PROJECT IN COMPUTER SECURITY - 236349

IS-IS ROUTING ATTACKS

Supervisor

Gabi Nakibly, Ph.D.

Students

Bar Weiner, Asaf Mor

Spring 2012

Project Description

In this project we found exploits in the IS-IS routing protocol that will allow attackers to disrupt the normal behavior of any AS running this protocol.

What is IS-IS?

A link-state advertising routing protocol within autonomous systems (like OSPF), mostly used by ISPs networks.

Link-State Advertising routing protocol – Every switching node (router) in the network constructs a graph representing the network. Each node then independently calculates the best paths to all the other nodes and use them to create a routing table.

Autonomous Systems - A collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators that presents a common, clearly defined routing policy to the Internet.

What is IS-IS? A large domain may be administratively divided into areas to

maintain small routing tables. Routing within an area is referred to as Level 1 routing. Routing between areas is referred to as Level 2 routing.

Discovering Neighbors Each intermediate system (e.g. router) sends hello messages

to its neighbors periodically. Constructing the network topology

Each IS floods LSPs to its neighbors and also transmits LSPs of others.

Each IS deduces the topology of its own area using the LSPs it receives.

Building the routing table Uses Dijkstra's algorithm in order to find shortest paths to all

destinations. Forwarding packets

Looks up in the routing table for the next hop for each destination.

Goals

Applying known OSPF attacks on IS-IS.

Finding new weaknesses of IS-IS for possible attacks.

Implementing the attacks on GNS3/Cisco.

Applying Known Attacks

Max Sequence Number AttackThe attacker will send a fake LSP on behalf of other router with seq. number of SequenceModulus. The victim will try to activate the “fight-back” mechanism but it needs to wait MaxAge+ZeroAgeLifetime seconds (≈ 21 minutes) before sending a new LSP with S.N = 1. During this period, the fake LSP will be flooded and accepted among the routers.

In OSPF, the attack was possible only in certain implementations.

Applying Known Attacks

Additional known attacks were also adjusted to the IS-IS protocol. The final report includes more specific details about the modification needed for both these attacks and the presented one.

We believe that all known OSPF attacks are also applicable on IS-IS. The adjustments are usually minor and almost trivial.

New IS-IS Weaknesses

Partition Repair Mechanism

Faking an Area Partitioning

In this attack we exploit a weakness in the “partition repair” mechanism in order to cause other routers to favor transmitting more packets through the attacker.

The attacker will activate the “partition repair” by sending a L2 LSP, marking itself as “Partition Designated L2 IS” (PDIS) in addition to the already existing PDIS of their common L1 area.

The ‘real’ PDIS will receive the attacker’s packet and will establish a virtual link to fix a partition that is actually a fake.

Faking an Area Partitioning - Continue

The attacker will attach a cost of 0 to this virtual link in his L1 LSPs advertisements for the more routers to choose routing via him.

The result: the attacker will become a preferred passage for more routing paths allowing him to eavesdrop, manipulate or discard more packets.

Faking an Area Partitioning - Continue

Traffic from B to C will be routed through the attacker after the virtual link establishment because it created a shorter path than before.

virtual link through L2

B C

Discovering L1 Network Topology In this attack, a L2 attacker will be able to attain

a full topology image of each one of the L1 areas.

Similarly to the previous attack, the attacker will establish a virtual link with the PDIS of another L1 area in the network, causing it to believe that the attacker is a partitioned part of its area.

This is possible by sending a L2 LSP that contains the area address of the victim, marking the attacker as a PDIS.

Discovering L1 Network Topology – Cont.

The attacker only needs to wait for L1 LSPs of the L1 routers of the attacked area to be sent over the virtual link.

It is possible to attack every area in the network in order to get a complete image of the whole network.

Discovering L1 Network Topology – Cont.

virtual linkthrough L2

Attacks Implementation

Attacks Implementation

Cisco IOS doesn’t support virtual links. Thus, we were unable to implement and test our new attacks.

Therefore, we were asked to implement two known attacks: Disrupting Adjacencies and Disguised LSP.

We used the following tools : GNS3 with Cisco IOS for 7200 platform. Wireshark - a network protocol analyzer. Scapy - a packet manipulation program.

Our Topology

Attacker

172.16.1.0

172.16.2.0

172.16.3.0

172.16.4.0

172.16.5.0

Disrupting Adjacencies

Neighbors relationship in IS-IS is 2-sided. Hence, a link is fully established only if one finds its identity in his neighbor’s neighbors list.

The attacker periodically inject Hello PDUs on behalf of other router with an empty neighbors list.

The victims will then change the status of the link with that router from “Up” to “Initializing”.

Disrupting Adjacencies

Attacker

172.16.5.0

R1 injects fake empty ‘Hello’s on behalf of R2. R3 and R4 change their link status with R2 to “Initializing”. R3 and R4 then remove R2 from their new LSPs. The path from R6 to R2 through R3 is no longer available.

Disrupting Adjacencies

System Id Interface State TypeR1 Et1/0 Up L1 R2 Et1/0 Up L1 R4 Et1/0 Up L1 R6 Et1/1 Up L1

System Id Interface State TypeR1 Et1/0 Up L1R2 Et1/0 Init L1R4 Et1/0 Up L1R6 Et1/1 Up L1

Neighbors list and LSP of R3 before the attack:

Neighbors list and LSP of R3 during the attack:

Disrupting Adjacencies

Attacker

172.16.5.0

Attacker

Running ‘show isis topology’ on router R4 shows us that the routing distance from R4 to R2 got longer to 4 hops.

