Breaking into Thousands of Cloud-Based VPNs with One Bug
Discloses a critical vulnerability in cloud-managed enterprise VPN platforms that allowed unauthenticated administrative takeover across thousands of corporate networks.
Summary
The Rise of Cloud-Managed Enterprise VPNs
Enterprises increasingly deploy cloud-managed VPN solutions to facilitate secure remote access for distributed workforces, relying on centralized SaaS dashboards for user provisioning and device policy enforcement.
Discovering Centralized Authentication Bypasses
David Cash and Rich Warren identify a critical architectural flaw in the cloud management control plane, where flawed SAML/OAuth session validation allowed unauthenticated attackers to elevate privileges to global tenant administrators.
National Tenant Compromise and Internal Network Pivoting
With global administrative access, researchers could manipulate client configuration profiles, deploy malicious routing rules, and gain unrestricted network access into thousands of corporate enterprise networks worldwide.
Hardening Cloud-Managed Network Infrastructure
Securing cloud VPN infrastructure requires enforcing strict tenant data isolation, conducting continuous cryptographic token validation, and mandating multi-party authorization for administrative configuration changes.
Related talks
Main Stage·39 min
David Cash · Rich Warren
Reveals an architectural vulnerability in cloud-managed enterprise VPNs that allowed unauthenticated administrative takeover and network pivoting across corporate tenants.
Main Stage·46 min
Bill Demirkapi
Demonstrates cross-tenant attacks and persistent firmware backdooring in major bare-metal cloud providers by exploiting legacy Baseboard Management Controllers.
Main Stage·37 min
Yakir Kadkoda · Michael Katchinskiy · Ofek Itach
Six critical attack vectors exploiting implicit and internal shadow resources created by AWS services to achieve cross-tenant and account takeover.