A Man-in-the-Middle attack against OpenDayLight SDN controller

Abstract

In this paper, we investigated the vulnerabilities surrounding software-defined networking (SDN). Specifically, we examined the vulnerabilities of OpenDayLight SDN controller. Among all the possible attack vectors, a man-in-the-middle attack using ARP poisoning was successfully launched to intercept the traffic between a client and the OpenDayLight controller. Details of the experiment method, procedures and results were described in this manuscript. To the best of our knowledge, this is the first successful practical attempt to penetrate an SDN controller and be able to capture login credentials of the controller. The significance of this attack should not be taken lightly; once the SDN controller is under the control of the adversary, there will be no security at all for the entire network governed by this controller.