Configuration bypass attacks¶

Attack pattern¶

IPsec protects the traffic its policy says to protect, and the policy is a set of rules a human wrote. The Security Policy Database decides which packets get a tunnel and which pass in the clear, and where those rules are complex, ambiguous or optimised for speed, a packet can be steered into the gap that goes unprotected. Bypass the policy and the traffic never enters IPsec at all: nothing to defeat, only a rule that did not fire.

2.1.1 Configuration Bypass [OR]

    2.1.3.1 Bypass SPD (Security Policy Database) rules
        • Crafted packet manipulation to evade policy matching
        • IP fragmentation to split policy-relevant information across packets
        • Traffic flow manipulation to fall between policy definitions
        • Protocol field spoofing to match unintended policies

    2.1.3.2 Weak policy enforcement
        • Fail-open behaviour exploitation during system stress
        • Policy cache poisoning through timing attacks
        • Race conditions in policy application during rekeying
        • Boundary condition exploitation in policy scope matching

    2.1.3.3 Mixed mode policy exploitation
        • Policy ambiguity exploitation in transport vs tunnel mode
        • Simultaneous protected and unprotected session manipulation
        • Policy priority manipulation to select weaker protections
        • Mode transition attacks during session establishment

    2.1.3.4 Default configuration abuse
        • Vendor default policy and key exploitation
        • Default permit policies in security gateway configurations
        • Hardcoded credential and policy exploitation
        • Out-of-box configuration vulnerability exploitation

The rule that did not fire¶

SPD rules get complex, and complex rule sets are hard to keep consistent.
Policy-lookup optimisations can create the very gaps they were meant to close.
Vendors enforce policy differently, so the same rules behave differently in different places.
Compatibility requirements keep weak configurations alive.
Complex policy is error-prone, and a misplaced rule leaves traffic unprotected.
Default configurations are often undocumented from a security angle, so the gaps are invisible.