Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept

•

1 like•1,236 views

Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept. Slides for a speaking showing a simulated scenario where a regular network have a rogue IPv6 router

Technology

DUAL STACK SECURITY
A simple proof of concept on IPv4/IPv6 stacks

Some thoughts about current dual stack setups

Eduardo Coelho

http://coelho.pro.br

SCENARIO

• virtual
•2

simulated environment

linux vms, 1 windows8 vm

• vmware

built-in IPv4 DHCP server, host-only network

• simulated

rogue IPv6 ra/dhcp/dns with regular linux software

DUAL STACK MAY NOT BE
SMOOTH FROM A SECURITY
STAND POINT

IPV6 ADDRESSING

• global
• link

unicast

local

• unique

local

• others: anycast, multicast, reserved

and special

AUTOCONF IS A BIG THING

• lets

try to understand how it works:

• stateless
• router
• IPv6

autoconf

advertisement and preﬁx distribution

routing

DNS SETTINGS DELIVERY
• llmnr

• stateless
• dns-ra

dhcp6

(problem:windows non-compliance to rfc6106)

• remember

naming is now more important than with ipv4,
due to human difﬁculty manually handling ipv6 addresses

AUTOCONF CONCERNS

• rogue

routers

• rogue

dhcp servers

• snifﬁng

• spooﬁng

(man in the middle attacks)

CONCLUSIONS
• we

have provided a simple proof of concept for a rogue ra/
dns server on a dual-stack ipv4/ipv6 environment

• ipv6

technologies should be very well understood, specially
on dual-stack setups, which is how most of networks are set

• some

of the security issues are not ipv6 speciﬁc, but have a
greater impact due to current lack of precautions

• most

issues are due to stack implementation or by design,
which makes it difﬁcult to mitigate

What's hot

Konrad Wilk is a Software Development Manager at Oracle. His groupâ€™s mission is to make Linux and Xen Project virtualization better and faster. As part of this work, Konrad has been the maintainer of the Xen Project subsystem in Linux, Xen Project maintainer and now also Release Manager for the 4.5 release of the Xen Project Hypervisor. Konrad has been active in the Linux and Xen Project communities for more than 6 years and was instrumental in adding Xen Project support to the Linux Kernel.

XPDS14: Xen 4.5 Roadmap - Konrad Wilk, Oracle

The Linux Foundation

[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions

Zoltan Balazs

Xen Project CI for OpenStack Overview

The Linux Foundation

Simplifying Ceph Management with Virtual Storage Manager (VSM)

Ceph Community

Midwest php 2013 deploying php on paas- why & how

dotCloud

OSv presentation from Linux Foundation Collaboration Summit

Don Marti

Zabbix Performance Tuning

Ricardo Santos

QEMU Disk IO Which performs Better: Native or threads?

Pradeep Kumar

A year has passed since the last Xen Developer Summit and it is time to announce the quiet progress made on the libvirt libxl driver and related tooling. New features include memory, cpu, block device, and network interface statistics reporting, support for pvUSB, support for migration stream V2, peer-to-peer migration, UEFI for HVM guests via OVMF, and domain capabilities reporting to name a few. There are also many noteworthy improvements such as better conversion of xl.cfg to/from libvirt domXML, allowing users to easily switch between the xl+libxl and libvirt+libxl toolstacks. The summit also provides an opportunity to discuss new proposals such as better control of domain placement on NUMA systems, exposing Xen's cpu pool feature in libvirt, supporting non-volatile memory for UEFI variables, and improved capabilities reporting. Much of libvirt's value for Xen is in the tools built upon it: virt-manager, virt-viewer, virt-install, virt-builder, kimchi, OpenStack nova, etc. These tools also deserve a quick status update as they relate to Xen. The audience is encouraged to participate, e.g. by requesting a sorely missing feature, warning of an upcoming Xen change that may affect libvirt, or simply suggesting a change that makes virtualization management life a bit easier.

