"Zero clients in the enterprise - Skating on THIN ice"

No ratings

Presented at BSidesCanberra 2018 by

Eldar Marcussen

The use of thin, ultra thin and zero clients are on a rapid rise across enterprises. Large scale deployment of these solutions offers significant cost reductions in hardware, power consumption and technical support, while centralizing corporate assets through remote access. However, it also leads to heterogeneous networks that depend upon network connectivity and central management. The proprietary software can prevent administrators from applying stronger security measures and offers limited monitoring and logging solutions. Using traditional bug hunting skills, this presentation will demonstrate how to analyse a system from basic access to discovering a large number of significant flaws. These flaws are then combined to make a simple attack that will lead to enterprise wide rootkit/worm infection, capable of persisting past factory resets. The presentation includes background knowledge on thin or zero clients covering the software used and design problems faced during enterprise wide deployments. Strategies for finding and exploiting bugs will be covered in-depth, including combining multiple vulnerabilities for maximum impact.