AUTOMATED DETECTION OF VULNERABILITIES IN BLACK-BOX ROUTERS (AND OTHER NETWORK DEVICES) presented at blackhat 2017

by Gabi Nakibly,

Summary : Network protocols are based on open standards. However, the Internet runs mostly on proprietary and closed-source network devices such as routers and switches of big-name vendors like Cisco, Juniper and Huawei. A slight deviation in a vendor's implementation of a standard protocol may weaken the robustness and security of the protocol, thus creating a logical vulnerability an attacker may be able to exploit. Such logical vulnerabilities will likely affect many models of devices made by that vendor. However, finding these logical vulnerabilities in protocol implementations of routers demands great efforts to reverse-engineer them.
In this work, we present a tool that leverages a formal black-box method to unearth deviations of protocol implementations in closed-source network devices with no need to access the binary or source code of the device. Our tool finds such deviations in a fully automatic manner while leveraging a model-based testing approach. We applied the tool to several routers to check their routing protocols' implementations (specifically OSPF) using the tool we found logical vulnerabilities in several commercial routers by Cisco, Quagga and others. The vulnerabilities affect in total hundreds of models of routers.
This is a joint work with Adi Sosnovich and Orna Grumberg.