Decrypting SonicWall SonicOSX Firmware: A Vulnerability Researcher's Deep Dive

The Challenge of SonicOSX Encryption

• 💡 SonicWall upgraded its platform to SonicOSX, introducing a new version of encryption that blocked researchers from accessing the underlying file system.
• 🎯 The goal was to reverse-engineer this encryption to continue researching new vulnerabilities on the platform.

The Reverse Engineering Process

• 🔑 The research began with a virtual machine image of the SonicOSX firmware.
• 🧩 Within the VM, two volumes were identified: one with the encrypted firmware and another with a bootloader, where the decryption keys were expected to be.
• 🛠️ The process involved unpacking the bootloader, extracting an initial RAM disk, decrypting an installer package found within, and recovering key encrypting keys.
• 🔗 This ultimately allowed for the decryption of the firmware image itself, revealing multiple layers of encryption.

Encryption Techniques and Tools

• 🔍 The encryption primarily used bash scripts and OpenSSL with AES keys, common techniques that became understandable once the scripts were accessed.
• 🚀 A tool called Sonicrack was developed to automate the extraction of keys from VM images and decrypt the firmware.
• 📈 This tool simplifies the process of accessing binaries for vulnerability research, such as performing patch diff analysis.

Implications and Justification for Releasing Tools

• ⚠️ While encryption slows down reverse engineers, it rarely stops them and can hinder legitimate security research.
• 🤝 Releasing tools like Sonicrack is justified because SonicWall is a frequent target, and vulnerabilities are often exploited in the wild before patches are widely applied.
• ⚖️ The release aims to level the playing field, giving independent researchers similar access to nation-state actors who may already possess these capabilities.

Recommendations for SonicWall Users

• 🔒 Ensure management interfaces are not exposed to the public internet, and are only accessible from internal networks.
• 📢 For public-facing interfaces like SSLVPN, stay informed about security advisories and patch devices as quickly as possible.
• 🔍 Increased research into firmware can lead to more bugs and vulnerabilities being discovered and fixed before malicious attackers exploit them, potentially inspiring more confidence in the products.