https://insinuator.net/tags/fhs/ Recent content in FHS on Insinuator.net - Bold Statements Hugo en-us Thu, 08 Jan 2015 00:00:00 +0000 https://insinuator.net/2015/01/dhcpv6-guard-do-it-like-ra-guard-evasion/ Thu, 08 Jan 2015 00:00:00 +0000 https://insinuator.net/2015/01/dhcpv6-guard-do-it-like-ra-guard-evasion/ <p><strong>Or: When Cisco ACL Can Count Up to Five 🙂</strong></p> <p>This is a guest post by <a href="https://twitter.com/AntoniosAtlasis">Antonios Atlasis</a>.</p> <p>Hi all,</p> <p>RA Guard Evasion is well-known in the IPv6 “circles”; there is <a href="https://tools.ietf.org/rfc/rfc7113.txt">RFC 7113</a> Advice for IPv6 Router Advertisement Guard (RA-Guard) and many interesting blog-posts like this one <a href="http://www.insinuator.net/2011/03/ipv6-security-part-2-ra-guard-%E2%80%93-lets-get-practical/">here</a>, <a href="http://www.insinuator.net/2012/03/the-story-continues-another-ipv6-update/">here</a>, and this excellent write-up <a href="http://6lab.cz/article/rogue-router-advertisement-attack/">here</a> that discuss this issue.<br> Moreover, as Jim Smalls states in his comprehensive “<a href="http://www.rmv6tf.org/wp-content/uploads/2013/04/5-IPv6-Attacks-and-Countermeasures-v1.2.pdf">IPv6 Attacks and Countermeasures</a>” presentation given at the <a href="http://www.rmv6tf.org/na-ipv6-summit/2013-na-ipv6-summit/2013-presentations">North American IPv6 Summit 2013</a>, DHCPv6 Guard or a corresponding IPv6 ACL can stop a DHCPv6 Rogue Servers, but (only?) for non-malicious/non-fragmented DHCPv6 packets (slide 35). However, at that time there wasn’t any known attack tool in the wild that had the fragmentation evasion built in.</p>