Abusing Software Defined Networks
summary
Current SDN controllers (Floodlight, OpenDaylight) ship with clear-text APIs, optional or missing TLS, no node authentication, debug ports and weak defaults, enabling interception, DoS and full takeover. A toolkit is available that impersonates switches (OpenFlow hello/feature exchange), probes controllers on ports 6633/6653, dumps flows and builds ACLs to identify targets and sensors, and modifies flows to hide from sensors and grant or deny access; demos show successful sensor evasion, 30% packet loss from injected rules, and an OpenDaylight exploit that extracts credentials and /etc/shadow.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:45Modern-Day Networks
- 7:25Open Flow
- 8:37Flow Tables
- 11:22Weaknesses in the Protocol
- 17:19The Debug Board
- 21:40Nmap Script
- 24:46Map the Network
- 37:02Southbound Openflow Api
- 41:00Headspace Analysis
- 46:41Final Thoughts
related talks
22mAttacking SDN Infrastructure: Are We Ready for the Next-Gen Networking?
29mAttacking the Brain: Races in the SDN Control Plane
26mRedefining the Networking Industry Through Collaboration
29mIdentifier Binding Attacks and Defenses in Software-Defined Networks
44mHow to Test SDN, or Software‑Defined Networks?
36mWhen The Front Door Becomes a Backdoor: The Security Paradox of OSDP
31mKeynote Panel: SDN@10
40mLeveraging Cloud SDNs to Solve OWASP Top Ten