SD-WAN: Disruptive Technology That Requires Careful Security Consideration

guest · Sep 11, 2019

SD-WAN: Disruptive Technology That Requires Careful Security Consideration
September 10, 2019
https://www.securityweek.com/sd-wan-disruptive-technology-requires-careful-security-consideration

A recent survey has shown that software defined wide area network (SD-WAN) is the most disruptive of the current crop of disruptive technologies. An August 2019 survey found that SD-WAN disruption is affecting companies of all sizes, although at a greater rate among smaller companies with a revenue size of less than $10 million.
The author of that survey, Avant Communications, has now expanded those findings in a deep dive (PDF) into the SD-WAN market and market expectations.

But while the business case for SD-WAN is clear (IDC expects the market to expand at a 30.8% compound annual growth rate -- CAGR -- from 2018 to 2023, reaching $5.25 billion; while Frost and Sullivan expects it to reach $4.4 billion by the same time), Avant warns that any new technology or infrastructure will almost always expand the cybersecurity attack surface.

"While SD-WAN adoption is booming, selecting the proper solution is a complex task," said Ian Kieninger, CEO and co-founder at AVANT. "Organizations must take the time to evaluate the applications they will need to support, as well as the security and geographic needs that must be met."
Click to expand...

Avant: Everything You Need to Know About Adopting SD-WAN
"SD-WAN 6-12 Report" (PDF - 1.98 MB): https://goavant.net/avantcommunications/media/AllFiles/6-12-SD-WAN-ONLINE-v2.pdf

guest · Jun 13, 2020

SD-WAN is the top choice for cloud security
June 12, 2020
https://www.itproportal.com/news/sd-wan-is-the-top-choice-for-cloud-security/

Software-defined wide area network (SD-WAN) is the preferred choice for cloud security among UK businesses, according to a new report from Barracuda Networks.

Based on a poll of businesses in various sectors, the report states that half of UK businesses are either already employing SD-WAN, or plan to do so within the next 12 months.
Among companies that have added security to their public cloud, more than a quarter use SD-WAN (27 percent), and another third backs it as their preferred additional security solution.

In terms of individual industries, the construction and property sector in EMEA has adopted SD-WAN most widely (80 percent), followed by IT, technology and telecoms (76 percent).
Click to expand...

“As more organisations move to the public cloud, SD-WAN technology is a critical part of securing these cloud deployments,” said Klaus Gheri, VP Network Security at Barracuda. “By deploying an all-in-one, secure SD-WAN solution natively built into the public cloud network, organisations can reap the full benefits of public cloud.”
Click to expand...

guest · Jun 26, 2020

SD-WAN security explained
June 25, 2020
https://cybersecurity.att.com/blogs/security-essentials/sd-wan-security-explained

Software-defined wide area networking (SD-WAN) is a distributed networking approach that provides organizations a sustainable alternative to high latency hub-and-spoke network topologies.
The security gap with SD-WAN
The mesh networking topology of SD-WAN maximizes application performance and reliability, and the flexibility in transport services helps bring down IT costs. Additionally, an SD-WAN's virtualized console still offers centralized management and visibility into all of these connections.

However, the SD-WAN model breaks the existing centralized security inspection that most organizations have built into their hub-and-spoke network architectures.
Click to expand...

guest · Jul 8, 2020

SD-WAN goes mainstream in remote work surge but network visibility, security are concerns
July 8, 2020
https://www.computerweekly.com/news...-but-network-visibility-security-are-concerns

Relentless technological advances and “tremendous” disruption from the Covid-19 pandemic have driven IT teams to require better visibility into the network, says research from Viavi Solutions.

The latest State of the network study from the global provider of network test, monitoring and assurance systems drew insights about network trends and challenges faced by IT teams. Results were compiled from more than 400 respondents, including network engineers, IT directors, security engineers and CIOs from around the world.
Viavi noted that SD-WAN deployment, application troubleshooting, security monitoring and remediation all rely on comprehensive network visibility to be most effective.

