Presented at
ToorCon San Diego 17 (2015),
Oct. 25, 2015, 11:30 a.m.
(20 minutes).
Routers and switches are the critical components of networks. When it comes to the security of organizations, network and infrastructure security are the center of concerns. The most common and obvious concern is that, all internet facing devices should comply with recommended security policies and standards. However, the true fact is, a number of security devices do not comply with secure design principles which results in potential vulnerabilities. Inherent vulnerabilities in routers and switches provide a backdoor access to attackers which ultimately result in device takeover. We will discuss design flaws and authentication bypass vulnerabilities in D-Link devices including Gigabit switches and VOIP routers. We will also discuss the methodology opted to hunt the vulnerabilities. The presentation will be organized as follows: We will describe the details about the vulnerabilities in D-Link Gigabit Switches and VOIP routers
We will demonstrate live exploits in order to gain complete network/device information configured on these devices.
We will present a tool by which users can make sure that their current Dink devices are vulnerable to this issues or not.
Presenters:
-
Varang Amin
Varang Amin is a Network Security Professional with over 7 years of experience. Varang specializes in exploit analysis, vulnerabilities research, protocol reverse engineering and signature development. He is currently working as a Sr Staff Engineer at Palo Alto Networks, performing security research in vulnerability management market. He has also worked for Cisco, Juniper and Qualys as a security research engineer. He has also discovered vulnerabilities in security monitoring devices. He holds a Masters degree in Computer Science from the SJSU.
-
Aditya K Sood
Aditya K Sood (Ph.D) is a security practitioner, researcher and consultant. Dr. Sood has research interests in malware automation and analysis, application security, secure software design and cybercrime. He has worked on a number of projects pertaining to penetration testing specializing in product/appliance security, networks, mobile and web applications while serving Fortune 500 clients for IOActive, KPMG and others. He has authored several papers for various magazines and journals including IEEE, Elsevier, CrossTalk, ISACA, Virus Bulletin, Usenix and others. His work has been featured in several media outlets including Associated Press, Fox News, The Register, Guardian, Business Insider, Kaspersky Threatpost, CBC and others. He has been an active speaker at industry conferences and presented at BlackHat, DEFCON, HackInTheBox, RSA, Virus Bulletin, OWASP and many others. Dr. Sood obtained his PhD from Michigan State University in Computer Sciences. Dr. Sood is also an author of “Targeted Cyber Attacks” book published by Syngress.
Similar Presentations: