Subject: [saag] fyi: talk @ Stanford: Owning the Routing Table - New OSPF Attacks - FRIDAY - AUG 5

From: =JeffH <[email-masked]>
Date: Sun, 31 Jul 2011 21:17:40 -0700

[ perhaps something to share with [email-masked]  nor 
[email-masked] ?  (I'm not sub'd to those lists) ]

Subject: FRIDAY - AUG 5 - Owning the Routing Table - New OSPF Attacks -
	Nakibly Gabi
From: Ankur Taly <[email-masked]>
Date: Fri, 29 Jul 2011 23:08:46 -0700 (PDT)
To: security-seminar <[email-masked]>
Cc: Nakibly Gabi <[email-masked]>

TITLE: Owning the Routing Table - New OSPF Attacks

SPEAKER: Nakibly Gabi

ABSTRACT: The holy grail of routing attacks is owning the routing table of a 
router. We present new found vulnerabilities in the OSPF protocol - the most 
popular routing protocol inside autonomous systems (AS) - which allow to own a 
router's routing table without having to own the router itself. We present new 
attacks that falsify the LSAs of routers not controlled by the attacker while 
evading the "fight-back" mechanism. These attacks affords a single attacker a 
great power to persistently falsify large portions of the routing domain's 
topology. This may be utilized to induce routing loops, network cuts or longer 
routes in order to facilitate DoS of the routing domain or to gain access to 
information flows which otherwise the attacker had no access to. This is a 
joint work with Alex Kirshon and Dima Gonikman. The talk shall be presented at 
Black Hat USA 2011.

Venue: Gates 463
Time: 4:30 pm
Date: 5 August 2011 (Friday)

--++**==--++**==--++**==--++**==--++**==--++**==--++**==
security-seminar mailing list
[email-masked]
https://mailman.stanford.edu/mailman/listinfo/security-seminar

---

From: Vishwas Manral <[email-masked]>
Date: Mon, 1 Aug 2011 13:25:41 -0700

Hi Jeff,

Thanks for forwarding this. Let me try to get more details of what they are
trying to do here.

I am not sure what new vulnerabilities they have found. However from what I
see it looks like things we well know and by the issues can be negated by
using authentication in OSPF.

Also it is well known that if a router in a domain is compormised and
accepts unauthenticated packets, it can cause routing issues /which means
loops/ blackholes etc. Sounds liek they may be using a higher sequence
number LSA of a router they do not control, which can disrupt routing.

Thanks,
Vishwas
On Sun, Jul 31, 2011 at 9:17 PM, =JeffH <[email-masked]>wrote:

> To: security-seminar <security-seminar@lists.**stanford.edu<[email-masked]>
> >
> ABSTRACT: The holy grail of routing attacks is owning the routing table of
> a router. We present new found vulnerabilities in the OSPF protocol - the
> most popular routing protocol inside autonomous systems (AS) - which allow
> to own a router's routing table without having to own the router itself. We
> present new attacks that falsify the LSAs of routers not controlled by the
> attacker while evading the "fight-back" mechanism. These attacks affords a
> single attacker a great power to persistently falsify large portions of the
> routing domain's topology. This may be utilized to induce routing loops,
> network cuts or longer routes in order to facilitate DoS of the routing
> domain or to gain access to information flows which otherwise the attacker
> had no access to. This is a joint work with Alex Kirshon and Dima Gonikman.
> The talk shall be presented at Black Hat USA 2011.
>
> Venue: Gates 463
> Time: 4:30 pm
> --++**==--++**==--++**==--++****==--++**==--++**==--++**==
> security-seminar@lists.**stanford.edu<[email-masked]>
> https://mailman.stanford.edu/**mailman/listinfo/security-**seminar<https://mailman.stanford.edu/mailman/listinfo/security-seminar>
> ______________________________**_________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/saag<https://www.ietf.org/mailman/listinfo/saag>
>

---

From: Vishwas Manral <[email-masked]>
Date: Thu, 4 Aug 2011 19:58:19 -0700

Hi guys,

I looked at the presentation. It basically assumes the attacker has the MD5
keys used to protect OSPF sessions and the attacker controls a router.

Ofcourse once ots well known once there is a wrong router, it can redirect
all traffic to itself, create routing loops, blackholes and do everything
else. It is for this very purpose that MD5 is used. :)

Thanks,
Vishwas