New Red Team Networking Techniques for Initial Access and Evasion

New Red Team Networking Techniques for Initial Access and Evasion

Speakers: Shu-Hao Tung

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=mdFRLCnACJM

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Shu-Hao%20Tung%20-%20From%20Spoofing%20to%20Tunneling%20New%20Red%20Team%20Networking%20Techniques%20for%20Initial%20Access%20and%20Evasion.pdf

Overview

In this DEF CON 33 talk, red team researcher Shu-Hao Tung from Taiwan presents a suite of novel network-layer attack techniques that challenge common assumptions about corporate perimeter security. The presentation—titled in full "From Spoofing to Tunneling"—covers IP spoofing for initial access, vulnerability exploitation via routing protocols (OSPF in particular), and IP-over-DNS tunneling as a covert communication channel. The thread connecting all three themes is a fundamental insight: many enterprise networks are far more permissive at Layer 2 and Layer 3 than defenders realize, and attackers who understand these lower-level protocols can bypass controls that higher-layer security products never inspect.

The talk is framed around a puzzling scenario Tung encountered in his own lab: an intranet server with no destination NAT received a login attempt from a public IP address. That anomaly—which he eventually traced to IP spoofing—became the starting point for a research arc that ultimately exposed serious flaws in how enterprise routing is managed and how DNS is trusted.

Background

▶ Watch: Introduction: red team networking beyond basic enumeration (2:15)

Enterprise security teams typically focus their energy on application-layer controls—web application firewalls, endpoint detection, SIEM correlation rules—and on east-west micro-segmentation. The network layer itself is often treated as solved infrastructure. Tung's research challenges this assumption by revisiting attack surfaces that have been known in theory for decades but have not been systematically weaponized in modern red team engagements.

IP spoofing has historically been considered a limited threat in switched networks because most ISPs apply ingress filtering (BCP38) and switches enforce anti-spoofing at Layer 2. However, Tung demonstrates that within a corporate intranet—particularly across VLANs or on segments where anti-spoofing is not enforced—raw socket spoofing remains viable and useful. Similarly, routing protocols such as OSPF are deployed extensively in enterprise environments but are rarely treated as an attack surface by blue teams.

The DNS tunneling component extends prior work on using DNS as a covert channel, but Tung's contribution is to demonstrate full Layer 3 IP-over-DNS tunneling—not just application-layer data exfiltration—enabling an attacker to route arbitrary TCP/IP traffic through a DNS resolver.

Key Findings

▶ Watch: Technique 2: OSPF LSA injection to hijack enterprise routing (11:20)

IP Spoofing for Initial Access: Tung demonstrates that an attacker on the same local segment (or on a segment without proper anti-spoofing controls) can send TCP SYN packets with a spoofed source IP. When the target responds with a SYN-ACK to the spoofed address, and if the attacker can predict or observe the TCP sequence number, a session can be established without owning the IP. He extended this concept to show that spoofed IP packets can reach intranet servers that have no public routing, defeating IP-based access controls and allowlists.

OSPF Injection and IP Hijacking: The most significant finding is the exploitation of OSPF (Open Shortest Path First), the dominant link-state routing protocol in enterprise networks. Tung shows that an attacker with access to a segment where OSPF is running—even as an unauthorized participant—can inject malicious Link State Advertisements (LSAs). By advertising a more specific route for a target prefix, the attacker can redirect traffic destined for legitimate hosts to an attacker-controlled machine. This constitutes a full IP hijack within the routing domain. The attack is made possible because many enterprise OSPF deployments do not enable MD5 or SHA cryptographic authentication, relying instead on network segmentation as a substitute for protocol-level security.

BGP Route Manipulation: The talk briefly extends the routing attack surface to BGP in environments where internal BGP (iBGP) is used for route reflection. Similar LSA injection logic applies when an attacker gains access to a router or an adjacent segment without BGP authentication.

IP-over-DNS Tunneling: Tung presents a full IP tunneling implementation that encapsulates arbitrary IP packets inside DNS queries and responses. Unlike traditional DNS tunneling tools (such as iodine) that provide a simple TCP-over-DNS channel, this approach operates at Layer 3, allowing the attacker to route any protocol. The technique is especially powerful in environments where UDP/53 outbound is permitted but other protocols are blocked—a common configuration in restrictive enterprise networks and captive portals.

Tool Release: All tools and proof-of-concept code from the research were published to the speaker's GitHub account, enabling both red teamers and defenders to test their own environments.

Technical Deep Dive

▶ Watch: Technique 3: IP-over-DNS tunneling through port 53 only (18:00)

IP Spoofing Mechanics

The attack begins with raw socket programming. On Linux, a process with CAP_NET_RAW (or running as root) can craft arbitrary Ethernet frames or IP packets using SOCK_RAW. Tung's implementation constructs TCP SYN packets with a forged source IP—an IP that the attacker does not own—and transmits them from a compromised host or rogue device on the network segment.

For the attack to complete a TCP handshake, the SYN-ACK from the target must be interceptable. In the intranet scenario, the attacker either:

1. Is on the same broadcast domain as the target and can observe all frames (or use ARP poisoning to redirect the SYN-ACK).
2. Can predict the ISN (Initial Sequence Number) through a side-channel or by sending many SYN packets and observing responses.

