Complete item: http://www.theregister.co.uk/2009/04/16/internet_backbone_hacking/
Description:
Network backbone technologies used to route traffic over large corporate networks are vulnerable to large-scale hijacking attacks, according to two researchers who released freely available software on Thursday to prove their point.
The tools, demonstrated at the Black Hat security conference in Amsterdam, are intended to show that attacks once believed to be only theoretical are very much practical, said Enno Rey, one of the creators of the software. He developed the tools along with researcher Daniel Mende.
"We think the trust models of some technologies that are widely deployed in some networks are outdated," Rey told The Register. "This is to make people aware that the technologies they use in their daily life are not as secure as they might seem.
Some of the new tools attack a network data-forwarding technology known as MPLS, or multiprotocol label switching. Carriers such as Verizon, AT&T and Sprint use it to segregate one corporate customer's traffic from another's as it's shuttled from one geographic region to another. The tools make it trivial for anyone with access to the carrier's network to redirect that traffic or alter data on it.
The software works because MPLS has no mechanism for protecting the integrity of the headers that determine where a data packet should be delivered.
"There is no way of detecting modification of labels," Rey said. "If somebody gets access to this network, it's quite easy to cause disastrous havoc."
Other tools attack a separate network technology known as BGP, or border gateway protocol. Among other things, they crack the MD5 cryptographic keys used to prevent tampering. They also make it easy to inject unauthorized routes in BGP tables, allowing an attacker to hijack huge swaths of internet traffic.
Other tools exploit similar weaknesses in the ethernet protocol.
Of course, the lack of security in MPLS, BGP and ethernet is well documented. At last year's Defcon hacker conference, for example, researchers Anton "Tony" Kapela and Alex Pilosov demonstrated an attack on BGP that allowed them to redirect traffic bound for the conference network in Las Vegas to a system they controlled in New York. Other internet underpinnings, including the DNS, or domain name system, and SNMP or Simple Network Management Protocol have also been shown to be vulnerable to tampering.
Rey said he and Mende are well aware of this research. But up to now, the assumption has been that the attacks are technically difficult to carry out. The goal of the tools is to make corporate security professionals aware that the only thing preventing the hijacking of entire corporate networks is the steps carriers take to secure their infrastructure.
"Try to understand if your carrier is trustworthy," he recommended. "If there are any doubts, it might be a good idea to encrypt the traffic. We just want people to be able to make informed decisions."
E-Secure-IT
https://www.e-secure-it.com
