Hakin9 Article - Advanced SPA with fwknop
25 August, 2008
In the latest issue of Hakin9 Magazine,
I had an article published entitled Advanced SPA with fwknop. It
was the goal of this article to introduce the port forwarding capabilities of fwknop
that make it possible to reach internal services with automatically generated NAT
rules, and also to show how fwknop SPA packets (prior to the 1.9.6 release) could be
detected with some well-crafted Snort rules that look for certain encryption and
encoding artifacts. Also, with the addition of
source IP addresses to SPA digest tracking,
it is possible to get a sense of routing paths that might at one time have had
sniffers watching for SPA packets if a replay attack against the same fwknopd
instance is detected at some later time.
The Snort rules mentioned in the article - updated to take into account the more recent 1.9.6 release - are displayed below. The first Snort rule is designed to look for UDP packets over port 62201 that end with two '=' characters - a potential marker of base64-encoded data (when the original data size was not a multiple of four). The second rule looks for the base64-encoded version of the string Salted__, which is added by the Crypt::CBC module to maintain compatibility with how the OpenSSL library encrypts data. The third rule looks for packets that begin with base64-encoded version of the string 0x8502 which is a marker for data encrypted with GnuPG, and also checks to see of the size of the payload is at least 1000 bytes (SPA packets encrypted with GnuPG tend to be larger than those encrypted with Rijndael). Here are the Snort rules:
alert udp any any -> any 62201 (msg:"fwknop pre-1.9.6 SPA traffic"; dsize:>150;
pcre:"/==$/"; sid:20080001; rev:1;)
alert udp any any -> any 62201 (msg:"fwknop pre-1.9.2 SPA traffic";
content:"U2FsdGVkX1"; depth:10; dsize:>150; sid:20080002; rev:1;)
alert udp any any -> any 62201 (msg:"fwknop GnuPG encrypted pre-1.9.6 SPA traffic";
content:"hQ"; depth:2; dsize:>1000; sid:20080003; rev:1;)
Any recent release of fwknop (greater than 1.9.5) strips out these identifying
markers before transmitting SPA packets on the wire, so these rules are no
longer effective at detecting fwknop SPA communications. Also, strong
port randomization
features were added in fwknop-1.9.4, both for the randomization of
the SPA packet destination port as well as the port where the actual connection
(say, SSH) is made, so UDP port 62201 is not effective either when these features
are used.
Finally, here is an excerpt from the conclusion of the article:
In the continual arms race that is computer security today,
having a good understanding of network communications and how to customize an
IDS rule set to an emerging protocol is an important skill. Finally, SPA
offers a compelling addition to the tools available for effective server
defense; I personally sleep more soundly knowing that arbitrary IP addresses
around the Internet cannot see that I have an SSH daemon running, and yet I can
access it from wherever I like.
