Evasion of High-End IPS Devices in the Age of IPv6
summary
Three novel techniques exploit IPv6 extension headers and fragmentation to make high-end IDPSes blind, demonstrated with a custom packet-builder and layer‑3 proxy called Chiron. Tests show a Suricata 2.x evasion where a long destination options header (>=56 bytes) split into 7+ misordered fragments bypasses alerts, and a commercial TippingPoint S10 is TippingPoint S10 evaded by a two-fragment chain with manipulated Next Header pointers; vendors release patches but alternative header/fragment combinations still succeed.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:56Outline
- 1:23IPv6 is important
- 1:51IPv6 Datagrams
- 2:19Extension Headers
- 3:38Problems with Extension Headers
- 5:21Fragmentation
- 7:58Fragment header
- 10:15Summary
- 10:48A Fundamental Problem
- 12:36Chiron
- 14:01Sivirata Circuit
- 15:01Watercut
- 18:15Tipping Point
- 21:58Tipping Point Update
- 22:34Mitigation Approaches
- 24:04Conclusion
- 24:40Outro
related talks
58mEvasion of High-End IDPS Devices at the IPv6 Era
41mAPTs Way: Evading Your EBNIDS
52mFlying Under the Radar - New Security Evasion Techniques
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
40mISE-Skating: Lessons Learned in Bypassing Network Access Control
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
50mHTTP Desync Attacks: Smashing into the Cell Next Door