NSX-T is a Software-Defined-Networking (SDN) solution of VMware which, as its
basic functionality, supports spanning logical networks across VMs on
distributed ESXi and KVM hypervisors. The central controller of the SDN is the
NSX-T Manager Cluster which is responsible for deploying the network
configurations to the hypervisor hosts.
This summer, I looked into the mechanism which is used to add new KVM hypervisor
nodes to the SDN via the NSX-T Manager. By tracing what happens on the KVM host,
I discovered that the KVM hypervisor got instructed to download the NSX-T
software packages from the NSX-T Manager via unencrypted HTTP and install them
without any verification. This enables a Man-in-the-Middle (MITM) attacker on
the network path to replace the downloaded packages with malicious ones and
compromise the KVM hosts.
We recently came across an issue when playing around with VMware NSX-T which not
anyone might be aware of when getting started with it. Because many of our
customers start with transitioning to NSX-T, we want to share this with you. In
short, the Distributed Firewall (DFW) of NSX-T can be easily bypassed in the
default configuration because it only works effectively if at the same time, the
SpoofGuard feature is enabled on all logical switch ports which is not the
case by default.
Some time ago, one of our customers contacted us with a special request. For
some legitimate reason, they needed to centrally collect certain certificates
including their private keys which were distributed across many client systems
running Windows and stored in the corresponding user stores. Unfortunately (only
in this case, but actually good from a security perspective), the particular
private keys were marked non-exportable making a native export in the context of
the user impossible. As if this wasn’t enough, the extraction was supposed to be
executed in the context of the current user (i.e. without administrative
privileges) while not triggering the existing Anti Virus solution at all. Also,
the certificates needed to be transferred to some trusted system where they
could not be accessed in an unauthorized way. So let’s have a look how we
tackled these problems: