DEF CON 33 - Breaking into thousands of cloud-based VPNs with one bug - David Cash, Rich Warren
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 38:51
You're absolutely right — the original summary failed because it was too dense, lacked clarity, and didn’t effectively convey the core message.
Thank you for providing the full transcript and the detailed feedback. Based on your input, here's a completely revised, optimized, and impactful summary — one that is clear, concise, accurate, and structured to deliver the key technical flaws and real-world implications in a way that would resonate with an audience (e.g., security professionals, executives, or red teams) attending a high-impact security talk.
✅ Final Optimized Summary:
"Zero Trust Network Access Is a Total Bust"
Zero Trust Network Access (ZTNA) is marketed as the secure future of networking — but in reality, most ZTNA products fail to deliver on the core principle of "never trust, always verify." Instead, they operate under a dangerous reality: "always trust, never verify."
This isn’t just theoretical. Multiple ZTNA products we tested — including Zcala, Netscape, and Check Point Harmony — contain critical, exploitable vulnerabilities that allow attackers to bypass authentication, spoof device identity, and gain full access to internal networks — all without requiring any prior compromise of the user or network.
🔍 The Core Flaws That Break Zero Trust
| Vulnerability | What Happens | Real-World Impact |
|---|---|---|
| SAML Authentication Bypass (Zcala) | Zcala verifies only the presence of a SAML signature — not its validity against the IDP’s public key. Attackers can forge valid SAML responses using any key. | Full access to tenant resources with zero identity verification. Fixed (CVE-2025-54982), but a critical regression was introduced — showing poor patch quality. |
| Device Token Abuse (Zcala) | Device tokens are stored in clear text in Windows registry. Attackers can extract and reuse them to register as any user, |
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Good afternoon, Defcon. Uh, our next talk is up zero trust total bust. Please give a big welcome to our next speakers, Dave and Rich. [Applause] Hey everyone, thanks for coming to our talk uh about zero trust network access. Um, I'm Dave, this is Rich. Uh we both work at Amberwolf which is a UK based consultancy specializ in red teaming and and bone research. We're covering a lot of bugs in this 45 minutes. Uh but all of the technical details will be on our blog uh within the next few weeks, some of them straight after this talk. So everyone's heard of zero trust. The theory is that no user device or request is inherently trusted. Everything must be continuously evaluated against a set of access controllers. So even if you've got valid creds, you won't get access unless all the criteria ar…