Jacob Baines - Help Me Vulnerabilities, You're My Only Hope
Presents a practical exploitation guide for finding and exploiting memory corruption vulnerabilities in network security devices and embedded Linux systems.
Summary
Exploiting Network Security Appliances
Jacob Baines (Vulnerability Researcher, Tenable) presents a practical guide to finding and exploiting memory corruption vulnerabilities in network security appliances — routers, firewalls, VPN concentrators, and UTM devices.
Attack Surface Overview
Network security appliances run stripped-down embedded Linux with minimal exploit mitigations (often no ASLR, NX, or stack canaries due to legacy toolchains), exposed attack surface through management web interfaces, and privileged network positions.
Vulnerability Discovery Methodology
Baines presents a structured approach: firmware extraction (UART/JTAG/download), static analysis with Ghidra to identify dangerous function calls (strcpy, sprintf in HTTP handlers), and targeted fuzzing using AFL with custom network protocol mutators.
Heap Exploitation Techniques
The talk covers heap exploitation techniques adapted for embedded Linux environments — glibc heap internals at 2.27, fastbin attacks, and tcache poisoning — applied to real CVEs in Fortinet and Cisco management interfaces.
Related talks
CSIT Village·22 min
Koh Kian Woon
Koh Kian Woon examines as AI accelerates development and increases system complexity, robust defence-in-depth and deep technical expertise are becoming increasingly critical for defenders.
Briefings·35 min
Yuhao Jiang · Xinlei Ying · Ziming Zhang
VMware ESXi appears to be increasingly secure, as indicated by fewer CVEs and 0 success at Pwn2Own.
