PROJECT IN COMPUTER SECURITY IS-IS ROUTING ATTACKS Supervisor Gabi Nakibly, Ph.D. Students Bar Weiner, Asaf Mor Spring 2012

Project Description In this project we found exploits in the IS-IS routing protocol that will allow attackers to disrupt the normal behavior of any AS running this protocol.

What is IS-IS? A link-state advertising routing protocol within autonomous systems (like OSPF), mostly used by ISPs networks.  Link-State Advertising routing protocol – Every switching node (router) in the network constructs a graph representing the network. Each node then independently calculates the best paths to all the other nodes and use them to create a routing table.  Autonomous Systems - A collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators that presents a common, clearly defined routing policy to the Internet.

What is IS-IS?  A large domain may be administratively divided into areas to maintain small routing tables.  Routing within an area is referred to as Level 1 routing.  Routing between areas is referred to as Level 2 routing.  Discovering Neighbors  Each intermediate system (e.g. router) sends hello messages to its neighbors periodically.  Constructing the network topology  Each IS floods LSPs to its neighbors and also transmits LSPs of others.  Each IS deduces the topology of its own area using the LSPs it receives.  Building the routing table  Uses Dijkstra's algorithm in order to find shortest paths to all destinations.  Forwarding packets  Looks up in the routing table for the next hop for each destination.

Goals  Applying known OSPF attacks on IS-IS.  Finding new weaknesses of IS-IS for possible attacks.  Implementing the attacks on GNS3/Cisco.

Applying Known Attacks

Max Sequence Number Attack The attacker will send a fake LSP on behalf of other router with seq. number of SequenceModulus. The victim will try to activate the “fight-back” mechanism but it needs to wait MaxAge+ZeroAgeLifetime seconds (≈ 21 minutes) before sending a new LSP with S.N = 1. During this period, the fake LSP will be flooded and accepted among the routers. In OSPF, the attack was possible only in certain implementations.

Applying Known Attacks Additional known attacks were also adjusted to the IS-IS protocol. The final report includes more specific details about the modification needed for both these attacks and the presented one. We believe that all known OSPF attacks are also applicable on IS-IS. The adjustments are usually minor and almost trivial.

New IS-IS Weaknesses

Partition Repair Mechanism

Faking an Area Partitioning  In this attack we exploit a weakness in the “partition repair” mechanism in order to cause other routers to favor transmitting more packets through the attacker.  The attacker will activate the “partition repair” by sending a L2 LSP, marking itself as “Partition Designated L2 IS” (PDIS) in addition to the already existing PDIS of their common L1 area.  The ‘real’ PDIS will receive the attacker’s packet and will establish a virtual link to fix a partition that is actually a fake.

Faking an Area Partitioning - Continue  The attacker will attach a cost of 0 to this virtual link in his L1 LSPs advertisements for the more routers to choose routing via him.  The result: the attacker will become a preferred passage for more routing paths allowing him to eavesdrop, manipulate or discard more packets.

Faking an Area Partitioning - Continue Traffic from B to C will be routed through the attacker after the virtual link establishment because it created a shorter path than before. virtual link through L2 BC

Discovering L1 Network Topology  In this attack, a L2 attacker will be able to attain a full topology image of each one of the L1 areas.  Similarly to the previous attack, the attacker will establish a virtual link with the PDIS of another L1 area in the network, causing it to believe that the attacker is a partitioned part of its area.  This is possible by sending a L2 LSP that contains the area address of the victim, marking the attacker as a PDIS.

Discovering L1 Network Topology – Cont.  The attacker only needs to wait for L1 LSPs of the L1 routers of the attacked area to be sent over the virtual link.  It is possible to attack every area in the network in order to get a complete image of the whole network.

Discovering L1 Network Topology – Cont. virtual link through L2

Attacks Implementation

 Cisco IOS doesn’t support virtual links. Thus, we were unable to implement and test our new attacks.  Therefore, we were asked to implement two known attacks: Disrupting Adjacencies and Disguised LSP.  We used the following tools :  GNS3 with Cisco IOS for 7200 platform.  Wireshark - a network protocol analyzer.  Scapy - a packet manipulation program.

Our Topology Attacker

Disrupting Adjacencies  Neighbors relationship in IS-IS is 2-sided. Hence, a link is fully established only if one finds its identity in his neighbor’s neighbors list.  The attacker periodically inject Hello PDUs on behalf of other router with an empty neighbors list.  The victims will then change the status of the link with that router from “Up” to “Initializing”.

Disrupting Adjacencies Attacker  R1 injects fake empty ‘Hello’s on behalf of R2.  R3 and R4 change their link status with R2 to “Initializing”.  R3 and R4 then remove R2 from their new LSPs.  The path from R6 to R2 through R3 is no longer available.

