You are on page 1of 37

Source Routing

A Simple Explanation of the Dangers

The Players

Ivan

Alice

Bob

Eddie

The Setup
Backbone

Ivan

Linksys

10.2.1.8
Alice
10.5.0.1

Bob

Eddie

10.5.0.2
3

Who Controls What


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob

Linksys
?
Eddie

10.5.0.2
4

The Setup...
Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

10.27.1.7
Linksys
10.5.0.50

Bob

Eddie

10.5.0.2

10.5.0.2
5

Eddie Sends a Packet


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
6

Eddie Sends a Packet


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
6

Eddie Sends a Packet


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
6

Eddie Sends a Packet


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

Unreachable
10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
6

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

What if we spoofed it?


Backbone

Ivan
10.2.1.8
Bob
Alice
Reset!
10.5.0.1
10.5.0.2

>

10.5.0.1

10.27.1.7
Linksys
192.168.1.1
Eddie
192.168.1.100
7

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

> 10.27.1.7

10.2.1.8
10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
8

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

> 10.27.1.7

10.2.1.8
10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
8

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
> 10.2.1.8
10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
9

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
> 10.2.1.8
10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
9

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
> 10.2.1.8
10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
9

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
> 10.2.1.8
10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
9

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic


Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

Source Routing Magic

2 Way
Spoofed
Communication!

Backbone

Ivan
10.2.1.8
Alice
10.5.0.1

Bob
10.5.0.2

10.27.1.7
10.2.1.8
> 10.5.0.1

10.27.1.7
Linksys
10.5.0.50
Eddie
10.5.0.2
10

You might also like