosting payloads for phishing campaigns, and enabling the access needed for content injection. They may also harvest reusable credentials from compromised devices.
MITRE notes that adversaries often target internet-facing edge devices and related appliances that specifically do not support strong host-based defenses. The devices can then support command and control, such as hiding infrastructure behind a proxy or botnet network.
This is why the unglamorous router in a branch office matters. It has few defenses, it faces the internet and nobody looks at it.
How to detect it
MITRE says that once adversaries use compromised network devices as infrastructure, it may be possible to look for unique characteristics of adversary software, if known. It also says that much of the activity is outside the visibility of the target organization.
For devices you own, general signals include:
- Configuration changes you did not make, including new administrative users, new DNS settings and new forwarding or proxy rules.
- Outbound connections from the device to unfamiliar hosts.
- Unexpected firmware versions, or a device that stopped reporting to your log collector.
- Login attempts against management interfaces from the internet.
How to reduce the risk
MITRE lists Pre-compromise as the mitigation. For the owner of a network device, these general practices apply.
- Replace devices that the manufacturer no longer supports. MITRE notes that end-of-life edge devices are commonly acquired for botnets.
- Do not expose management interfaces to the internet. Use a management network or VPN.
- Change default credentials and use unique credentials per device.
- Back up configurations and compare them with the running configuration on a schedule.
- Forward device logs to a central collector.
A practical starting move is to pick the five devices that face the internet at your most important sites and give each a short card: model, firmware version, support end date, management exposure and log destination. Anything with a gap on its card goes to the top of the work list. Small sites and branch offices deserve the same treatment, because adversaries do not care how big the building is.
Check your own environment
- Make a list of every internet-facing network device, with model, firmware version and support status.
- Check each one: is the management interface reachable from the internet? A scan from outside your network, using a tool you are authorized to use, answers this.
- Compare the running configuration with the last known good backup.
- Confirm that logs from each device reach your collector, and that someone looks at them.
Quick check
Is the device owner usually the final target in T1584.008?
Often not. MITRE says the goal may be to use the device to support additional targeting.
Why are edge devices attractive?
They are internet-facing and often do not support strong host-based defenses.
