WEBVTT

1
00:00:03.200 --> 00:00:06.840
This is Decrypted. Wednesday, the twenty-third of September.

2
00:00:06.840 --> 00:00:12.080
F5's access gateway let attackers in without a password.

3
00:00:12.080 --> 00:00:19.040
F5 spent Monday telling customers something you never want to hear about the box sitting at the edge of your

4
00:00:19.040 --> 00:00:24.400
network. This is the box whose entire job is deciding who gets in.

5
00:00:24.400 --> 00:00:29.120
And it turns out it had a hole in it that needed no password to walk through.

6
00:00:29.120 --> 00:00:35.280
C V E twenty twenty-six, nine four one two seven.

7
00:00:35.280 --> 00:00:40.880
A heap-based buffer overflow in Big I P's Access Policy Manager.

8
00:00:40.880 --> 00:00:46.640
It scores 9.8 out of 10, and it's already being exploited in the wild.

9
00:00:46.640 --> 00:00:54.640
It was one of four vulnerabilities the US Cybersecurity and Infrastructure Security Agency added to its known

10
00:00:54.640 --> 00:01:02.480
-exploited list on the same afternoon, alongside two Check Point flaws and one in Arista's VeloCloud orchestra

11
00:01:02.480 --> 00:01:11.760
tor. Big I P sits in front of banks, telecoms providers, insurers and government departments across the UK.

12
00:01:11.760 --> 00:01:15.520
It's doing precisely the job this bug undermines.

13
00:01:15.520 --> 00:01:19.320
And it's not the kind of box you take offline lightly to patch.

14
00:01:19.320 --> 00:01:23.560
Next.

So how did the door swing open?

15
00:01:23.560 --> 00:01:32.160
The flaw only bites on a virtual server configured with both an A P M access policy and an OAuth profile.

16
00:01:32.160 --> 00:01:35.760
That's a common combination for anything doing single sign-on.

17
00:01:35.760 --> 00:01:44.297
When a client authenticates, the OAuth handling code copies attacker-influenced data into a fixed-size heap b

18
00:01:44.297 --> 00:01:47.200
uffer, without checking how much of it there is.

19
00:01:47.200 --> 00:01:54.440
Send more than the buffer allows, and the excess spills into adjacent memory, corrupting the data structures

20
00:01:54.440 --> 00:01:58.800
the traffic management microkernel uses to decide what to do next.

21
00:01:58.800 --> 00:02:02.640
Control of that memory becomes control of execution.

22
00:02:02.640 --> 00:02:09.664
No credentials required.

Picture a bouncer's clipboard with no limit on how much a visitor can write on the

23
00:02:09.664 --> 00:02:15.600
sign-in sheet. Fill it past the edge, and the ink starts landing on the guest list itself.

24
00:02:15.600 --> 00:02:18.720
Now the guest list says whatever the visitor wrote.

25
00:02:18.720 --> 00:02:23.440
And also.

And it was a bad afternoon for edge appliances generally.

26
00:02:23.440 --> 00:02:26.320
F5 was not alone that day.

27
00:02:26.320 --> 00:02:33.040
Check Point disclosed active exploitation of a path traversal bug in its management server, letting attackers

28
00:02:33.040 --> 00:02:35.960
upload and run scripts without logging in.

29
00:02:35.960 --> 00:02:42.880
Separately, it confirmed attempts against its Spark firewalls through a certificate-validation bypass in V P

30
00:02:42.880 --> 00:02:46.560
N setup, one that started days after the patch shipped.

31
00:02:46.560 --> 00:02:53.361
Arista's VeloCloud orchestrator made the same Sisa list, for an input validation flaw.

32
00:02:53.361 --> 00:02:56.640
None of these four bugs share a codebase.

33
00:02:56.640 --> 00:02:58.840
But they share a category.

34
00:02:58.840 --> 00:03:05.600
Internet-facing appliances built to be trusted gatekeepers, all patched in the same week, because someone was

35
00:03:05.600 --> 00:03:07.120
already inside testing them.

36
00:03:07.120 --> 00:03:15.600
N C S C guidance issued earlier this year told UK organisations to baseline their V P N and remote-access tra

37
00:03:15.600 --> 00:03:20.880
ffic, precisely because edge devices are where covert access gets established quietly.

38
00:03:20.880 --> 00:03:24.160
This is what that warning looked like, arriving.

39
00:03:24.160 --> 00:03:28.040
And finally.

The lesson for Secure by Design.

40
00:03:28.040 --> 00:03:36.320
The design decision that would have stopped C V E twenty twenty-six, nine four one two seven is unglamorous.

41
00:03:36.320 --> 00:03:41.680
Validate the length of untrusted input before writing it into fixed memory.

42
00:03:41.680 --> 00:03:48.400
On code that, by definition, handles traffic from anyone on the internet before they've proven who they are.

43
00:03:48.400 --> 00:03:54.640
F5 is a signatory to pledges on exactly this kind of secure-by-design commitment.

44
00:03:54.640 --> 00:04:02.736
Which makes a pre-authentication heap overflow in an access-control product a useful embarrassment, rather th

45
00:04:02.736 --> 00:04:11.840
an a surprise.

For UK organisations, the immediate task is patching, or applying F5's emergency iRule, wherev

46
00:04:11.840 --> 00:04:14.640
er A P M and OAuth profiles coexist.

47
00:04:14.640 --> 00:04:21.600
And checking logs for repeated OAuth failures or unexpected T M M crashes, as signs of probing.

48
00:04:21.600 --> 00:04:28.160
The longer task? Treating what sits at the network edge as a supplier-risk question with a paper trail.

49
00:04:28.160 --> 00:04:31.240
Not a purchasing decision made once and forgotten.

50
00:04:31.240 --> 00:04:37.120
That was Decrypted. The written version and every source are linked in the show notes.

51
00:04:37.120 --> 00:04:38.240
Thanks for listening.