Do Not Trust the ASA, Trojans: Implanting Cisco ASA Firewalls
Jacob Baines demonstrates reverse engineering Cisco ASA firewalls, implanting persistent firmware backdoors, and subverting integrity verification checks.
Summary
Cisco ASA as High-Value Perimeter Targets
Cisco Adaptive Security Appliances (ASA) guard corporate network perimeters, making them prime targets for state-sponsored persistence and espionage.
Reverse Engineering Cisco ASA OS and ROMMON Bootloaders
Jacob Baines analyzes the x86 64-bit Linux-based architecture of modern ASA software and its hardware integrity checking mechanisms.
Developing In-Memory and Persistent Firmware Implants
Baines demonstrates modifying firmware images, bypassing code-signing verifications, and hooking core packet processing functions to establish stealthy C2 channels.
Forensics and Verification Techniques for Network Defenders
The author shares forensic scripts and memory inspection methodologies to help network administrators detect backdoored ASA firewalls.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.