易受攻击的网络：思科AnyConnect安全分析
Very Pwnable Network: Cisco AnyConnect Security Analysis
摘要：
企业虚拟专用网络（VPN）使用户能够在家或旅行时工作。与此同时，VPN与公司的网络基础设施相关联，迫使用户出于网络兼容性的原因安装专有客户端。VPN客户端以高权限运行，以加密和重新路由网络流量。因此，VPN客户端中的漏洞对其用户以及企业网络构成了重大风险。思科是企业网硬件的主要供应商，通过其AnyConnect客户端为桌面和移动设备提供VPN连接。虽然过去的安全研究主要集中在AnyConnect Windows客户端上，但我们发现Linux和iOS基于不同的架构，具有不同的安全问题。我们的逆向工程以及后续的设计分析和模糊揭示了13个新的漏洞。其中七个位于Linux客户端。Linux上特权升级的根本原因在客户端的架构中如此之深，以至于它只得到了部分解决方案。对iOS的类似分析揭示了三个AnyConnect特定的错误以及iOS网络扩展中的三个一般问题，这些问题适用于所有类型的VPN，并不限于AnyConnect。
英文摘要：
Corporate Virtual Private Networks (VPNs) enable users to work from home or while traveling. At the same time, VPNs are tied to a company's network infrastructure, forcing users to install proprietary clients for network compatibility reasons. VPN clients run with high privileges to encrypt and reroute network traffic. Thus, bugs in VPN clients pose a substantial risk to their users and in turn the corporate network. Cisco, the dominating vendor of enterprise network hardware, offers VPN connectivity with their AnyConnect client for desktop and mobile devices. While past security research primarily focused on the AnyConnect Windows client, we show that Linux and iOS are based on different architectures and have distinct security issues. Our reverse engineering as well as the follow-up design analysis and fuzzing reveal 13 new vulnerabilities. Seven of these are located in the Linux client. The root cause for privilege escalations on Linux is anchored so deep in the client's architecture that it only got patched with a partial workaround. A similar analysis on iOS uncovers three AnyConnect-specific bugs as well as three general issues in iOS network extensions, which apply to all kinds of VPNs and are not restricted to AnyConnect.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
