Defending Telco Networks#

Anthony Schofield — Vocus

• Why: A concrete, staged attack/defense walkthrough of router-plane compromise using only native device functionality — exactly the operational security depth the PM values, and unusually detailed for an operator conference.
• What: An LOTL (living-off-the-land) kill chain against telco gear, explicitly derived from Vocus wargames/tabletops, not production: (1) initial access via an exposed SNMPv2 RW community on a BNG — legacy "best practice" strings now brute-forceable; config exfiltrated via SNMP-set copy-to-TFTP, then an SSH backdoor provisioned via SNMP sets; (2) credential harvesting using the router's own packet-capture utility to grab RANCID credentials and the TACACS+ secret, decrypted offline; (3) lateral movement on the rancid service account — indistinguishable from normal rancid logins, hiding in plain sight; (4) persistence via IOS XR application-hosting to spawn an SSH daemon (port 57722) in the underlying Linux shell. Defenses per stage: control-plane ACL compliance automation, SNMP brute-force alerting, RadSec, SIEM alerting on "Configured from x.x.x.x by SNMP" (should never happen), least-privilege lockdown of service accounts and jump hosts, no device-to-device lateral movement, MFA on jump hosts, microsegmentation, retiring legacy, plus passkeys/EDR/NDR.
• How: Live demos against a real, internet-connected lab ("Bozo Networks", documented at bozo.net.au), each attack stage paired with specific countermeasures; references the CISA/ASD joint advisory of 28 August.
• Where applicable: Explicitly hypothetical/wargame material, not a production postmortem — but the patterns (SNMP RW, RANCID credential risk, vendor Linux shells on routers) are generic and apply to any operator with legacy Cisco gear. Cisco-centric examples; the control-plane discipline transfers to any vendor.