Evasion of High-End IDPS Devices at the IPv6 Era
summary
Claims that IPv6 extension headers plus fragmentation let crafted packets bypass high-end IDPSes; researchers test four IDPS products (snort, suata, Source fire, Tipping Point) and find 12 evasion techniques that let port scans, XSS/SQLi-like payloads and ICMP pass undetected. A custom tool (Kon/Chiron) builds proxied fragments that exploit the next-header pointer ambiguity and header ordering; demos show repeated-fragment replay evading Tipping Point and Source fire. Recommended fixes: drop or scrub nonessential extension headers at the border or follow RFC 7112 guidance.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:00What is IPv6
- 8:00Problems with IPv6
- 14:05Security enforcement
- 20:15Ricochet Surrogate
- 27:35Demo
- 37:10Wireshark
- 41:25What could be done
- 44:00RFC 7112
- 51:50Questions
related talks
25mEvasion of High-End IPS Devices in the Age of IPv6
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
50mHTTP Desync Attacks: Smashing into the Cell Next Door
52mFlying Under the Radar - New Security Evasion Techniques
31mNew Techniques for Split-Second DNS Rebinding
26mMobile Interconnect Threats: How Next-Gen Products May be Already Outdated
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools