Automated Discovery of Cross - Plane Event - Based Vulnerabilities in - PowerPoint PPT Presentation

Automated Discovery of Cross - Plane Event - Based Vulnerabilities in Software - Defined Networking Benjamin E. Ujcich 1 , Samuel Jero 2 , Richard Skowyra 2 , Steven R. Gomez 2 , Adam Bates 1 , William H. Sanders 1 , and Hamed Okhravi 2 1 University of Illinois at Urbana - Champaign, 2 MIT Lincoln Laboratory 2020 Network and Distributed System Security Symposium (NDSS) February 25, 2020 San Diego, CA, USA

SDN is Everywhere! 2

Network “Appification” 3

Network “Appification” Do apps work well together? 4

Network “Appification” How can they be exploited? 5

Cross - Plane Vulnerabilities Reactive Event - Based Control Plane CONTROL PLANE DATA PLANE Flow rule Packets from configuration hosts SDN data SDN data plane input plane output 6

Cross - Plane Vulnerabilities Event App event dispatch listener SDN data plane SDN data plane … input (e.g., output (e.g., packets) flow rules) App event listener Reactive Event - Based Control Plane 7

Cross - Plane Vulnerabilities Event App event dispatch listener Event App event … dispatch listener SDN data plane App event SDN data plane … input (e.g., listener output (e.g., packets) flow rules) App event listener … Reactive Event - Based Control Plane 8

Cross - Plane Vulnerabilities Event … App event dispatch listener Event App event API … dispatch listener call SDN data plane App event SDN data plane … input (e.g., listener output (e.g., packets) flow rules) App event listener … Reactive Event - Based Control Plane 9

Cross - Plane Vulnerabilities: Exploitation Target: New Event Vector: Spoofed flow rules; … App event dispatch packets via removal of old listener Event malware flow rules App event API … dispatch listener call SDN data plane App event SDN data plane … input (e.g., listener output (e.g., packets) flow rules) App event listener … Malicious Insight: Missing event handling information can be exploited flow 10

Data Plane Hosts as Attack Vectors § Cross - app study led to App 2 App 3 App 1 explore hosts as attackers Northbound § Discovered ONOS data plane SDN API Controller firewall vulnerability à CONTROL PLANE arbitrary lateral DATA PLANE Southbound API Maliciously movement crafted § Reported to ONOS traffic Access developers (CVE 2018 - 12691) control bypassed 11

Anatomy of an Exploit 1. The access control app ( acl ) is activated and registers for any host events (A). acl app fwd app ONOS Controller ACL Rules Host Flow A Manager Manager CONTROL PLANE DATA PLANE Southbound API Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 12

Anatomy of an Exploit 1. The access control app ( acl ) is activated and registers for any host events (A). The network operator adds access control policies (B). acl app AclRule B fwd app object ONOS Controller ACL Rules 10.0.0.1 à 10.0.0.2, Host Flow A DENY Manager Manager CONTROL PLANE DATA PLANE Southbound API Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 13

Anatomy of an Exploit 2. Host 1 sends a syntactically correct but semantically invalid ICMP packet with host 1’s MAC address into the data plane. acl app fwd app ONOS Controller ACL Rules AclRule Host Flow Manager Manager CONTROL PLANE DATA PLANE Southbound API Switch ICMP Echo Request (1) Flow table IP src: 0.0.0.0 Host 2 Host 1 IP dst: 255.255.255.255 (victim) Port Port MAC src: 00:00:00:00:00:01 (malicious) 1 2 IP: 10.0.0.2 14

Anatomy of an Exploit 3. ONOS sees the packet (A) acl app fwd app ONOS Controller ACL Rules AclRule Host Flow Manager Manager CONTROL PLANE A ICMP Echo DATA PLANE Southbound API Request (1) Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 15

Anatomy of an Exploit 3. ONOS sees the packet (A) and registers a new host with its MAC address but not IP address (B). acl app fwd app ONOS Controller ACL Rules Host object B AclRule MAC: Host Flow 00:00:00:00:00:01 Manager Manager IPs: [none] CONTROL PLANE A ICMP Echo DATA PLANE Southbound API Request (1) Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 16

Anatomy of an Exploit 3. ONOS sees the packet (A) and registers a new host with its MAC address but not IP address (B). It generates a HOST_ADDED event (C). C HostEvent object acl app HOST_ADDED fwd app ONOS Controller ACL Rules Host object B AclRule MAC: Host Flow 00:00:00:00:00:01 Manager Manager IPs: [none] CONTROL PLANE A ICMP Echo DATA PLANE Southbound API Request (1) Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 17

Anatomy of an Exploit 4. The acl app sees the HOST_ADDED event (A) A HostEvent object acl app HOST_ADDED fwd app ONOS Controller ACL Rules Host object AclRule MAC: Host Flow 00:00:00:00:00:01 Manager Manager IPs: [none] CONTROL PLANE ICMP Echo DATA PLANE Southbound API Request (1) Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 18

Anatomy of an Exploit 4. The acl app sees the HOST_ADDED event (A) and host (B), but since the host doesn’t have an IP, the app does not insert flow deny rules. A HostEvent object acl app HOST_ADDED fwd app ONOS Controller ACL Rules B Host object AclRule MAC: Host Flow 00:00:00:00:00:01 Manager Manager IPs: [none] CONTROL PLANE ICMP Echo DATA PLANE Southbound API Request (1) Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 19

Anatomy of an Exploit 4. The acl app sees the HOST_ADDED event (A) and host (B), but since the host doesn’t have an IP, the app does not insert flow deny rules. AclManager.java processing host events AclManager.java handling new host events ✕ ✓ No IP addresses ✕ Never gets called 20

Anatomy of an Exploit 5. Host 1 attempts to send regular traffic to its desired victim destination (host 2). Since no matching flows exist, ONOS handles the packet. acl app fwd app ONOS Controller ACL Rules Host object AclRule MAC: Host Flow 00:00:00:00:00:01 Manager Manager IPs: [none] CONTROL PLANE DATA PLANE Southbound API Switch ICMP Echo Request (2) Flow table IP src: 10.0.0.1 Host 2 Host 1 IP dst: 10.0.0.2 (victim) Port Port MAC src: 00:00:00:00:00:01 (malicious) 1 2 IP: 10.0.0.2 21

Anatomy of an Exploit 6. ONOS registers host 1’s new IP address (A) acl app fwd app ONOS Controller ACL Rules Host object A AclRule MAC: Host Flow 00:00:00:00:00:01 Manager Manager IPs: [ 10.0.0.1 ] CONTROL PLANE ICMP Echo DATA PLANE Southbound API Request (2) Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 22

Anatomy of an Exploit 6. ONOS registers host 1’s new IP address (A) as a HOST_UPDATED event (B). acl does not handle HOST_UPDATED events, so it does nothing. B HostEvent object acl app HOST_UPDATED fwd app ONOS Controller ACL Rules Host object A AclRule MAC: Host Flow 00:00:00:00:00:01 Manager Manager IPs: [ 10.0.0.1 ] CONTROL PLANE ICMP Echo DATA PLANE Southbound API Request (2) Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 23

Anatomy of an Exploit 6. ONOS registers host 1’s new IP address (A) as a HOST_UPDATED event (B). acl does not handle HOST_UPDATED events, so it does nothing. AclManager.java processing host events AclManager.java handling new host events HOST_UPDATED ✕ events not handled ✕ Never gets ✕ Never gets called called 24

Anatomy of an Exploit 7. The packet gets sent to a second app (A) acl app A fwd app ONOS Controller ACL Rules Host object AclRule ICMP Echo MAC: Host Flow Request (2) 00:00:00:00:00:01 Manager Manager IPs: [10.0.0.1] CONTROL PLANE DATA PLANE Southbound API Switch Flow table Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 25

Anatomy of an Exploit 7. The packet gets sent to a second app (A), which instantiates the flow (allow) rule (B) acl app A fwd app ONOS Controller ACL Rules Host object B AclRule ICMP Echo MAC: Host Flow Request (2) 00:00:00:00:00:01 Manager Manager IPs: [10.0.0.1] CONTROL PLANE FlowRule object Selector: 10.0.0.1 à 10.0.0.2 DATA PLANE Southbound API Treatment: send out port 2 Switch ICMP Echo Flow table Request (2) Host 1 Host 2 (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 26

Anatomy of an Exploit 7. The packet gets sent to a second app (A), which instantiates the flow (allow) rule (B) and allows host 1 to communicate with host 2 (C). acl app A fwd app ONOS Controller ACL Rules Host object B AclRule ICMP Echo MAC: Host Flow Request (2) 00:00:00:00:00:01 Manager Manager IPs: [10.0.0.1] CONTROL PLANE FlowRule object Selector: 10.0.0.1 à 10.0.0.2 DATA PLANE Southbound API Treatment: send out port 2 Switch ICMP Echo Flow table Request (2) Host 1 Host 2 C (malicious) (victim) Port Port 1 2 IP: 10.0.0.1 IP: 10.0.0.2 27

What Makes This Challenging? No ground truth about what events ought to be handled Multiple entry points for code analysis Not all event handling can affect the data plane 28