Fantastic Ethertypes and Where to Find Them
Ricky Lawshae explores esoteric non-IP Ethernet protocols across transportation, industrial SCADA, and healthcare networks, demonstrating packet injection vectors.
Summary
Exploring Beyond the TCP/IP Protocol Stack
While most security monitoring focuses exclusively on IP-based traffic, Layer 2 Ethernet frames support hundreds of specialized, non-routable protocols defined by distinct EtherType fields.
Surveying Esoteric Ethertypes in the Wild
Ricky Lawshae investigates obscure Ethernet protocols deployed in industrial manufacturing plants, rail transportation networks, and hospital clinical facilities.
Security Implications of Unauthenticated Layer 2 Protocols
Many specialized EtherType implementations lack basic authentication, encryption, or sequence validation, allowing local network attackers to inject control commands directly.
Defensive Visibility and Network Segmentation
The presentation demonstrates packet crafting tools for auditing non-IP protocols and provides network architecture recommendations for Layer 2 filtering.
Related talks
Main Stage·22 min
Katie Inns
Katie Inns introduces HL7Magic, an open-source Burp Suite extension enabling security researchers to intercept, decode, and tamper with legacy HL7 medical device traffic.
Biohacking Village·26 min
Mixæl Laufer
Four Thieves Vinegar Collective founder Mixæl Laufer shares open-source medicine projects, decentralized hardware, and grassroots biohacking initiatives.
Biohacking Village·37 min
Bryson Bort
Analyzes industrial control and embedded medical device architectures within hospital clinical networks.