Hello to the list and RA guard evasion technique

[Marc Heuse]

Hi guys,

as Fernando Gont, Eric Vyncke and quite some more clever IPv6 heads are
on this list, I subscribed and will join the (security) discussions.

I am the author of the thc-ipv6 toolkit and have so far done quite some
ipv6 security/vulnerability research. The newest issue I published is
bypassing the RA Guard security features on Cisco switches.

Note that this technique also bypasses the following configuration Eric
recommended for switches that have layer 3 ACL capabilities but do not
support RA guard:
    deny icmp any any router-advertisement
    permit any any

And it also bypasses NDPmon/RAfixd/RAmond.


Attack:
=======
Make the evil Router Advertisement fragmented and put the ICMPv6 into
the second fragment, eg. by putting a very large Destination extension
header before the ICMPv6 part.

So the packets look like:

Fragment 1:
 IPv6 Header
 Fragmentation Header
 Destination Header (~1400 bytes)

Fragment 2:
 IPv6 Header
 Fragmentation Header
 Destination Header (continued with some bytes)
 ICMPv6 with RA


Workaround:
===========
To prevent this attack, put the following IPv6 ACL on all ports:

    deny ip any any undetermined-transport

This will drop all packets where the switch is not able to identify the
IPv6 transport type like in this attack. Note that this might drop some
unusual valid traffic too.


Workaround Bypass:
==================
Craft the packets in a way so that the first fragment has an ICMPv6 echo
request and the second fragment overwrites the first fragment with the
ICMPv6 router advertisement.

Fragment 1:
 IPv6 Header
 Fragmentation Header
 Destination Header (8 bytes)
 ICMPv6 with Echo Request

Fragment 2:
 IPv6 Header
 Fragmentation Header with offset == 1 (equals position of 8th byte ==
start of Echo Request in first fragment)
 ICMPv6 with RA

Note that the handling of overlapping fragments differs between
platforms, some take the first fragment received, others the latest, so
send the packets accordingly to your target.


Other implementations
=====================
Works on all implementations so far I tested, on some e.g. NDPmon it is
way simpler, you have have to add an empty hop-by-hop header and it goes
blind for NDP and RA attacks.


Basically, if just want to prevent accidental RA's on the network, then
all the tools and mechanisms are fine.
But if you want to prevent attacks, the only secure way is packet
reassembling/verification in the switches - and that is not a good idea
for performance and availability reasons (RAM, CPU, ...).

Greets,
Marc

--
Marc Heuse
Mobile: +49 177 9611560
Fax: +49 30 37309726
www.mh-sec.de

Marc Heuse - IT-Security Consulting

Ust.-Ident.-Nr.: DE244222388
PGP: FEDD 5B50 C087 F8DF 5CB9  876F 7FDD E533 BF4F 891A