https://insinuator.net/tags/blacknurse/ Recent content in BlackNurse on Insinuator.net - Bold Statements Hugo en-us Mon, 05 Dec 2016 00:00:00 +0000 https://insinuator.net/2016/12/some-notes-from-the-lab-blacknurse-in-the-ipv6-era/ Mon, 05 Dec 2016 00:00:00 +0000 https://insinuator.net/2016/12/some-notes-from-the-lab-blacknurse-in-the-ipv6-era/ <p>Since BlackNurse was released on 10th of November, we asked ourselves whether this problem does also apply to ICMPv6 traffic. To answer this question, Christian Tanck (one of our students) build a lab with several firewall appliances. Kudos to him for testing and the following blog post.</p> <h3 id="intro">Intro</h3> <p><img src="bl1.png" alt="bl1"></p> <p> </p> <p>On 10^(th) of November, 2016 the <a href="https://www.trusted-introducer.org/directory/teams/tdc-soc.html">TDC Security Operations Center in Denmark</a> published the BlackNurse Denial of Service Attack Report as an <a href="http://soc.tdc.dk/blacknurse/blacknurse.pdf">PDF download</a> on their website and a <a href="http://www.netresec.com/?page=Blog&amp;month=2016-11&amp;post=BlackNurse-Denial-of-Service-Attack">blog post</a> written by Erik Hjelmvik from NETRESEC. He was involved in the project by helping with the analysis of packet dumps, testing different systems, with ideas for test scenarios and at least inspired me with his blog post on how to build a test lab described later in this post. The attack on its own was discovered by the TDC analysts Kenneth B. Jørgensen and Lenny Hansson.</p>