IPv4 vs. IPv6 Security Considerations

Searching_ _ _ · Nov 18, 2010

Types of Threats

Reconnaissance - Provide the adversary with information enabling other attacks

Unauthorized Access - Exploit the open transport policy inherent in the IPv4 protocol
Header Manipulation and Fragmentation - Evade or overwhelm network devices with carefully crafted packets

Layer 3 – Layer 4 Spoofing - Modify the IP address and port information to mask the intent or origin of the traffic

ARP and DHCP Attacks - Subvert the host initialization process or a device the host accesses for transit

Broadcast Amplification Attacks (smurf) - Amplify the effect of an ICMP flood by bouncing traffic off of a network which inappropriately processes directed ICMP echo traffic

Routing Attacks - Disrupt or redirect traffic flows in a network

Viruses and Worms - Attacks which infect hosts and optionally automate propagation of the malicious payload to other systems

Sniffing - Capturing data in transit over a network

Application Layer Attacks - Broad category of attacks executed at Layer 7

Rogue Devices - unauthorized devices connected to a network

Man-in-the-Middle Attacks - Attacks which involve interposing an adversary between two communicating parties

Flooding - Sending bogus traffic to a host or network designed to consume enough resources to delay processing of valid traffic

Attacks fundamentally the same between IPv6 & IPv4

Sniffing

Without IPsec, IPv6 is no more or less likely to fall victim to asniffing attack than IPv4

Application Layer Attacks

Even with IPsec, the majority of vulnerabilities on the Internet today are at the application layer, something that IPsec will do nothing to prevent

Rogue Devices

Rogue devices will be as easy to insert into an IPv6 network as in IPv4

Man-in-the-Middle Attacks (MITM)

Without IPsec, any attacks utilizing MITM will have the same liklihood in IPv6 as in IPv4

Flooding

Flooding attacks are identical between IPv4 and IPv6

Reconnaissance

At 100M pings / second (40 Gbps fdx), it takes > 5,800 years to scan the address range for just one subnet.

Worm and virus propagation will fail or will have to find an alternative search path.

So will scanning based network management products…

L3 - L4 Spoofing

L3 Spoofing is very common in IPv4, RFC 2827 defines mechanisms to largely eliminate L3 spoofing but this has not seen broad adoption in IPv4 networks.

Note that RFC 2827 stops the spoofing of the network portion of an IP address, not the host portion

L4 Spoofing can be done in concert with L3 spoofing to attack systems (most commonly running UDP, I.e. SNMP, Syslog, etc.

Nearly 25% of the current IPv4 space has not been allocated, and around 8% more is reserved for special use (RFC3330) making it fairly easy to block at network ingress through bogon filtering.

IPv6 deployments should deploy the filtering discussed in RFC 2827 at every point up the aggregation hierarchy.

Translation and Tunneling

Tunneling and Address Translation are security issues regardless of protocol

Tunneling - IPv4 over HTTP, ICMP tunneling, etc.

These have been covert channel for hackers for many years.

IPv6 tunnels are only one other avenue of attack and the approaches to deal with it are the same as IPv4 tunnels.

NAT has been a challenge to security as well.

NAT limits the ability to trace an attack to a source machine

IPv4 NAT has been known to break applications and efforts to secure them.

NAT-PT allows IPv4 to interact with IPv6 but has the same issues as IPv4/IPv4 NAT.

Click to expand...

-http://www.6diss.org/publications/presentations/hain-security.pdf- IPv6 Security Issues: Thinking Outside the NAT Box - Tony Hain

~ Source Page: http://www.6diss.org/publications/index.html ~

Searching_ _ _ · Nov 18, 2010

DEEPSEC
IN-DEPTH SECURITY CONFERENCE 2010 EUROPE — November 23–26; Vienna, Austria

Pentesting and Securing IPv6 Networks
Marc "van Hauser" Heuse, Baseline Security

This is the only workshop in the world which shows you how to perform on IPv6 networks - in theory and hands-on, as this is the only workshop which supplies you with the necessary tools which are nowhere else available.
Today IPv6 is available on every desktop and every server, as all operating systems since Windows XP and Linux Kernel 2.2 support IPv6. Hosting providers start to offer IPv6 addresses and networking. IPv6 is already available in corporations, e.g. all major mobile providers already support it on their backbones.
This training explains the IPv6 issues, concentrating on the security vulnerabilities inherent in the protocol as well as configuration issues and implementation problems. All so far known vulnerabilities are presented and students will be able to try them out themselves with supplied tools on the test network.
Then - switching sides - it is explained how to secure IPv6 systems (Windows, Solaris, Linux) and especially large networks including routing and how to solve the difficult firewalling questions which arise with IPv6. New advances like SEND, new DHCP6 developments and ISATAP etc. are included.
Trainees will not only receive the current unpublished version of the thc-ipv6 protocol attack suite (which has more than twice the functionality of the current public release) but also receive direct development source code access for the future. Some of the code will begin to be published in 2011 only.
Click to expand...

NOTE:
I am doing a hands-on training on IPv6 penetration testing and security
IPv6 networks at the Deepsec conference.
In the training I will not only hand-out the current version of thc-ipv6
(11 new attack tools, and existing tools enhanced) but also train how to
use them in a live network - hands-on.
Click to expand...

http://freeworld.thc.org/thc-ipv6/

Recent advances in IPv6 Insecurities
Marc Heuse, Baseline Security Consulting

Five years have past since my initial talk on IPv6 insecurities 2005 and 2006. New protocol features have been proposed and implemented since then and ISPs are now slowly starting to deploy IPv6. Few changes have led to a better security of the protocol, several increase the risk instead. This talk starts with a brief summary of the issues presented 5 years ago, and then expands on the new risks especially in multicast scenarios. As an add-on, discovered implemention security issues in Windows 7/2008, Linux and Cisco will be shown too. Lets hope patches are out until the conference, if not - they had enough time. All accompanied with GPL'ed tools to and a library: the new thc-ipv6 package. rewritten, expanded, enhanced.
Click to expand...

https://deepsec.net/docs/speaker.html#WSLOT05

login01 · Nov 19, 2010

Now that someone is claiming the FIRST "Security/Hacking Class", I guess I need to throw my hat into the discussion. I have been teaching classes in the topic for the last 6 years on an invite only bases. Three years ago I was teaching a public IPv6 security/hacking class at Command Information.

The class included theory, hands on attacks and defenses. It also included impact on compliance and common deployment mistakes.

Although I have to admit, having Van Hauser also teaching a class on the same topic is an Honor.

Searching_ _ _ · Nov 20, 2010

Hi login01'

I'm new to understanding IPv6 and am interested in implementing it in the local area network. There is a plethora of info, what guides or material would you recommend that would get me up to speed?
I have found that some D-Link routers support native IPv6, DIR 655, DIR 825 in my limited research.

Would it be possible or good for everyone to switch to IPv6 for all LAN networking?
Maybe this would free up more addresses for public IP's to give industry more time to build up the infrastructure. :shrugs:

Log in or Sign up

IPv4 vs. IPv6 Security Considerations

Searching_ _ _ Registered Member

Searching_ _ _ Registered Member

login01 Security Researcher

Searching_ _ _ Registered Member

Log in or Sign up

IPv4 vs. IPv6 Security Considerations

Searching_ _ _ Registered Member

Searching_ _ _ Registered Member

login01 Security Researcher

Searching_ _ _ Registered Member

Useful Searches