The video demonstrates how to bypass an access control list on HP A5800 switch using IPv6 and extension headers. The attacker uses kernel modul which adds empty destination-options headers to the whole TCP session, thus is able to connect to any service on the server. The video is temporarily removed … Read More
Virtualisation of Critical Network Services – Best Practice Document
Pavel Kislinger, Vladimír ZáhoříkThis document describes a way to virtualise the number of network servers that are required for the operation of a large campus network. These servers provide services, including DHCP, DNS, VPN, email, network monitoring, and radius. Most of these services are so important that the network must operate two or … Read More
Hiding TCP Traffic: Threats and Counter-measures
Libor PolčákComputer networks were designed to be simple and routers do not validate the integrity of the processed traffic. Consequently, an attacker can modify his or her traffic with the aim of confusing any analyser that intercepts the traffic, e.g. monitoring and security software or lawful interception. This paper studies the … Read More
Behaviour of various operating systems during SLAAC, DAD, and ND
Libor PolčákThis post contains the report from the study phase of the behaviour of various operating systems during SLAAC and DAD analysis for our paper called “A New Approach for Detection of Host Identity in IPv6 Networks”, which will be presented at DCNET 2013. This post also contains PCAP files that … Read More
Optimizing network tracking tool for management of BUT campus network
Peter DrienkoThis article describes optimization of the database structure in Zabbix monitoring tool using automatic partitioning. With this optimization we achieved a decrease of the processor utilization on the Zabbix server and a significant decrease in the growth of data on its hard drive. Last Updated: 27th of May, 2014. Introduction … Read More
Rogue Router Advertisement Attack
Jozef Pivarnik, Matej GregrThis article describes first hop security issue of IPv6 Neighbor Discovery Protocol. Vulnerability of this protocol is exploited to perform a Rogue Router Advertisement attack. Currently, there are few mitigation techniques available against this type of attack. Most of them, however are useful only in specific scenarios, or not widely used, mainly because insufficient support of vendors. This article presents probably the most applicable mitigation technique against the Rogue RA attack — RA Snooping. Specifically, its implementations by Cisco and HP (H3C).
The Man-in-the-middle Attack Using IPv6
Tomas PodermanskiThe video demonstrates the man-in-the-middle attack using IPv6 an windows 7. The attacker is placed in the same network segment as the victim(s). Standard software packages like named, dhcpd, squid, radvd are used to perform attack.
Security challenges in IPv6 from the campus perspective
Tomas PodermanskiGrowing number of IPv6 devices in the network would bring new security challenges. Are there any security improvements comparing to IPv4 or IPv6 brings some new security threads. IPv6 have been developed for more than 15 years so far and presentation tries to find the answer if IPv6 provides better … Read More
IPv6 RA flood DoS attack in Windows 8
Tomas PodermanskiRA flood attack is known for a few years. It appeared in many operating systems. Some vendors have already fixed the issue. Unfortunately Microsoft Windows product are still vulnerable including the latest version of Windows 8. Following video demonstrates the flood attack on on the latest version Windows 8 using thc-ipv6 toolkit.
Deploying IPv6 – practical problems from the campus perspective
Tomas Podermanski, Matej Gregr, Miroslav ŠvédaOn February 2011, IANA has run out of IPv4 addresses. On April 2011, APNIC pool reached the final /8 IPv4 address block. Projected address pool exhaustion for other RIRs varies from the beginning of the 2012 to the end of 2014. This situation pushes organizations to think about transition to IPv6. Unfortunately IPv4 and IPv6 are incompatible protocols that make the transition more difficult and raise new security issues. This paper shares experiences of deploying IPv6 in the university campus network, describes the most significant troubles that we have been faced with and describes the best practices in the practical IPv6 deployment. The article discusses differences in IPv6 and IPv4 networks with focus on the first hop security, autoconfiguration (SLAAC, DHCP, DHCPv6) and different client’s support.