ISE-Skating: Lessons Learned in Bypassing Network Access Control
summary
Shows a reproducible ISE-Skating bypass that takes under a minute by inserting a hub/unmanaged switch or a disguised UPS + Raspberry Pi between supplicant and switch, capturing the EAPOL START, cloning the victim MAC, spoofing IPs and avoiding BPDU generation so the port stays forwarding. Demonstrates automated tooling that detects re‑auth intervals and random IP aliasing to avoid races. Defenses tested: enable BPDU guard, segment MAB devices, enforce consistent NAC configs, ACLs and monitor for IP aliasing.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:24What will you learn?
- 2:27Components and intended Process
- 4:57MAB Bypass
- 6:56Abuse of Misconfigurations
- 10:57BPDUs are the key
- 12:54Unmanaged Switch
- 15:24The Physical Attack Box
- 15:53ISE Skate Service
- 18:08Abusing NAC Authentication Process
- 27:11"Apply" Slide
- 29:38Additional Resources
related talks
41mAPTs Way: Evading Your EBNIDS
29mFrom Zero to Success
58mEvasion of High-End IDPS Devices at the IPv6 Era
30mNetwork Technocracy: A Tale of Monitoring, Spoofing, Intercepting and Social Engineering
25mEvasion of High-End IPS Devices in the Age of IPv6
47mFinding a Needle in an Encrypted Haystack
33mWi-Fi Brokering
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools