Something Rotten in the State of Data Centers
summary
Finds eight critical zero‑days across a popular DDI appliance and an Avocent KVM that lead to complete tenant takeover and control of attached hosts. On the DDI an authenticated command injection plus a predictable PRNG seed (gced) lets attackers generate past/future session IDs after grabbing one via a malicious control server, aided by Frida and a DoS to force seed reinitialization (brute force cut to ~16.7M). On the KVM firmware is unpacked, CRC forged via check_image under QEMU, a persistent backdoor added (shell accessible as netcat on port 1337), and ASMP heap overflow / null‑byte login yield admin user creation.
AI-written summary · about
chapters (4)
- 0:00Data center vulnerabilities
- 1:07Project X DDI attack chain
- 21:38Avocent KVM exploit
- 38:59Key takeaways
related talks
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
38mFail Harder: Finding Critical 0-Days in Spite of Ourselves
41mfirmWar: An Imminent Threat to the Foundation of Computing
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
39mNight of the living vulnerabilities
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
26mHacking buildings: Security flaws in embedded building control systems