Unhackable network really unhackable?

[akuroda@mx5.nisiq.net ($B%8!]

Have you ever checked out the InvisiLAN technology?
InvisiLAN is seemingly developed by ex-KGB and CIA directors. It's a
random IP change technology inside LAN by a set of secureID like
network cards and special router. Anarkey Network security, a Dutch
company started to distribute InvisiLAN in Europe recently. I saw that
they started "hacker's challenge 2003" to let hackers to break their
invisible LAN security, however the news disappeared right away. I'm
very curious about the technology. Are there someone who're
knowledgeable about a security method to change randomly individual
PC's IP?

Original source
http://www.invictanetworks.com/
Distributor in Europe
http://www.anarkey.org/en/index.html

-------------------------------------------------
Programmer::Atsushi Kuroda::akuroda@mx5.nisiq.net
-------------------------------------------------

[Julian Wynne]

In-Reply-To: <20031124214628.9101.AKURODA@mx5.nisiq.net>

Dear Atsushi,

Thank you for your interest in InvisiLan technology. Regarding the hackchallenge;
due to practical reasons (we are in the process of creating a proper demo-space in
Amsterdam) we have decided to postpone the event.

We would like to make very clear that in the meantime anyone who wants to do a
live on-site test is more than welcome. Further enquiries can be made through <
hackchallenge@anarkey.org>

Furthermore we would like to point out that InvisiLAN technology has no relation
whatsoever with DHCP, for example InvisiLAN changes randomly not just the IP
address but also the MAC address and the port numbers.

We understand that the claim of unhackability is a steep one but I can assure you
that anyone who has tested the system in the past has been swept away by the
effectiveness and the implications of this new technology.

Best regards,

Julian Wynnne
Director of Sales and Marketing
http://www.anarkey.org

>Have you ever checked out the InvisiLAN technology?
>InvisiLAN is seemingly developed by ex-KGB and CIA directors. It's a
>random IP change technology inside LAN by a set of secureID like
>network cards and special router. Anarkey Network security, a Dutch
>company started to distribute InvisiLAN in Europe recently. I saw that
>they started "hacker's challenge 2003" to let hackers to break their
>invisible LAN security, however the news disappeared right away. I'm
>very curious about the technology. Are there someone who're
>knowledgeable about a security method to change randomly individual
>PC's IP?

>Programmer::Atsushi Kuroda::akuroda@mx5.nisiq.net

[Niels Bakker]

* bugjules@anarkey.org (Julian Wynne) [Thu 27 Nov 2003, 19:14 CET]:
[..]
> Furthermore we would like to point out that InvisiLAN technology has no
> relation whatsoever with DHCP, for example InvisiLAN changes randomly
> not just the IP address but also the MAC address and the port numbers.

That rules out long-living TCP sessions. Kind of defeats the purpose of
having a machine connected, doesn't it?


-- Niels.

--
[Please reply to niels=bugtraq@bakker.net instead. I'm sick and tired
of all the morons who misconfigure their mailers and send autoreplies
back after anybody contributes something to a mailing list.]

[Crispin Cowan]

Julian Wynne wrote:

>Furthermore we would like to point out that InvisiLAN technology has no relation
>whatsoever with DHCP, for example InvisiLAN changes randomly not just the IP
>address but also the MAC address and the port numbers.
>
The InvisiLAN technique is an instance of what I called "interface
permutation" in this paper:

"The Cracker Patch Choice: An Analysis of Post Hoc Security
Techniques". Crispin Cowan, Heather Hinton, Calton Pu, and Jonathan
Walpole. Presented at the National Information Systems Security
Conference (NISSC) <http://csrc.nist.gov/nissc/>, Baltimore MD,
October 16-19 2000. PDF
<http://immunix.com/%7Ecrispin/crackerpatch.pdf>.

The specific approach of IP address hopping was described in this DARPA
experiment:

"Dynamic Approaches to Thwart Adversary Intelligence Gathering
<http://www.iaands.org/discex_II/Briefs/13June/I&E/I&E_4_Kewley_DISCEXII_DYNAT.ppt>",
Doreen Kewley et al, DARPA Information Survivability Conference &
Expo (DISCEX II), June 12-14, 2001.


>We understand that the claim of unhackability is a steep one but I can assure you
>that anyone who has tested the system in the past has been swept away by the
>effectiveness and the implications of this new technology.
>
In the DARPA experiment anyway, it turned out to be hackable :) More
precisely, it imposed a delay on the attacker, but did not stop them. A
notable difference is that the DARPA experiment only changed the IP
address, and not the MAC address. I'm not convinced that this will make
a difference, but it could.

Crispin

--
Crispin Cowan, Ph.D. http://immunix.com/~crispin/
Chief Scientist, Immunix http://immunix.com
http://www.immunix.com/shop/

[Kurt Seifried]

>Furthermore we would like to point out that InvisiLAN technology has no
relation
>whatsoever with DHCP, for example InvisiLAN changes randomly not just the
IP
>address but also the MAC address and the port numbers.

I don't see how MAC address changes would help for several reasons:

1) across the internet, let's face it. no-one cares what your MAC address
is.
2) on local networks I can wtach arp traffic
3) you can no longer do port locking on switches to a given MAC address

I assume the invisilan technology needs some sort of client/server setup
with a master to track all the IP/MAC/port changes, otherwise client systems
will never be able to connect properly to servers. This would seem to me to
be a nice vulnerability point.

Assuming the MAC address keeps changing any established connections can be
more easily hijacked by assuming the old MAC address (which the victim was
polite enough to give up on it's own).

As far as I can tell this actually makes it sound like it would make a local
attackers life easier. Firewalling can't really be used to restrict access
to systems since the ports/ip keep changing, any IDS solution is going to
yack up hairballs, assuming you can ever get it tuned to actually see the
traffic properly, etc, etc.

As for remote attackers, ok, it makes life a bit harder, but wouldn't those
remote people who shouldn't be accerssing you be firewalled anyways?

All in all it sounds like a wonky technology that hasn't been clearly
thought out, and doesn't really address an identifiable problem. But boy,
does it ever sound cool (I suppose one star out of five for sheer chutzpah
is ok).

Kurt Seifried, kurt@seifried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/

[Thor]

> >We understand that the claim of unhackability is a steep one but I can
assure you
> >that anyone who has tested the system in the past has been swept away by
the
> >effectiveness and the implications of this new technology.
> >
> In the DARPA experiment anyway, it turned out to be hackable :) More
> precisely, it imposed a delay on the attacker, but did not stop them. A
> notable difference is that the DARPA experiment only changed the IP
> address, and not the MAC address. I'm not convinced that this will make
> a difference, but it could.

I had actually posted earlier regarding MAC addresses and the ease of adding
static entries in the ARP table to hit a host on the local LAN (once in),
but it did not seem to make it.

It is refreshing to see you (the vendor, not you Crispin) use "the
effectiveness and implications" rather than stand by "un-hackable," even
though I know it was the OP's statement, and not the vendors. Even if
hackable, it looks like a pretty effective layer of security, which may make
attackers look for LHF. I have accomplished similar security-in-depth
features by requiring IPSec for all IP traffic (certificate based) though
that is of course at the network software layer, and some administrative
issues are introduced by such a configuration. Interesting stuff, though.

T