Like Lightning From the Cloud: Finding RCEs in an Embedded TLS Library
summary
Researchers find eight critical flaws in a closed-source TLS library (nanoSSL) that lead to pre-auth remote code execution across Aruba switches, Avaya portals and APC Smart-UPS; one exploit is a heap overflow from a missing error check, another abuses TLS resumption to bypass cloud authentication. Extraction uses JTAG + RAM dumps and an automated Raspberry Pi rig to pull ~1,200 firmware chunks, VLAN/ARP manipulation to reach devices, and an installed payload that successfully disables and physically damages a UPS.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:03Software supply chain risk
- 3:13Analyzing NanoSSL
- 5:10Exploiting Aruba devices
- 8:41Vulnerabilities in Avaya
- 9:35Reverse engineering APC
- 15:20APC device exploitation
- 19:17Live demonstration
- 25:26Mitigation and conclusions
related talks
46mInfiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs
44mExposing Critical Threats In Millions Of Connected Devices
45mOutside the box: pwning IoT devices through their applications
45mThe Top 10 Web Hacks of 2014
39mNight of the living vulnerabilities
50mPwnie Awards 2016
39mDiving into Windows Remote Access Service for Pre-Auth Bugs
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions