How To Configure Snort to Stop IPv6 Evasion Attacks

Sun, 11 Jan 2015 00:00:00 +0000

This is a guest post from Antonios Atlasis.

Hi all,

during our BlackHat US 2014 talk titled “Evasion of High-End IPS Devices in the Age of IPv6”, among others we discussed a Snort preprocessor rule (116:456) which, when enabled (not the case by default), triggers an alert when an IPv6 datagram with nine (9) or more IPv6 Extension Headers is used (such a header was used by us to evade Snort). However, we mentioned that:

A Novel Way of Abusing IPv6 Extension Headers to Evade IPv6 Security Devices

Mon, 26 May 2014 00:00:00 +0000

(Or How the Smallest Detail Can Make a Difference)

This is a guest post from Antonios Atlasis.

As it is well known to the IPv6 enthusiasts, one of the most significant changes that IPv6 brings with it, apart from supporting a really huge address space, is the improved support for Extensions and Options, which is achieved by the usage of IPv6 Extension headers. According to RFC 2460, “changes in the way IP header options are encoded allows for more efficient forwarding, less stringent limits on the length of options, and greater flexibility for introducing new options in the future.” So, by adding IPv6 Extension headers, according to the designers of the protocol, flexibility and efficiency in the IP layer is improved.

IDPS on Insinuator.net - Bold Statements

How To Configure Snort to Stop IPv6 Evasion Attacks

A Novel Way of Abusing IPv6 Extension Headers to Evade IPv6 Security Devices