Taking the chance from
a discussion
on the
IPv6 hacker’s mailing list
and the
freshly proposed draft RFC
regarding
the deprecation of the generation of IPv6 Atomic Fragments,
I decided to test very quickly what is the current status related with the
latest and some of the most poplar Operating Systems (OS) status (whether they
send Atomic Fragments in response to Packet Too Big messages, or not). The
motivation behind this was to check which one of them is potentially vulnerable
to the DoS attack using the technique described in the above proposed RFC and
taking it for granted that Atomic Fragments are blocked in the real world (but
more about this, in another blogpost in the near future).
In the
“A Novel Way of Abusing IPv6 Extension Headers to Evade IPv6 Security Devices”
blogpost I described a way to evade a high-end commercial IDPS device, the
Tipping Point IDPS (TOS Tipping Point, Package 3.6.1.4036 and vaccine 3.2.0.8530
digital), by abusing a minor detail at the IPv6 specification. As I promised at
the end of that blogpost, this is not the end. In this blogpost I am going to
describe several new and different ways of evading another popular IDPS, an
open-source one this time, Suricata.
As it is well known to the IPv6 enthusiasts, one of the most significant changes
that IPv6 brings with it, apart from supporting a really huge address space, is
the improved support for Extensions and Options, which is achieved by the usage
of IPv6 Extension headers. According to
RFC 2460, “changes in the way IP
header options are encoded allows for more efficient forwarding, less stringent
limits on the length of options, and greater flexibility for introducing new
options in the future.” So, by adding IPv6 Extension headers, according to the
designers of the protocol, flexibility and efficiency in the IP layer is
improved.
Marc Heuse – who happens to give
this workshop
at the
Troopers IPv6 Security Summit next
week – just sent
this email (subject:
“Remote system freeze thanks to Kaspersky Internet Security 2013”) to the
IPv6 hackers mailing list,
describing how a system running a certain flavor of Kaspersky security products
can be remotely frozen when receiving IPv6 packets with a specific combination
of extension headers and fragmentation (which in turn can be easily generated by
his IPv6 protocol attack suite).