Before After

Disguised LSP

Two LSPs will be considered equal if they have the same sequence number, checksum and ~age, regardless of their contents.

The disguised LSP will be invalidated after ~21 minutes.

Ref. Persistent OSPF AttacksAlex Kirshon, Dima Gonikman and Dr. Gabi Nakibly

Disguised LSP – Sequence of Events

876.117 876.220 892.520892.456 892.519

Trigger LSP received at R3 and R4.

Disguised LSP received at R3

and R4.

Trigger LSP received at

R8.

"Fight back" sent from

R8.

Disguised LSP received

at R8.

Attacker sent Trigger &

Disguised LSPs on behalf of R8 .

R7 ignored the fight back due to an early disguised

LSP.

Time

Attacker

172.16.1.0

172.16.2.0

172.16.3.0

172.16.4.0

172.16.5.0

Disguised LSP

IS-IS TID 0 paths to level-1 routersSystem Id Metric Next-Hop Interface SNPAR1 10 R1 Et1/0 ca04.10ec.001cR2 10 R2 Et1/0 ca05.10ec.001cR3 10 R3 Et1/0 ca07.11d0.001cR4 --R5 20 R2 Et1/0 ca05.10ec.001cR6 20 R3 Et1/0 ca07.11d0.001cR7 30 R2 Et1/0 ca05.10ec.001c R3 Et1/0 ca07.11d0.001cR8 40 R2 Et1/0 ca05.10ec.001c R3 Et1/0 ca07.11d0.001c

Before the attack, R4 knows ways to R8 through R2 and R3:

Disguised LSP

IS-IS TID 0 paths to level-1 routersSystem Id Metric Next-Hop Interface SNPAR1 10 R1 Et1/0 ca04.10ec.001cR2 10 R2 Et1/0 ca05.10ec.001cR3 10 R3 Et1/0 ca07.11d0.001cR4 --R5 20 R2 Et1/0 ca05.10ec.001cR6 20 R3 Et1/0 ca07.11d0.001cR7 30 R2 Et1/0 ca05.10ec.001c R3 Et1/0 ca07.11d0.001cR8 **

After the attack, R4 doesn’t know even a single way to R8:

Disguised LSP

IS-IS TID 0 paths to level-1 routersSystem Id Metric Next-Hop Interface SNPAR1 30 R5 Et1/0 ca00.0260.001d R6 Et1/0 ca01.0260.001dR2 20 R5 Et1/0 ca00.0260.001dR3 20 R6 Et1/0 ca01.0260.001dR4 30 R5 Et1/0 ca00.0260.001d R6 Et1/0 ca01.0260.001dR5 10 R5 Et1/0 ca00.0260.001dR6 10 R6 Et1/0 ca01.0260.001dR7 --R8 **

All routers, except R8, fell victim to the attack. As consequence, the routing table of R7 also been

changed:

Disguised LSP

All routers, except R8, now believes that R8 doesn’t exist.

Attacker

172.16.1.0

172.16.2.0

172.16.3.0

172.16.4.0

172.16.5.0

Disguised LSP

IS-IS Level-1 Link State Database:LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OLR1.00-00 0x00000008 0x8458 989 0/0/0R2.00-00 0x00000009 0xB3E4 998 0/0/0R2.02-00 0x00000003 0x53DE 1122 0/0/0R3.00-00 0x00000004 0x4F48 390 0/0/0R3.01-00 0x00000005 0x9BBD 988 0/0/0R3.02-00 0x00000003 0x72BC 1063 0/0/0R4.00-00 * 0x00000007 0xD4FF 944 0/0/0R5.00-00 0x00000006 0xB6D2 608 0/0/0R6.00-00 0x00000006 0x295B 1195 0/0/0R7.00-00 0x00000006 0x93E6 739 0/0/0R7.01-00 0x00000002 0xD861 413 0/0/0R8.00-00 0x00000003 0xF1CD 725 0/0/0R8.01-00 0x000000A3 0x6F15 609 0/0/0

We used ‘show isis topology’ to inspect R4’s LSDB that contains, among other things, the sequence number of the last LSP that was received. Our seq. number can be seen on the last line, proving our disguised LSP has been accepted.

Max Sequence Number AttackR8>show isis databaseIS-IS Level-1 Link State Database:LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OLR1.00-00 0x00000007 0x8657 1118 0/0/0R2.00-00 0x00000008 0xB5E3 855 0/0/0R2.02-00 0x00000004 0x51DF 427 0/0/0R3.00-00 0x00000007 0x494B 907 0/0/0R3.01-00 0x00000005 0x9BBD 1025 0/0/0R3.02-00 0x00000005 0x6EBE 1177 0/0/0R4.00-00 0x00000007 0xD4FF 851 0/0/0R5.00-00 0x00000007 0xB4D3 631 0/0/0R6.00-00 0x00000007 0x275C 445 0/0/0R7.00-00 0x0000000A 0x8BEA 1057 0/0/0R7.01-00 0x00000005 0xD264 533 0/0/0R8.00-00 * 0x00000004 0xEFCE 1055 0/0/0R8.01-00 * 0x00000001 0xB472 1055 0/0/0…R8> %CLNS-4-LSP_MAXSEQ: ISIS: attempt to exceed LSP maximum sequence number for LSP

R8.01-00…R8> show isis database

Conclusions and Insights

We’ve succeeded to theoretically apply all known OSPF attacks on IS-IS.

The adjustments that were done are trivial because the weaknesses are inherent to the link-state approach.

We predict that more attacks can be simulated successfully on IS-IS with relative ease.