Hunting Bugs in the Tropics: Auditing Aruba Enterprise Networks
Daniel Jensen details hunting for vulnerabilities across Aruba's on-premises network management and wireless controller appliances, uncovering pre-auth RCE.
Summary
The Threat Surface of Enterprise Network Appliances
Aruba Networks produces central management appliances (AirWave, ClearPass, Mobility Controllers) that govern entire corporate wireless and wired infrastructures.
Reverse Engineering Proprietary Aruba Daemons
Daniel Jensen audits embedded Linux firmware, dissecting custom C/C++ daemons, Java web services, and internal communication protocols.
Discovering Pre-Authentication Remote Code Execution Flaws
Jensen demonstrates chaining unauthenticated protocol manipulation, deserialization flaws, and command injection to obtain root access on target controllers.
Remediation and Enterprise Network Hardening
The presentation provides network engineers with advice on isolating management interfaces and managing vendor firmware updates.
Related talks
Main Stage·39 min
Octavio Gianatiempo · Octavio Galland
Octavio Gianatiempo and Octavio Galland audit top-selling consumer routers, discovering systemic OEM firmware vulnerabilities that enable zero-click remote RCE.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.