FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches

FIRESTARTER is a Linux ELF binary backdoor that targets Cisco Firepower devices running ASA or FTD software. It can persist through firmware updates and device reboots unless a hard power cycle occurs. The malware integrates into the device's boot sequence by manipulating a startup mount list and attempts to install hooks within LINA (the device's core engine) to enable execution of arbitrary shell code. It works in conjunction with LINE VIPER post-exploitation toolkit which can execute CLI commands, perform packet captures, bypass VPN AAA for actor devices, suppress syslog messages, harvest user CLI commands, and force delayed reboots. FIRESTARTER parses specially crafted WebVPN authentication requests containing magic packets to receive shellcode.