Organizer
Partner Company
Breaking SD-WAN Crypto Protocols
Denis Kolegov, Maria Nedyak
Abstract
Software-defined networking in a wide area (SD-WAN) requires secure cryptographic protocols to protect control and data flows. In this talk, we will consider SD-WAN cryptographic protocols and their implementations. The main result presented in the talk will be devoted to IPsec UDP (IKE-less) protocol invented by SilverPeak company and employed within its Unity EdgeConnect SD-WAN product. We will introduce the IPsec UDP protocol in a way suitable for non-experts in cryptographic protocols and show that its design and implementation is totally compromised from a cryptographic perspective and fails to provide the claimed security properties. Additionally, we will discuss found vulnerabilities in other widely known SD-WAN products that can be exploited to reconstruct the cryptographic keys and decrypt all network traffic.
Speaker Info
Denis Kolegov is a principal security researcher at BI.ZONE. His research focuses on network security, cryptography engineering, and covert communications. He holds a Ph.D. and an associate professor degree. Denis presented at various international security conferences including Power of Community, DeepSec, Area41, and InsomniHack.
Maria Nedyak is a developer at BI.ZONE company, a student at Tomsk State University, and a member of the SiBears CTF team. Maria presented at HITB Lockdown and ZeroNights conferences.