SD-WAN New Hope

Software-defined networking in a wide area network (SD-WAN) quickly becomes very popular in Enterprises. Vendors promise "on-the-fly agility, simplicity, security and automation" and many other benefits. What do you know about SD-WAN? What "security" means from a hands-on perspective? Are present SD-WAN products really secure?

The goal of this project is to give answers to these questions by exploring implementation security of real SD-WAN solutions from a practical point of view.

Papers

• SD-WAN Internet Census (preprint)
• SD-WAN Threat Landscape (preprint)
• Practical Security Assessment of SD-WAN Implementations
• SD-WAN Security: A Product Liability Insurance Law Would Certainly Help
• SD-WAN TLS Scanning (draft)

Knowledge Base

• SD-WAN Census Queries List
• SD-WAN Version Leakage List
• Silver Peak VXOA 8.1 Vulnerabilities

Public Reports

SilvePeak

• Malicious Portal Can Access REST API on EdgeConnect
• Malicious or Untrusted Orchestrator Can Access REST API on EdgeConnect
• SilverPeak’s IPsec UDP protocol implementation fails to provide forward secrecy
• Silverpeak EdgeConnect Multiple Vulnerabilities

Citrix

• Citrix SD-WAN Center Security Findings
• Citrix NetScaler SD-WAN Security Findings

Riverbed

• Riverbed SteelConnect Vulnerabilities

Viprinet

• Viprinet Virtual VPN Hub Stored XSS

Versa

• Versa Analytics Security Assessment

Checklists

• SD-WAN Security Assessment: The First Hours

Tools

• Grinder Framework
• SD-WAN Harvester
• SD-WAN Infiltrator

Slides

• SD-WAN Secure Communication Designs and Vulnerabilities. DeepSec 2019
• One Framework to Rule Them All: A framework for Internet-connected Device Census. OFFZONE 2019
• A dive in to SD-WAN Insecure Designs and Vulnerabilities. SecurityFest 2019
• SD-WAN New Hope. PHDays 2019
• SD-WAN Secure Communications. Yandex OSN Meetup 2019
• SD-WAN: Yet Another Way to Unsafe Internet. InsomniHack 2019
• SD-WAN Internet Census. Zero Nights 2018
• "WebGoat.SDWAN.Net" in Depth. Power of Community 2018
• Practical Threat Modeling for SD-WAN. Area 41 2018
• Too Soft[ware Defined] Networks: SD-WAN Vulnerability Assessment. Black Hat USA 2018

Talks

• SD-WAN Secure Communications Design and Vulnerabilities. DeepSec 2019
• SD-WAN Secure Communications. Yandex OSN Meetup 2019 (Russian)
• SD-WAN a New Hop. How to hack software defined network and keep your sanity? CCC 2018
• How To Hack SD-WAN And Keep Your Sanity? Ekoparty 2018

Contributors

• Sergey Gordeychik
• Alex Timorin
• Denis Kolegov
• Maxim Gorbunov
• Christoph Jaggi
• Nikolay Tkachenko
• Nikita Oleksov
• Oleg Broslavsky
• Anton Nikolaev
• Maria Nedyak