Optus has teamed up with VMware to offer the latter’s software-defined wide area network (SD-WAN) technology to Australian enterprises as it expands its 5G network footprint across the country.

The telco said enterprises can make use of VMware’s SD-WAN technology, which works across fixed and wireless networks, to tap 5G as their primary connection to speed up IT deployment with lower latency.

Deon Liebenberg, vice-president of product innovation at Optus Enterprise, said the partnership with VMware was part of a broader strategy to provide enterprises with a greater choice of digital networking solutions.

In particular, he singled out VMware’s dynamic multipath optimisation, an SD-WAN feature that lets enterprises measure live network conditions and maximise network performance.

“The service will also enhance user experiences across common business tools, such as Microsoft 365 and Amazon Web Services-delivered cloud services. By combining Optus’s 4G and 5G networks with VMware SD-WAN, we look forward to enabling transformative cloud access and mobile experience, particularly for branch and home users,” said Liebenberg.

Ron Longo, VMware’s vice-president for worldwide service provider sales, added that the relationship with Optus would help to “reduce network complexity and give IT teams more time to focus on other business challenges and drive innovation and strategic outcomes across their business”.

SD-WAN has taken off faster in Australia than other markets, partly due to the migration of last-mile access to the country’s national broadband network.

According to technology research firm GlobalData, nearly 60% of enterprises with more than 200 employees have already deployed SD-WAN and one in three are considering implementing it in the next 12 months.

“While cost-saving has been part of the motivation to adopt SD-WAN, better security and network management is also a key benefit,” said Siow Meng Soh, senior technology analyst at GlobalData.

Australia’s SD-WAN market is highly fragmented, however. GlobalData’s research shows that Cisco and VMware are ahead of the pack, but Aryaka, Silver Peak and Fortinet are also popular, with each having over 10% of market share in Australia.

Soh said SD-WAN vendors were trying to gain market share by working with different channel partners, including systems integrators, resellers and local providers such as telcos.

According to GlobalData, nearly 10% of enterprises were interested in buying SD-WAN directly from vendors and nearly 20% indicated telcos as their preferred option.

As more businesses move to the cloud, SD-WAN will play an increasingly important role in providing users with access to applications and data.

“SD-WAN has a bigger role to play as businesses look to simplify branch networking, increase the use of cloud-based services and adopt remote working,” said Soh. “As a result, companies need to also have a long-term network strategy instead of treating SD-WAN as a standalone solution which delivers quick fixes.”

VMware has fixed vulnerabilities in its VeloCloud SD-WAN Orchestrator that, chained together, can lead to unauthenticated remote code execution (RCE).

Researchers from Realmode Labs combined authentication bypass, SQL injection, and directory traversal vulnerabilities to leave arbitrary JavaScript running in node.js.

The revelation marks the conclusion of a blog series documenting potentially calamitous RCE chains in four SD-WAN products from major vendors.

Centrally controlling an enterprise’s network topology, SD-WAN (Software-defined Wide Area Network) products represent “a crucial single point of failure from a security perspective”, Ariel Tempelhof, co-founder and CEO of Tel Aviv-based Realmode Labs, said in a blog post mapping the VMware RCE chain.

Pass the hash
VeloCloud, which was acquired by VMware in 2017, made “two grave mistakes” in implementing the password reset process that paved the way to an authentication bypass.

First, they used the user’s hashed password for the reset key “instead of generating random bytes”.

Second, while they implemented “an encrypted, signed token”, they “also added an option to use an unsigned cleartext [token] using the {CLEAR} prefix”.

VeloCloud also added predefined backdoor users, a “practice we’ve seen less of in the past years”, albeit disabled by default.

A ‘Pass The Hash Attack’ therefore allowed researchers “to use the hashed password during the password reset procedure, which also reenables the user”.

Researchers were thus able to reset the highest privilege, super@velocloud.net account, having obtained the account’s hashed password and logicalId parameter from the installation files.

The non-blind SQL injection vulnerability, meanwhile, arose because user-controlled data was “concatenated to an SQL query without escaping any characters”.

The blog post also explains how the researchers found the directory traversal flaw, which enabled them to “execute almost any JavaScript file on the local disk.”

Finally, uploaded files which failed content verification were not being deleted, meaning their randomly generated filename could be retrieved from the logger module because VeloCloud allowed users to set the device’s syslog server.

Startup insecurity
The flaws were reported to VMware at the end of July, said Tempelhof.

VMware then issued a security advisory on November 18 that addressed six CVEs emanating from Realmode Labs’ research and advised customers to update to versions 4.0.1, 3.4.4, or 3.3.2.

“VMware’s SIRT team was very responsive,” Tempelhof told The Daily Swig, although their decision not to assign ‘critical’ classifications, despite being presented with the RCE exploit, suggested they had “underestimated these issues”, he claimed.

Tempelhof noted that many SD-WAN products were first developed by startups that were later acquired by large companies – Silver Peak by HPE, Viptela by Cisco, VeloCloud by VMware, and Talari, whose codebase is apparently partly shared with Citrix, by Oracle.

“Startup companies usually put less emphasis on securing their products,” he said. “They need to build a system from scratch, they have tight development schedules, code is often left unreviewed, and sometimes shortcuts are made.”

Tempelhof told The Daily Swig that he and co-researcher Yaar Hahn were left “wondering what was the security assessment due diligence during this transition [to new ownership for the vendors researched] (if any)”.

The bugs leading to RCE in VMware SD-WAN Orchestrator, Cisco’s Viptela vManage, and, as reported by The Daily Swig, Citrix’s SD-WAN Center and Silver Peak’s Unity Orchestrator, “could have been found and fixed by a standard security review”, added Tempelhof.