1. By Alex Kirshon and Dima Gonikman Under the Guidance of Gabi Nakibly

2.  Project Objectives  OSPF Routing Protocol Protocol Overview Known Attacks Description  Project Accomplishments Fake Adjacency Attack Adjacency Corruption Attack  Project Summary Outline

3.  Study of vulnerabilities of OSPF from the protocol perspective  Exploitation of vulnerabilities to attack an OSPF network in new and improved ways  Prove effectiveness of attacks by collecting network statistics in simulated environment OSPF Attacks Project Objectives

4. OSPF Routing Protocol Open Shortest Path First  A Second Generation Internal Routing Protocol  Main Purpose – Internal Gateway Protocol – establishment an maintenance of routes within an Autonomous System  Dijkstra Algorithm based routing topology

5. OSPF Routing Protocol Open Shortest Path First  Link State Advertisement Protocol  Hello Protocol - discovery of neighbors and forming adjacencies (~Every 10 seconds)  Most protocol data is exchanged exclusively over adjacencies  Areas – an administrative abstraction

6. OSPF Routing Protocol Security Features  Simple Encryption MD5 based Message Authentication Code  ‘Natural Fightback’ mechanism False LSAs are updated or flushed by legitimate router  Areas as a Security Measure Flooding of false information is limited to area of origin

7. OSPF Routing Protocol The Link State Database

8. OSPF Routing Protocol Some Known Attacks  Max Sequence Number Attack Prevents Fightback  False Forwarding Address Attack Creates data loops  False Designated Router Attack Impacts AS connectivity

9. Project Accomplishments New Attacks  Fake Adjacency Attack  Adjacency Corruption Attack

10. Fake Adjacency Attack  Attack Goal – Establishing an adjacency with a phantom router  Motivation – Being Adjacent is a powerful position  Link State Databases are synchronized over adjacencies, being adjacent means being able to change other LSDBs at will

11. Hello Protocol And Adjacency Bring-Up

12. Fake Adjacency Attack Description  Send Spoofed Hello Packet to Victim Network Designated Router  Perform the Adjacency Bring-Up Procedure Without Hearing Victim Response (Send “next packet” every RTT)  Inject False Routing Information Via Spoofed LSU Packets (~ Every 30 minutes)  Maintain Attack By Periodically Sending Spoofed Hello Packets (~Every 10 seconds)

13. Fake Adjacency Attack

17.  Advantages Not Dependent On Network Topology Easy Maintenance – generating messages for maintenance is easy, and not frequent Powerful – can cause information loss, not bothered by limitations caused by areas  Disadvantages Exposed and requires High Maintenance – The attacker sends a false message every 10 seconds, this is traceable

18. Adjacency Corruption Attack  Attack Goal – Controlling The Fightback Mechanism  Motivation – Knowing When Fightback Occurs Helps to Overcome It  Lack of Fightback Means False Information Stays in the System Longer

19. Adjacency Corruption Attack Description  Send Spoofed LSU to Victim Router  Immediately Send Same Spoofed LSU to Network Designated Router (After RTT) The DR will fight the injected information but it will be rejected by the victim  Send Spoofed LSA Ack to Network DR (After RTT)  Maintain Attack By Periodically Repeating it (~Every 30 minutes)

20. Adjacency Corruption Attack

26.  Advantages Powerful – can cause information loss or routing loops, not bothered by limitations caused by areas Low Maintenance – Attacker sends 3 protocol messages every 30 minutes  Disadvantages Dependent On Network Topology

27. OSPF Attacks Project Summary  What We Accomplished: Found 2 New Major Security Weaknesses in OSPFv2 RFC Exploited Said Weaknesses to Gain Positions of Power Proved Applicability of Exploits Using OMNET++

28. Thanks for Listening  Any Questions?