A Peek Under the Blue Coat
summary
Detailed reverse engineering of Blue Coat ProxySG SGOS (appliance and VMware, versions up to 6.5) extracts bcfs images and ELF binaries, maps a tiny 800 KB kernel, and reveals a ring-zero kernel with no user/kernel isolation and C++ code rife with vtables. Static boot images are a bcfs read-only image with CRC/HMAC that was modified via a custom FUSE image-mounter used to edit images, debug mode exposes 200+ CLI extensions and a GDB stub via console magic bytes. Updates are signed but HMAC key was recovered in under two hours; no stack canaries, NX added recently; full analysis takes ~2–3 months.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:57Overview
- 1:33Blue Coat Proxy SG
- 3:32Goal of the study
- 5:07Proxy SG
- 7:09File System
- 10:24Boot Sequence
- 11:29File Structure
- 13:13CPD
- 14:36CFS
- 15:38Registry
- 16:59Binary
- 20:42Open Source
- 21:46How does it work
- 24:06Memory organization
- 25:57Tools
- 27:19Debugging
- 29:00CAG
- 29:14GDB
- 33:55Application Security
- 36:54Administration Interface
- 40:58Exploitability
- 43:01Conclusion
- 45:36Security Enhancements
- 47:40Questions
- 48:31Getting Access
- 49:19Feed Data
related talks
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
53mBehind the Scenes of Intel Security and Manageability Engine
20mThink eBPF for Kernel Security Monitoring
39mAn Overview of the Self Boot Engine (SBE) in POWER9 base OpenPOWER Systems
27mBreaking the Chain of Trust
36meBPF for Runtime Security
38mBootloaders Under Fire: Real-World Threats and Practical Defenses
14mWill eBPF Save Us From the Next Global Outage?