The survey also confirmed that the trend for the last year or so for increased SD-WAN adoption has gone mainstream, with the primary motivations for deployment being cost savings (58%) and business continuity (50%).
Click to expand...

guest · Nov 11, 2020

SD-WAN takeover
Silver Peak addresses three-pronged RCE exploit in Unity Orchestrator
Chained attack could ‘shut down a company’s entire international network’
November 11, 2020
https://portswigger.net/daily-swig/...ree-pronged-rce-exploit-in-unity-orchestrator

Silver Peak’s Unity Orchestrator, a centralized SD-WAN management platform, contained three security vulnerabilities that, chained together, could result in pre-authenticated remote code authentication (RCE).

Users have been urged to upgrade their systems after Silver Peak patched the authentication bypass, file delete path traversal, and arbitrary SQL query execution flaws.
Combining these flaws, security researchers from Realmode Labs found that attackers could run arbitrary code by finding a file being run by the web server and deleting it using the file delete path traversal issue, then recreating it through the SQL query execution endpoint, which triggered file execution.

“In the best case scenario, an attacker can use these vulnerabilities to intercept or steer traffic,” said Ariel Tempelhof, co-founder and CEO of the Tel Aviv-based cybersecurity firm, in a Medium post outlining the findings.
Silver Peak says there are currently around 2,000 deployments of Unity Orchestrator.
Click to expand...

The findings are the first part of a four-part series of blog posts disclosing chained RCE exploits – all remedied – affecting leading SD-WAN products.
SD-WAN solutions simplify and optimize the management of WANs by decoupling networking hardware from its control mechanism.

The California-based company, which was recently acquired by Hewlett-Packard Enterprise, was alerted to the vulnerabilities on August 9, and issued software updates addressing the flaws on October 30.
Click to expand...

guest · Nov 16, 2020

Network takeover alert
Citrix patches RCE flaw in SD-WAN Center that could lead to network takeover
November 16, 2020
https://portswigger.net/daily-swig/...an-center-that-could-lead-to-network-takeover

Enterprises that use the Citrix SD-WAN Center (SDWC) have been urged to update their systems to protect their networks from malicious takeover.

Security researchers from Realmode Labs issued the warning after chaining an authentication bypass flaw in the Collector endpoint with a stop_ping shell injection to achieve pre-authenticated remote code execution (RCE).

“This is a major vulnerability which allows someone to intercept traffic or take down your whole international network,” said Ariel Tempelhof, co-founder and CEO of the Tel Aviv-based cybersecurity firm of the bug, which is being tracked as CVE-2020-8271.
A blog post published yesterday (November 15) also documents the discovery of an authentication bypass in ConfigEditor (CVE-2020-8272) and a shell injection on the CreateAzureDeployment endpoint (CVE-2020-8273).
Click to expand...

Citrix has by far the largest share of the rapidly growing global $1.4 billion SD-WAN market.

The research is the second instalment of a four-part series of Realmode Labs blog posts uncovering now-remedied RCE chains in four popular SD-WAN platforms.
As reported by The Daily Swig last week, the series kicked off with Silver Peak’s Unity Orchestrator.
Click to expand...

In a security advisory issued on November 10, Citrix advised users to update to Citrix SD-WAN 11.2.2, 11.1.2b, or 10.2.8.

“From a developer perspective, these kinds of bugs are the hardest to spot. That's why we believe every integration with a 3rd party framework should undergo a security assessment before proceeding to production.”
Click to expand...

guest · Nov 20, 2020

VMware SD-WAN Vulnerabilities Expose Enterprise Networks to Attacks
CVSSv3 base score of 7.1
November 19, 2020
https://www.securityweek.com/vmware-sd-wan-vulnerabilities-expose-enterprise-networks-attacks

Three of the vulnerabilities were reported to VMware by Israel-based cybersecurity consulting firm Realmode Labs. VMware has described the security holes as a high-severity SQL injection bug that can allow unauthorized access to data, a medium-severity directory traversal issue that can lead to arbitrary code execution, and a medium-severity problem related to default passwords.

However, Ariel Tempelhof, co-founder and CEO of Realmode Labs, told SecurityWeek that some of the vulnerabilities they’ve found can be chained for unauthenticated remote code execution.
Exploitation can lead to “traffic steering or even a complete shutdown of the network of a multinational company,” Tempelhof said.
Click to expand...

