CISA Warns of Cyberattacks Targeting Unencrypted F5 BIG-IP Cookies

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning about cybercriminals abusing unencrypted persistent cookies in F5 BIG-IP systems. This new tactic enables attackers to map internal devices, making it easier to identify vulnerable machines and launch further attacks on enterprise networks. Organizations using F5 BIG-IP systems are now at greater risk if they haven’t yet implemented encryption for these cookies.

Unencrypted Cookies: A Key to Internal Network Mapping

CISA reports that attackers are leveraging unencrypted persistent cookies from the F5 BIG-IP Local Traffic Manager (LTM) module. These cookies are being exploited to scan internal, non-internet-facing devices on a targeted network. Once these devices are identified, threat actors can use the information to detect weaknesses and potentially exploit vulnerabilities within the network.

“CISA has observed cyber threat actors using unencrypted persistent cookies managed by the F5 BIG-IP LTM module to enumerate other internal devices on the network,” CISA warned in a recent advisory. “A malicious actor could use this information to identify additional network resources and exploit vulnerabilities in other devices.”

This method gives cybercriminals an edge by allowing them to map the internal structure of a network. Such mapping can be used in the early stages of a cyberattack, enabling hackers to identify high-value targets or critical infrastructure that may have vulnerabilities.

Understanding F5 BIG-IP and Its Vulnerability

F5 BIG-IP is a comprehensive suite of tools for managing application delivery and network traffic. It offers load balancing, security, and traffic management features that help organizations optimize server performance. One key module within this system is the Local Traffic Manager (LTM), which manages network traffic by distributing it across multiple servers. The LTM uses persistent cookies to ensure that clients, such as web browsers, are consistently directed to the same backend server.

These persistence cookies play a crucial role in managing server loads, but they come with a hidden risk: by default, the cookies are unencrypted. This exposes sensitive information such as IP addresses, port numbers, and load-balancing configurations to potential attackers.

“Cookie persistence ensures requests from the same client are directed to the same pool member after the BIG-IP system initially load-balances them,” according to F5’s official documentation.

However, the unencrypted nature of these cookies makes them easy prey for hackers. Encoded within them are details about the network’s infrastructure, and by exploiting them, attackers can gain insight into the network’s structure. This weakness can be especially dangerous if organizations haven’t updated to more secure configurations.

A Long-Standing Security Issue

The issue of unencrypted cookies in F5 BIG-IP systems is not new. Security researchers have warned for years about the risks of using unencrypted persistent cookies, which can allow attackers to discover internal servers or devices that aren’t typically exposed to the internet. These servers can then be scanned for potential vulnerabilities, increasing the likelihood of a network breach.

To make matters worse, tools like a Chrome extension have been developed to decode these cookies. While this was intended to help F5 administrators troubleshoot their systems, it also makes it easier for malicious actors to uncover sensitive network information.

CISA’s warning underscores the fact that cybercriminals are now actively exploiting these unencrypted cookies to carry out network reconnaissance and prepare for attacks.