MD5 attacks for BGP.
Just like in the routing protocols described earlier, BGP uses the MD5 authentication mechanism. According to RFC 2385 "Protection of BGP Sessions via the TCP MD5 Signature Option", each segment is authenticated with a 16-bit MD5 hash for the following fields:
TCP pseudo-header (in the following order: source IP address, destination IP address, zero-padded protocol number, segment length);
TCP header, excluding TCP options.
In general, all the information that an attacker needs to calculate the MD5 authentication hash is provided in a TCP packet, excluding the Shared key, which a hacker can try to crack
using dictionary matching using the bgpcrack utility from the CIAG BGP package.
Bgpcrack can work both online and offline. Online, the target router is bombarded with TCP segments with a SYN flag and MD5 signatures generated using various passwords. If the signature is suitable, the router will respond with a SYN-ACK. This is not the most effective attack methodology, as it requires a lot of time and network resources. This type of attack is recommended only for "blind attacks". The well-known utility John the Ripper can also be used to crack MD5. The combination of ciag-bgp tools for generating TCP packets and John the Ripper for BGP hacking will allow it to be performed online. Below is an example in which a small script written in Perl tcp-sig-crack.pl , is used to carry out an attack:
john -wordfile:/path_to_a_dictionary_file/ dictionary.txt -stdout |
examples/tcp-sig-crack.pl -S <source IP> -D <target IP> --dport bgp --syn
It is much better to use bgpcrack offline to crack BGP packets intercepted using a sniffer. Here is a small example:
arhontus# ./bgpcrack -r bgppackets.pcap -w dictionary-file port bgp
90 frames have been processed.
There are 73 TCP segments with MD5 signatures.
Using 6720 bytes for storage of MD5 data.
Found a match in frame 5.
Password is 'secretbgp'. Bye.
Oleg Petukhov, lawyer in the field of international law and personal data protection, information security specialist security, protection of information and personal data.
Telegram channel: https://t.me/protectioninformation
Telegram Group: https://t.me/informationprotection1
Website: https://legascom.ru
Email: online@legascom.ru
#informationprotection #informationsecurity
