The Channel logo


By | John Leyden 5th March 2008 14:27

Networks left open to SNMP scans

Minority of networks leave out welcome mat for hackers

Some sysadmins are leaving their networks open to hacking attack by allowing Simple Network Management Protocol (SNMP) configurations to be read across the internet.

Using SNMP scans, a range of devices including Windows servers, BT Voyager 2000 routers, and HP JetDirect printers might be prompted to cough up username credentials and passwords, according to Adrian Pastor of GNUCitizen.

SNMP is a core component of the internet management architecture and is used in tools such as HP Openview and Cisco Works. The protocol is unsecured, but defending against attacks is a simple matter of blocking external SNMP requests at the firewall.

However, a scan of 2.5 million random IP addresses by GNUCitizen revealed that 5,320 (about one in 500) responded to the submitted SNMP requests. Read access to SNMP configuration lets hackers spy on targeted networks.

The security weakness might easily enable hackers to change device configurations using a spoofed IP address - if a valid write community string is identified or cracked. This invasive hacking attack was not tested by the GNUCitizen scan.

Read-only access might be bad news, Pastor notes. "Even if a cracker only gained read access to a device or server via a SNMP community string, sometimes it would be possible to extract sensitive information such as user names and passwords which would eventually lead to a compromise of the targeted systems." ®

comment icon Read 6 comments on this article alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


Suit-and-tie-wearing man tries to meditate, take deep breaths in faux yoga pose. Photo by Shutterstock
Emotional intelligence, not tech skills, is the way to woo suits
League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe