Security assessment on a VXLAN-based network Guido Pineda Reyes - - PowerPoint PPT Presentation

▶

Jan 09, 2023 104 likes •431 views

Introduction VXLAN prototype Security assessment Q&A Security assessment on a VXLAN-based network Guido Pineda Reyes MSc. Systems and Networking Engineering University of Amsterdam February 5, 2014 Guido Pineda Reyes Security

SLIDE 1

Introduction VXLAN prototype Security assessment Q&A

Security assessment on a VXLAN-based network

Guido Pineda Reyes

MSc. Systems and Networking Engineering

University of Amsterdam

February 5, 2014

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 2

Introduction VXLAN prototype Security assessment Q&A

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 3

Introduction VXLAN prototype Security assessment Q&A Virtual eXtensible LAN Research question Approach

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 4

Introduction VXLAN prototype Security assessment Q&A Virtual eXtensible LAN Research question Approach

Virtual eXtensible LAN

Introduction

Still an Internet Draft, current revision: 7th Allows to extend logical networks Encapsulates layer MAC-based Layer 2 frames within a UDP packet Up to 16 million logical networks Security measurements have not been performed yet

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 5

Introduction VXLAN prototype Security assessment Q&A Virtual eXtensible LAN Research question Approach

Virtual eXtensible LAN

Typical use case

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 6

Introduction VXLAN prototype Security assessment Q&A Virtual eXtensible LAN Research question Approach

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 7

Introduction VXLAN prototype Security assessment Q&A Virtual eXtensible LAN Research question Approach

Research questions

Main question: How feasible are the known VLAN attacks in a VXLAN environment? Subquestions:

Which attacks were successful? What is the difference between these attacks in a VLAN and a VXLAN environment? Is there anyway to prevent them or mitigate them?

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 8

Introduction VXLAN prototype Security assessment Q&A Virtual eXtensible LAN Research question Approach

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 9

Introduction VXLAN prototype Security assessment Q&A Virtual eXtensible LAN Research question Approach

Approach

Build the VXLAN prototype. Deploy the security assessment on the prototype. Focus on successful attacks. Understand how this attacks work to give a solution on how to mitigate or prevent them.

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 10

Introduction VXLAN prototype Security assessment Q&A

VXLAN prototype

Design

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 11

Introduction VXLAN prototype Security assessment Q&A

VXLAN prototype

Options

VMware vSphere products VMware vSphere + Cisco Nexus 1000v VXLAN Linux implementation (needs kernel modification)

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 12

Introduction VXLAN prototype Security assessment Q&A

VXLAN prototype

Connectivity tests: UDP encapsulated traffic

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 13

Introduction VXLAN prototype Security assessment Q&A

VXLAN prototype

Connectivity tests: VXLAN encapsulation

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 14

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Security Assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Evaluation

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 15

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 16

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

MAC Flood Attack

Scenarios

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 17

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

MAC Flood Attack

Tool: macof Results:

Attacker on physical net: Successful Attacker on logical net: Failed

Mitigation/Prevention:

Restrict the number of MAC addresses to one port Specify static MAC address association IDS

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 18

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 19

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Double-Encapsulated 802.1Q/Nested VLAN Attack

Scenario

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 20

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Double-Encapsulated 802.1Q/Nested VLAN Attack

Concept

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 21

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Double-Encapsulated 802.1Q/Nested VLAN Attack

Tool: scapy Results:

Attacker on logical net: Failed

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 22

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 23

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

ARP Attack

Scenarios

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 24

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

ARP Attack

Summary

Tool: arpspoof Results:

Attacker on physical net: Successful Attacker on logical net: Successful

Mitigation/Prevention:

Blocking direct communication between the attacker and the victim.

Configuring private communication between the hosts at the service provider level.

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 25

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

ARP Attack

Scenarios

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 26

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 27

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

UDP Flood Attack

Summary

Tool: flood.pl Results:

Attacker on physical net: Failed

Mitigation/Prevention:

IDS to detect unusual UDP traffic

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 28

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 29

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Further research

Possible vulnerability

Trying to modify the FDB and redirect all traffic to the attacker.

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 30

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Outline

1 Introduction

Virtual eXtensible LAN Research question Approach

2 VXLAN prototype 3 Security assessment

MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

4 Q&A

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 31

Introduction VXLAN prototype Security assessment Q&A MAC Flood Attack Double-Encapsulated 802.1Q/Nested VLAN Attack ARP Attack UDP Flood Attack Future research Conclusions

Conclusions

Most relevant points

Building the prototype is not trivial Some attacks are feasible Double-Encapsulation attack and MAC flooding attacks failures show that VXLAN segments are isolated from each other. ARP attacks show that Man in the Middle Attacks or DoS are possible from within any network (physical & logical). Mitigation and prevention is mainly related to best practices.

Guido Pineda Reyes Security assessment on a VXLAN-based network

SLIDE 32

Introduction VXLAN prototype Security assessment Q&A

Q&A

Questions?

Guido Pineda Reyes Security assessment on a VXLAN-based network