XPDS16: libvirt and Tools: What's New and What's Next - James Fehlig, SUSE

The Linux Foundation

In recent years Xen has seen the development of many minimalistic or specialized virtual machines (e.g., OSv, Mirage, ClickOS, Erlang on Xen, etc.). Thanks in part to a small CPU and memory footprints, these VMs allow for running thousands or more on a single, inexpensive commodity server. Doing so could save cloud and network operators vast amounts of money. Attempts to do so are already underway and have discovered important bottlenecks in Xen. While some of these have already been addressed by the community (e.g., limited number of event channels or memory grants) others still remain. In this talk we describe our experience when trying to run up to 10,000 MiniOS-based VMs, including bottlenecks in the XenStore, toolchain and network pipe. We further report on prototypical solutions, and on our implementation of suspend/resume for MiniOS that allows us tens of milliseconds migrations.

XPDS14 - Towards Massive Server Consolidation - Filipe Manco, NEC

The Linux Foundation

Xen Virtualization 2008

mwlang88

Nexenta at VMworld Hands-on Lab

Nexenta Systems

Presentation delivered at LinuxCon China 2016 UEFI HTTP/HTTPS Boot is a new feature of UEFI 2.5+. In the meantime, this feature is not yet implemented in any Linux bootloader. This Birds of a Feather session will give an introduction to UEFI HTTP/HTTPS Boot, and share a proof-of-concept implementation based on grub2 that works on both the emulator (QEMU/OVMF) and HPE ProLiant Gen10 servers. For HTTPS, the experience and comparison will be shared between the purely software-based and UEFI-based implementations in the aspects of ease of implementation, security strength, and limitation.

UEFI HTTP/HTTPS Boot

LinuxCon ContainerCon CloudOpen China

5. hands on - building local development environment with Open Mano

videos

ONIE: Open Network Install Environment @ OSDC 2014 Netways, Berlin

Nat Morris

Recent Developments in Donard

PMC-Sierra Inc.

4. open mano set up and usage

videos

A lot of the cloud discussion centers around which hypervisors are the best, and which management tools will simplify one's life the most. But is it the whole story? While addressing the problems from the lower and higher layers, the middle man -- the guest operating system -- is usually left behind. This talk will introduce OSv — a new from-scratch operating system written by a group of former Linux veterans designed specifically for cloud deployments. We will showcase the operating system architecture and explain the performance and manageability improvements that can be expected

OSv – The OS designed for the Cloud

Yandex

What's hot (18)

XPDS14: Xen 4.5 Roadmap - Konrad Wilk, Oracle

[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions

Xen Project CI for OpenStack Overview

Simplifying Ceph Management with Virtual Storage Manager (VSM)

Midwest php 2013 deploying php on paas- why & how

OSv presentation from Linux Foundation Collaboration Summit

Zabbix Performance Tuning

QEMU Disk IO Which performs Better: Native or threads?

XPDS16: libvirt and Tools: What's New and What's Next - James Fehlig, SUSE

XPDS14 - Towards Massive Server Consolidation - Filipe Manco, NEC

Xen Virtualization 2008

Nexenta at VMworld Hands-on Lab

UEFI HTTP/HTTPS Boot

5. hands on - building local development environment with Open Mano

ONIE: Open Network Install Environment @ OSDC 2014 Netways, Berlin

Recent Developments in Donard

4. open mano set up and usage

OSv – The OS designed for the Cloud

Viewers also liked

IPv6 Deployment in Japan

Akira Nakagawa

Operational Experience of MAP-E

Akira Nakagawa

JPNE MAP-E Deployment (IETF92@Dallas)

Akira Nakagawa

MAP-E as IPv4 over IPv6 Technology

Akira Nakagawa

MAP-E as IPv4 over IPv6 Technology - with some operational experiences

APNIC

Look at ipv6 security advantages over ipv4

Alexander Decker

IPv4 vs IPv6

NetProtocol Xpert

Die monatlichen Anlässe in Zusammenarbeit mit dem Swiss IPv6 Council behandeln verschiedene technische Themenbereiche von IPv6. Das Referat von Martin Gysi am 27. Oktober 2015 widmete sich der Funktionsweise von MAP (Mapping of Address and Port), einem neuen Übergangsmechanismus. Während bei 6rd, das heute bei Swisscom eingesetzt wird, IPv6-Daten über einen IPv4-Backbone transportiert werden, werden bei MAP IPv4-Daten über einen IPv6-Backbone transportiert. Dies reduziert die Anforderungen an bestehende oder neue IPv4-NATs beträchtlich und ist darum eine zukunftsweisende Technologie. MAP wird dabei verglichen mit anderen Übergangsmechanismen wie z.B. DS-Lite, um so deren Vor- und Nachteile und Anwendungsfälle aufzeigen zu können. Anhand eines Lab Setups zeigte Martin Gysi detailliert die Funktionsweise von MAP.

IPv6-Networking-Referat: «Mapping of Address and Port (MAP) – Deep Dive»

Digicomp Academy AG

資訊安全規劃

道成資訊股份有限公司

Presentation of ipv4 disadvantage,ipv6 advantage and transation from ipv4 to ...

安全程式設計 C語言

Ipv4 & ipv6

超越敏捷开发(成就敏捷企业之道)

電路學 - [第六章] 二階RLC電路

Comparison between ipv4 and ipv6

Dharmesh Patel

Linux firewall-201503

[嵌入式系統] 嵌入式系統進階

IPv6

Linux 的檔案系統格式介紹

IPV6 ppt

Viewers also liked (20)

IPv6 Deployment in Japan

Operational Experience of MAP-E

JPNE MAP-E Deployment (IETF92@Dallas)

MAP-E as IPv4 over IPv6 Technology

MAP-E as IPv4 over IPv6 Technology - with some operational experiences

Look at ipv6 security advantages over ipv4

IPv4 vs IPv6

IPv6-Networking-Referat: «Mapping of Address and Port (MAP) – Deep Dive»

資訊安全規劃

Presentation of ipv4 disadvantage,ipv6 advantage and transation from ipv4 to ...

安全程式設計 C語言

Ipv4 & ipv6

超越敏捷开发(成就敏捷企业之道)

電路學 - [第六章] 二階RLC電路

Comparison between ipv4 and ipv6

Linux firewall-201503

[嵌入式系統] 嵌入式系統進階

IPv6

Linux 的檔案系統格式介紹

IPV6 ppt

Similar to Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept

DevopsItalia2015 - DHCP at Facebook - Evolution of an infrastructure

Angelo Failla

CAv6TF Meeting - 2014-05-27 - IPv6@ VMware Integration Engineering

Christian Elsen

gogo6 IPv6 Video Series. Event, presentation and speaker details below: EVENT gogoNET LIVE! 3: Enterprise wide Migration. http://gogonetlive.com November 12 – 14, 2012 at San Jose State University, California Agenda: http://gogonetlive.com/4105/gogonetlive3-agenda.asp PRESENTATION Deploying IPv6 in Cisco's Labs Presentation video: http://www.gogo6.com/video/deploying-ipv6-in-cisco-s-labs-by-robert-beckett-at-gogonet-live Interview video: http://www.gogo6.com/video/interview-with-robert-beckett-at-gogonet-live-3-ipv6-conference SPEAKER Robert Beckett - Services Technical Leader, Cisco Systems Bio/Profile: http://www.gogo6.com/profile/RobertBeckett MORE Learn more about IPv6 on the gogoNET social network http://www.gogo6.com Get free IPv6 connectivity with Freenet6 http://www.gogo6.com/Freenet6 Subscribe to the gogo6 IPv6 Channel on YouTube http://www.youtube.com/subscription_center?add_user=gogo6videos Follow gogo6 on Twitter http://twitter.com/gogo6inc Like gogo6 on Facebook http://www.facebook.com/pages/IPv6-products-community-and-services-gogo6/161626696777