It’s worth noting that Realmode Labs recently also found serious remote code execution vulnerabilities in Silver Peak’s Unity Orchestrator and Citrix SD-WAN. The company has already published blog posts describing those findings and it will soon detail the VMware flaws as well.
Click to expand...

guest · Nov 28, 2020

VMware patches security flaws leading to RCE in SD-WAN Orchestrator
Research concludes four-part series unearthing RCE chains in ‘single point of failure’ SD-WAN products
November 27, 2020
https://portswigger.net/daily-swig/...y-flaws-leading-to-rce-in-sd-wan-orchestrator

VMware has fixed vulnerabilities in its VeloCloud SD-WAN Orchestrator that, chained together, can lead to unauthenticated remote code execution (RCE).

Researchers from Realmode Labs combined authentication bypass, SQL injection, and directory traversal vulnerabilities to leave arbitrary JavaScript running in node.js.
The revelation marks the conclusion of a blog series documenting potentially calamitous RCE chains in four SD-WAN products from major vendors.

Centrally controlling an enterprise’s network topology, SD-WAN (Software-defined Wide Area Network) products represent “a crucial single point of failure from a security perspective”, Ariel Tempelhof, co-founder and CEO of Tel Aviv-based Realmode Labs, said in a blog post mapping the VMware RCE chain.
Click to expand...

guest · Nov 30, 2020

SD-WAN Product Vulnerabilities Allow Hackers to Steer Traffic, Shut Down Networks
November 30, 2020
https://www.securityweek.com/sd-wan...llow-hackers-steer-traffic-shut-down-networks

Realmode Labs has published four blog posts this month describing the vulnerabilities found by Ariel Tempelhof and Yaar Hahn in SD-WAN solutions from VMware, Cisco, Citrix and Silver Peak, which HP acquired earlier this year. Tempelhof told SecurityWeek that the details of the vulnerabilities were disclosed after each of the impacted vendors released patches within 90 days.

• In Silver Peak’s Unity Orchestrator, the researchers discovered a total of three vulnerabilities, including an authentication bypass issue and two flaws that can be chained for remote code execution.
• In Citrix’s SD-WAN Center, they identified two authentication bypass bugs — one of them impacted the CakePHP web framework — and two shell injections, which also could have been exploited for remote code execution.
• In Cisco’s SD-WAN (Viptela) vManage network management system they found four vulnerabilities [...]
• The security holes found in VMware’s SD-WAN (VeloCloud) Orchestrator product can also allow remote code execution.
Click to expand...

“For each vendor we studied the central management unit of their SD-WAN topology,” Tempelhof explained. “Gaining unrestricted access to this allows the attacker to set the way traffic is being routed in the international network of the company. This may lead to traffic steering or even complete shutdown of the company's network.”

He pointed out that all of the analyzed products were developed by relatively small companies — ones that were not security-focused — that have been acquired by major organizations.

“We're wondering what was the security assessment due diligence during this transition (if any) and what should they've done better in the process.”
Click to expand...

guest · Aug 23, 2021

Virgin Media Business to provide SD-WAN service to customers
August 23, 2021
https://www.siliconrepublic.com/comms/virgin-media-business-sd-wan

Telecoms provider Virgin Media Business has launched a new software solution for businesses to improve their networking and security.

The Virgin Media subsidiary, which caters solely to businesses, launched its SD-WAN (software-defined wide area network) for clients to overcome common IT challenges, such as bandwidth problems and cloud connectivity.
Unlike traditional WAN models, SD-WAN can be used by SaaS companies in multiple clouds without compromising on security.

“As part of the SD-WAN journey, we will manage every step of the migration, from planning to delivery of service,” she said.
Click to expand...

The new service comes following Virgin Media Business’s strategic partnerships dating back more than three years with Irish company Innovate and networking giant Cisco to develop improvements to WAN and SD-WAN technologies.
Click to expand...

Log in or Sign up

SD-WAN: Disruptive Technology That Requires Careful Security Consideration

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

SD-WAN: Disruptive Technology That Requires Careful Security Consideration

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches