"Software-Defined Networking (SDN) is now widely deployed in production environments with an ever-growing community. Though SDN's software-based architecture enables network programmability, it also introduces dangerous code vulnerabilities into SDN controllers. However, the decoupled SDN control plane and data plane only communicate with each other with pre-defined protocol interactions, which largely increases the difficulty of exploiting such security weaknesses from the data plane. In this talk, we extend the attack surface and introduce Custom Attack, a novel attack against SDN controllers that leverages legitimate SDN protocol messages (i.e., the custom protocol field) to facilitate Java code vulnerability exploitation. Our research shows that it was possible for a weak adversary to execute arbitrary command or manipulate data in the SDN controller without accessing the SDN controller or any applications, but only controlling a host or a switch. To the best of our knowledge, Custom Attack is the first attack that can remotely compromise SDN software stack to simultaneously cause multiple kinds of attack effects in SDN controllers. Till now we have tested 5 most popular SDN controllers and their applications and found all of them are vulnerable to Custom Attack in some degree. 14 serious vulnerabilities are discovered, all of which can be exploited remotely to launch advanced attacks against controllers (e.g., executing arbitrary commands, exfiltrating confidential files, crashing SDN service, etc.). This presentation will include: an overview of SDN security research and practices. a new attack methodology for SDN that is capable of compromising the entire network. our research process that leads to these discoveries, including technical specifics of exploits. showcases of interesting Custom Attack chains in real-world SDN projects. "

1. Customize Evil Protocol to Pwn an SDN Controller
HACKING THE BRAIN
Feng Xiao, Ph.D. student at PennState, Cyber Security Lab
Jianwei Huang, Researcher at Wuhan University
Peng Liu, Professor at PennState, Cyber Security Lab

2. What’s SDN?
func
Virtual
Switch
func
func
Control
Plane
Data
Plane
Software-Defined Networking (SDN) is an emerging architecture that
decouples the network control and forwarding functions.

3. What’s SDN Like Today?
Who are using?
• More than 15 popular controllers.
• More than 3000 open source SDN projects.
Who are contributing?
• Data Center
• IDC
• Telecom
• …

4. Overview of SDN Attacks
Attack on Control Plane
• Topology tampering
• Control channel flooding
Attack on Data Plane
• Switch OS Hacking
• TCAM Flooding
Controller
APP
N
E
T
C
O
N
F
Control
Plane
APP APP
O
P
E
N
F
L
O
W
O
V
S
D
BData
Plane

5. Pwn It Like A Hacker?
Software-Defined Networks
DecoupledControl Plane and Data Plane
Firewall
Load-
Balancing
Controller
OpenFlow OVSDB
Control Channel
…
…
Switch Host
Infrastructure
…

6. Pwn It Like A Hacker?
Software-Defined Networks
DecoupledControl Plane and Data Plane
Our Choice:
Custom Attack
Firewall
Load-
Balancing
Controller
OpenFlow OVSDB
Control Channel
…
…
Switch Host
Infrastructure
…

7. Custom Attack
Custom Protocol Field (CPF) in
legitimate protocol interactions
•CPF is controlled by data plane
•CPF will be processed by components
in the controller
Infrastructure
Service
APP L
I
B
R
A
R
I
E
S
Controller

8. Custom Attack
Custom Protocol Field (CPF) in
legitimate protocol interactions
•CPF is controlled by data plane
•CPF will be processed by components
in the controller
Infrastructure
Service
APP L
I
B
R
A
R
I
E
S
③ ⑥
Controller
CPF results in a semantic gap between
control plane and data plane

9. What Can It Cause?
Execute Arbitray SDN Commands
Steal Confidential Data
Crash/Disrupt Service
Disable Network Function
...

10. Threat Model
We do NOT assume that hackers can have network access
to SDN controllers or SDN applications
Control channel is well protected by SSL/TLS

11. Threat Model
We do NOT assume that hackers can have network access
to SDN controllers or SDN applications
Control channel is well protected by SSL/TLS
A compromised host[1] or switch[2]
[1] exploitable if the target network is configured with in-band control.
[2] Switches are vulnerable to multiple remote attacks (e.g., Buffer Overflow[CVE-2016-2074]).

12. Attack Workflow
APPAPP
ServiceService
Routing
Link
Discovery ...
Service
Routing
Link
Discovery ...
O
P
E
N
F
L
O
W
N
E
T
C
O
N
F
O
V
S
D
B
Controller
Infrastructure
CPF Injection

13. Attack Workflow
APPAPP
ServiceService
Routing
Link
Discovery ...
Service
Routing
Link
Discovery ...
O
P
E
N
F
L
O
W
N
E
T
C
O
N
F
O
V
S
D
B
Controller
Infrastructure
CPF Injection
①
CPF delivery via legitimate
protocol interactions
Crafted
Protocol Message

14. Attack Workflow
APPAPP
ServiceService
Routing
Link
Discovery ...
Service
Routing
Link
Discovery ...
O
P
E
N
F
L
O
W
N
E
T
C
O
N
F
O
V
S
D
B
Controller
Infrastructure
CPF Injection
①
②
Payload transformation for
final exploitation
Payload in Form 1
CPF delivery via legitimate
protocol interactions
Crafted
Protocol Message

15. Attack Workflow
APPAPP
ServiceService
Routing
Link
Discovery ...
Service
Routing
Link
Discovery ...
O
P
E
N
F
L
O
W
N
E
T
C
O
N
F
O
V
S
D
B
Controller
Infrastructure
CPF Injection
①
③
Subvert SDN Controller
Payload in Form N
②
Payload transformation for
final exploitation
Payload in Form 1
CPF delivery via legitimate
protocol interactions
Crafted
Protocol Message

16. Hack Something Real!

17. Hack Something Real!

18. Hack Something Real!

19. Hack Something Real!

20. Hack Something Real!

21. Hack Something Real!

22. Hack Something Real!
Plaintext Key
Command
Execution
Path Traversal
XXE
XSS

23. Evaluation
5 popular SDN Controller
• Three open source projects (White-box)
• Two commercial products (Black-box)
54 apps
• Analyze 12 protocols
• Identify 476 dangerous function calls
19 zero-day vulnerabilities
• Construct 24 sophisticated exploit chains

24. Impact Analysis
Get System Shell (1 of them)
Execute Arbitray SDN Commands (5 of them)
Steal Confidential Data (7 of them)
Crash/Disrupt Service (11 of them)

25. 0day Profile

26. Demo
ONOS Remote Command Execution

27. Conclusions
The first attack that can remotely compromise SDN software stack to
simultaneously cause multiple kinds of attack effects in SDN
controllers.
The data-plane-based attack surface is actually significantly larger
than what has been discovered.
Service-logic-free vulnerabilities in the controller could be exploited
in unexpected ways to conquer the difficulty brought in by pre-
defined protocol interactions.

28. Thanks!
Email : f3ixiao@gmail.com
Homepage: http://fxiao.me
Twitter: @f3ixiao