Deploying IPv6 in Cisco's Labs by Robert Beckett at gogoNET LIVE! 3 IPv6 Conf...

gogo6

Microsoft IT's IPv6 Killer App

Oliver Müller

RMLL / LSM 2009

Franck_Villaume

Rmll Virtualization As Is Tool 20090707 V1.0

guest72e8c1

IPv6 configuration at CSCS ● Dual Stack approach ● Static addressing for networking equipment and servers ● Dynamic addressing for PC and guest networks – Auto configuration with SLAAC ● But we still rely on DHCPv4 to distribute DNS – Tests ongoing for: ● Distributing DNS via RA (RDNSS, RFC6106) ● DHCPv6 IPv6 deployment 5 ● Configure the network part and FW/ACLs – Test ● Configure IPv6 on the systems – Test – At this point the system uses IPv6 and IPv4 for outgoing connections ● Publish the AAAA resource record into the DNS with short TTL – If test is succesful: set normal TTL for the RR AAAA – Now the system is fully IPv6 enabled IPv6 lessons learned 7 ● Some network devices send out RA even if they shouldn't – Impact: machines get IPv6 global address ● Disable SLAAC autoconfiguration on all the servers ● Rogue RA: – Impact: default gateway changed! No IPv6 connectivity anymore.. ● Filter RA messages at the network level ● IPv6 ACL: be careful not to filter NS/ND messages – Impact: you may break IPv6 connectivity ● On IPv6 ARP is replaced by ICMPv6 NS and ICMPv6 ND messages ● Firewall IPv6 limitations (CLI config needed, WebGUI not ready) ● Services not listening on IPv6. Remember to configure ssh, httpd, etc to listen also on IPv6

IPv6 at CSCS

Swiss IPv6 Council

fgont-h2hc-2020-ipv6-security.pdf

FernandoGont

The IPv6 protocol suite was designed to accommodate the present and future growth of the Internet, by providing a much larger address space than that of its IPv4 counterpart, and is expected to be the successor of the original IPv4 protocol suite. It has already been deployed by most major content providers (including Google and Facebook) and many Internet Service Providers (ISPs). While the ultimate goal of IPv6 is virtually the same as that of IPv4 (moving packets across the Internet), the underlying mechanisms and technical details are significantly different, typically resulting in unexpected security and privacy implications. In this presentation, Fernando will cover the state of the art in everything ranging from IPv6 pentesting, to security controls and operational mitigations for IPv6 attacks, thus providing valuable information to red, blue, and purple teams.

Fernando Gont - The Hack Summit 2021 - State of the Art in IPv6 Security

EdgeUno

IPv6 networking training sduffy v3

Shane Duffy

The container abstraction hit the collective developer mind with great force and created a space of innovation for the distribution, configuration and deployment of cloud based applications. Now that this new model has established itself work is moving towards orchestration and coordination of loosely coupled network services. There is an explosion of tools in this arena at different degrees of stability but the momentum is huge. On the above premise this session we'll delve into a selection of the following topics: - Two minute Docker intro refresher - Overview of the orchestration landscape (Kubernetes, Mesos, Helios and Docker tools) - Introduction to Docker own ecosystem orchestration tools (machine, swarm and compose) - Live demo of cluster management using a sample application. A basic understanding of Docker is suggested to fully enjoy the talk.

The age of orchestration: from Docker basics to cluster management

Nicola Paolucci

2012 11-09 facex - i pv6 transition planning-

Eduardo Coelho

High performace network of Cloud Native Taiwan User Group

HungWei Chiu

7 slaac-rick graziani

Alejandro Reyes

Big Data in Container; Hadoop Spark in Docker and Mesos

Heiko Loewe

Integrate Kubernetes into CORD(Central Office Re-architected as a Datacenter)

inwin stack

Implementing an IPv6 Enabled Environment for a Public Cloud Tenant

Shixiong Shang

Network Stack in Userspace (NUSE)

Hajime Tazaki

Ron Broersma dren-stavanger-22 nov2011

IPv6no

Oracle Sandbox

Datavail

Similar to Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept (20)

DevopsItalia2015 - DHCP at Facebook - Evolution of an infrastructure

CAv6TF Meeting - 2014-05-27 - IPv6@ VMware Integration Engineering

Deploying IPv6 in Cisco's Labs by Robert Beckett at gogoNET LIVE! 3 IPv6 Conf...

