Skip to content

Routing injection (RIP/OSPF)

1. Context & stakes

Inject bogus routes into an unauthenticated IGP.

Interior gateway protocols such as RIP and OSPF exchange routes, and run without authentication a router believes any peer's advertisement. Injecting bogus routes blackholes traffic or pulls it through the attacker for MITM. Unauthenticated IGPs have caused real outages from a single rogue speaker; cryptographic neighbour authentication and passive interfaces contain it.

2. Theory

Interior gateway protocols (RIP, OSPF) build the routing table from advertisements exchanged between routers. Without neighbour authentication, an attacker injects routes to blackhole or reroute traffic - RIP via crafted responses, OSPF by forming an adjacency and flooding bogus LSAs.

3. Attack (PoC)

netlab-routing attack --i-own-this-network --iface veth-host
  1. Advertise RIP/OSPF routes
  2. Blackhole / reroute

4. Detection

netlab-routing detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Neighbour authentication (MD5/SHA)
  • Passive interfaces

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading