Pull the Plug: FIRESTARTER Survives Patches, Reboots, and Your Incident Response Plan

FIRESTARTER is a sophisticated malware that infects Cisco ASA (Adaptive Security Appliance) and Firepower devices. It embeds itself into the boot-time configuration of these network appliances, allowing it to survive security patches and reboots, thereby providing attackers with persistent access.

Here are some key points about FIRESTARTER:

1. Persistence Mechanism:

   • The malware infects the device's boot-time configuration script (CSP_MOUNT_LIST) and places a copy of itself in a reboot-persistent location (/opt/cisco/platform/logs/var/log/svc_samcore.log).

2. Triggering Mechanism:

   • It uses a modified XML handler within LINA to trigger execution via WebVPN requests with specific payloads.

3. Survival Against Updates:

   • The malware remains active even after applying security patches or rebooting the device, as it leverages the boot-time configuration for persistence.

4. Detection:

   • CISA has released YARA rules (CISA_261290_01 and CISA_261290_02) to detect FIRESTARTER in core dumps or disk images.
   • Artifacts such as `/

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.