HACKING THE BRAIN: Customize Evil Protocol to Pwn an SDN Controller

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Customize Evil Protocol to Pwn an SDN Controller
HACKING THE BRAIN
Feng Xiao, Ph.D. student at PennState, Cyber Security L...

What’s SDN?
func
Virtual
Switch
func
func
Control
Plane
Data
Plane
Software-Defined Networking (SDN) is an emerging archit...

What’s SDN Like Today?
Who are using?
• More than 15 popular controllers.
• More than 3000 open source SDN projects.
Who a...

Overview of SDN Attacks
Attack on Control Plane
• Topology tampering
• Control channel flooding
Attack on Data Plane
• Swi...

Pwn It Like A Hacker?
Software-Defined Networks
DecoupledControl Plane and Data Plane
Firewall
Load-
Balancing
Controller
...

Pwn It Like A Hacker?
Software-Defined Networks
DecoupledControl Plane and Data Plane
Our Choice:
Custom Attack
Firewall
L...

Custom Attack
Custom Protocol Field (CPF) in
legitimate protocol interactions
•CPF is controlled by data plane
•CPF will b...

Custom Attack
Custom Protocol Field (CPF) in
legitimate protocol interactions
•CPF is controlled by data plane
•CPF will b...

What Can It Cause?
Execute Arbitray SDN Commands
Steal Confidential Data
Crash/Disrupt Service
Disable Network Function
...

Threat Model
We do NOT assume that hackers can have network access
to SDN controllers or SDN applications
Control channel ...

Threat Model
We do NOT assume that hackers can have network access
to SDN controllers or SDN applications
Control channel ...

Attack Workflow
APPAPP
ServiceService
Routing
Link
Discovery ...
Service
Routing
Link
Discovery ...
O
P
E
N
F
L
O
W
N
E
T
...

Attack Workflow
APPAPP
ServiceService
Routing
Link
Discovery ...
Service
Routing
Link
Discovery ...
O
P
E
N
F
L
O
W
N
E
T
...

Attack Workflow
APPAPP
ServiceService
Routing
Link
Discovery ...
Service
Routing
Link
Discovery ...
O
P
E
N
F
L
O
W
N
E
T
...

Attack Workflow
APPAPP
ServiceService
Routing
Link
Discovery ...
Service
Routing
Link
Discovery ...
O
P
E
N
F
L
O
W
N
E
T
...

Hack Something Real!

Hack Something Real!

Hack Something Real!

Hack Something Real!

Hack Something Real!

Hack Something Real!

Hack Something Real!
Plaintext Key
Command
Execution
Path Traversal
XXE
XSS

Evaluation
5 popular SDN Controller
• Three open source projects (White-box)
• Two commercial products (Black-box)
54 apps...

Impact Analysis
Get System Shell (1 of them)
Execute Arbitray SDN Commands (5 of them)
Steal Confidential Data (7 of them)...

Demo
ONOS Remote Command Execution

Conclusions
The first attack that can remotely compromise SDN software stack to
simultaneously cause multiple kinds of att...

Thanks!
Email : f3ixiao@gmail.com
Homepage: http://fxiao.me
Twitter: @f3ixiao

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1058316 views
Storytelling For The Web: Integrate... by Chiara Aliotta 975190 views
Artificial Intelligence, Data and C... by OECD Directorate ... 912205 views
How to Leverage AI to Boost Employe... by SocialHRCamp 386594 views
2024 State of Marketing Report – by... by Marius Sescu 218858 views
Everything You Need To Know About C... by Expeed Software 235942 views

View on Slideshare

1 of 28 Ad

View on Slideshare

1 of 28 Ad