Disrupting Adjacencies System Id Interface State Type R1 Et1/0 Up L1 R2 Et1/0 Up L1 R4 Et1/0 Up L1 R6 Et1/1 Up L1 System Id Interface State Type R1 Et1/0 Up L1 R2 Et1/0 Init L1 R4 Et1/0 Up L1 R6 Et1/1 Up L1  Neighbors list and LSP of R3 before the attack:  Neighbors list and LSP of R3 during the attack:

Disrupting Adjacencies Attacker Attacker  Running ‘show isis topology’ on router R4 shows us that the routing distance from R4 to R2 got longer to 4 hops. BeforeAfter

Disguised LSP  Two LSPs will be considered equal if they have the same sequence number, checksum and ~ age, regardless of their contents. The disguised LSP will be invalidated after ~21 minutes. Ref. Persistent OSPF Attacks Alex Kirshon, Dima Gonikman and Dr. Gabi Nakibly

Disguised LSP – Sequence of Events Trigger LSP received at R3 and R4. Disguised LSP received at R3 and R4. Trigger LSP received at R8. "Fight back" sent from R8. Disguised LSP received at R8. Attacker sent Trigger & Disguised LSPs on behalf of R8. R7 ignored the fight back due to an early disguised LSP. Time Attacker

Disguised LSP IS-IS TID 0 paths to level-1 routers System Id Metric Next-Hop Interface SNPA R1 10 R1 Et1/0 ca04.10ec.001c R2 10 R2 Et1/0 ca05.10ec.001c R3 10 R3 Et1/0 ca07.11d0.001c R4 -- R5 20 R2 Et1/0 ca05.10ec.001c R6 20 R3 Et1/0 ca07.11d0.001c R7 30 R2 Et1/0 ca05.10ec.001c R3 Et1/0 ca07.11d0.001c R8 40 R2 Et1/0 ca05.10ec.001c R3 Et1/0 ca07.11d0.001c  Before the attack, R4 knows ways to R8 through R2 and R3:

Disguised LSP IS-IS TID 0 paths to level-1 routers System Id Metric Next-Hop Interface SNPA R1 10 R1 Et1/0 ca04.10ec.001c R2 10 R2 Et1/0 ca05.10ec.001c R3 10 R3 Et1/0 ca07.11d0.001c R4 -- R5 20 R2 Et1/0 ca05.10ec.001c R6 20 R3 Et1/0 ca07.11d0.001c R7 30 R2 Et1/0 ca05.10ec.001c R3 Et1/0 ca07.11d0.001c R8 **  After the attack, R4 doesn’t know even a single way to R8:

Disguised LSP IS-IS TID 0 paths to level-1 routers System Id Metric Next-Hop Interface SNPA R1 30 R5 Et1/0 ca d R6 Et1/0 ca d R2 20 R5 Et1/0 ca d R3 20 R6 Et1/0 ca d R4 30 R5 Et1/0 ca d R6 Et1/0 ca d R5 10 R5 Et1/0 ca d R6 10 R6 Et1/0 ca d R7 -- R8 **  All routers, except R8, fell victim to the attack.  As consequence, the routing table of R7 also been changed:

Disguised LSP  All routers, except R8, now believes that R8 doesn’t exist. Attacker

Disguised LSP IS-IS Level-1 Link State Database: LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL R x x /0/0 R x xB3E /0/0 R x x53DE /0/0 R x x4F /0/0 R x x9BBD 988 0/0/0 R x x72BC /0/0 R * 0x xD4FF 944 0/0/0 R x xB6D /0/0 R x x295B /0/0 R x x93E /0/0 R x xD /0/0 R x xF1CD 725 0/0/0 R x000000A3 0x6F /0/0  We used ‘show isis topology’ to inspect R4’s LSDB that contains, among other things, the sequence number of the last LSP that was received. Our seq. number can be seen on the last line, proving our disguised LSP has been accepted.

Max Sequence Number Attack R8>show isis database IS-IS Level-1 Link State Database: LSPID LSP Seq Num LSP Checksum LSP Holdtime ATT/P/OL R x x /0/0 R x xB5E /0/0 R x x51DF 427 0/0/0 R x x494B 907 0/0/0 R x x9BBD /0/0 R x x6EBE /0/0 R x xD4FF 851 0/0/0 R x xB4D /0/0 R x x275C 445 0/0/0 R x A 0x8BEA /0/0 R x xD /0/0 R * 0x xEFCE /0/0 R * 0x xB /0/0 … R8> %CLNS-4-LSP_MAXSEQ: ISIS: attempt to exceed LSP maximum sequence number for LSP R … R8> show isis database

Conclusions and Insights  We’ve succeeded to theoretically apply all known OSPF attacks on IS-IS.  The adjustments that were done are trivial because the weaknesses are inherent to the link-state approach.  We predict that more attacks can be simulated successfully on IS-IS with relative ease.