Once the handshake is established, the spoofed session allows the attacker to send application-layer data as if they were the trusted IP—defeating IP allowlists on SSH, RDP, database ports, and internal APIs.

OSPF LSA Injection

OSPF routers within an area flood Link State Advertisements that describe the network topology. Each LSA includes the advertising router's ID, the prefix being described, and the metric cost. When a more specific LSA for a prefix arrives, OSPF selects it by longest-prefix match, just as IP forwarding does.

Tung's attack flow:

1. Identify an OSPF area in the target network (passive listening on multicast 224.0.0.5/224.0.0.6).
2. Craft a Type-1 (Router LSA) or Type-5 (External LSA) advertisement claiming a /32 route for a high-value target IP with a very low metric.
3. Inject the LSA onto the segment. If OSPF authentication is absent (or only uses the trivially bypassed plain-text password option), neighboring routers accept and flood the LSA.
4. Traffic to the hijacked IP is now forwarded to the attacker's machine, where it can be inspected or proxied.

The attack affects all routers in the OSPF area and can persist until the legitimate router re-advertises or the injected LSA ages out (default LSA lifetime is 3600 seconds in OSPF).

IP-over-DNS Tunneling

The tunneling implementation creates a virtual network interface (TUN device) on both the client and the DNS server side. IP packets written to the TUN interface are base64-encoded and embedded as labels in DNS A or TXT queries. The server decodes them and injects them into its own TUN interface—and vice versa for the return path. The result is a bidirectional IP pipe that traverses DNS infrastructure.

The maximum DNS label length (63 characters) and the practical UDP payload limit constrain per-packet throughput, but for C2 traffic or data exfiltration, the bandwidth is sufficient. Tung measured usable throughput in real environments at several kilobytes per second—slow for large file transfers but adequate for interactive shells and credential harvesting.

Demo / Proof of Concept

▶ Watch: Live demo: OSPF injection and IP hijack on target network (23:30)

The talk includes live demonstrations of each technique:

• IP spoofing demo: A packet capture shows a TCP connection established to an intranet host from a public IP address that is not routed to the lab network. The SYN packet with the spoofed source is visible, followed by a SYN-ACK from the target and an ACK completing the handshake.

• OSPF injection demo: Wireshark captures show the rogue LSA flooding to legitimate OSPF routers. A traceroute before and after the injection shows traffic for a target /32 rerouting through the attacker's hop.

• DNS tunnel demo: An interactive shell running over the DNS tunnel is shown, with DNS query/response pairs in Wireshark containing encoded IP payloads. The shell operates through an enterprise proxy that blocks all non-DNS outbound traffic.

Defensive Implications

▶ Watch: Defensive mitigations: anti-spoofing, OSPF auth, and DNS filtering (37:00)

For IP Spoofing:

• Enable Dynamic ARP Inspection (DAI) and IP Source Guard on access switches to prevent Layer 2 spoofing within VLANs.
• Apply BCP38 ingress filtering on all routers, including internal segment boundaries, not just at the internet edge.
• Avoid relying on IP address as the sole access control for sensitive internal services; combine with certificate-based authentication or Kerberos.

For OSPF Security:

• Enable OSPF authentication on all areas. Use SHA-256 HMAC (RFC 5709) rather than the MD5 variant, which has known weaknesses. Plain-text OSPF passwords provide no meaningful protection.
• Deploy route dampening and maximum-LSA limits to make injection attacks noisier.
• Monitor for unexpected OSPF neighbor adjacencies and LSA changes; alert on new /32 advertisements for host routes that were not previously in the routing table.
• Consider using OSPF stub areas or totally stubby areas for segments where routing protocol participation should be minimal.

For DNS Tunneling:

• Implement DNS inspection on next-generation firewalls; alert on abnormally long query names, high query rates per host, or unusual record types (especially TXT).
• Deploy DNS security products (e.g., Cisco Umbrella, Palo Alto DNS Security) that detect tunneling heuristics.
• Where feasible, restrict outbound DNS to approved recursive resolvers rather than allowing direct external DNS queries.

Key Takeaways

1. Corporate networks that rely exclusively on application-layer controls are vulnerable to attackers who operate at Layer 2 and Layer 3.
2. OSPF without authentication is effectively an open routing protocol—any connected attacker can redirect traffic within an OSPF area.
3. IP-over-DNS tunneling provides a complete Layer 3 covert channel through the most universally permitted protocol in enterprise firewalls.
4. Red teams should include routing protocol manipulation in their standard toolkits; it is a high-impact, low-detection technique.
5. Defenders should audit OSPF authentication configurations as a priority, since the fix is a configuration change, not a product purchase.

About the Speaker(s)

▶ Watch: Key takeaways: network-layer attacks that bypass application controls (41:30)

Shu-Hao Tung is a red team researcher and security engineer based in Taiwan. At the time of the talk, he was a security researcher at Tich and a graduate of Chinhai University. He served as president of his university's hacking club and has focused his research on lower-level network protocols as an attack surface. This was his first DEF CON presentation and his first time in the United States. His research tools and proof-of-concept code are available on his public GitHub profile.