Microsoft IT's IPv6 Killer App

RMLL / LSM 2009

Rmll Virtualization As Is Tool 20090707 V1.0

IPv6 at CSCS

fgont-h2hc-2020-ipv6-security.pdf

Fernando Gont - The Hack Summit 2021 - State of the Art in IPv6 Security

IPv6 networking training sduffy v3

The age of orchestration: from Docker basics to cluster management

2012 11-09 facex - i pv6 transition planning-

High performace network of Cloud Native Taiwan User Group

7 slaac-rick graziani

Big Data in Container; Hadoop Spark in Docker and Mesos

Integrate Kubernetes into CORD(Central Office Re-architected as a Datacenter)

Implementing an IPv6 Enabled Environment for a Public Cloud Tenant

Network Stack in Userspace (NUSE)

Ron Broersma dren-stavanger-22 nov2011

Oracle Sandbox

Recently uploaded

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Miguel Araújo

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

Building Digital Trust in a Digital Economy Veronica Tan, Director - Cyber Security Agency of Singapore Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

apidays

GenCyber Cyber Security Day Presentation

Michael W. Hawkins

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

Imagine a world where information flows as swiftly as thought itself, making decision-making as fluid as the data driving it. Every moment is critical, and the right tools can significantly boost your organization’s performance. The power of real-time data automation through FME can turn this vision into reality. Aimed at professionals eager to leverage real-time data for enhanced decision-making and efficiency, this webinar will cover the essentials of real-time data and its significance. We’ll explore: FME’s role in real-time event processing, from data intake and analysis to transformation and reporting An overview of leveraging streams vs. automations FME’s impact across various industries highlighted by real-life case studies Live demonstrations on setting up FME workflows for real-time data Practical advice on getting started, best practices, and tips for effective implementation Join us to enhance your skills in real-time data automation with FME, and take your operational capabilities to the next level.

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Safe Software

Finology Group – Insurtech Innovation Award 2024

The Digital Insurer

Histor y of HAM Radio presentation slide

vu2urc

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Join our latest Connector Corner webinar to discover how UiPath Integration Service revolutionizes API-centric automation in a 'Quote to Cash' process—and how that automation empowers businesses to accelerate revenue generation. A comprehensive demo will explore connecting systems, GenAI, and people, through powerful pre-built connectors designed to speed process cycle times. Speakers: James Dickson, Senior Software Engineer Charlie Greenberg, Host, Product Marketing Manager

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

DianaGray10

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

Three things you will take away from the session: • How to run an effective tenant-to-tenant migration • Best practices for before, during, and after migration • Tips for using migration as a springboard to prepare for Copilot in Microsoft 365 Main ideas: Migration Overview: The presentation covers the current reality of cross-tenant migrations, the triggers, phases, best practices, and benefits of a successful tenant migration Considerations: When considering a migration, it is important to consider the migration scope, performance, customization, flexibility, user-friendly interface, automation, monitoring, support, training, scalability, data integrity, data security, cost, and licensing structure Next Wave: The next wave of change includes the launch of Copilot, which requires businesses to be prepared for upcoming changes related to Copilot and the cloud, and to consolidate data and tighten governance ShareGate: ShareGate can help with pre-migration analysis, configurable migration tool, and automated, end-user driven collaborative governance

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

sammart93

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

Advantages of Hiring UIUX Design Service Providers for Your Business

Pixlogix Infotech

As privacy and data protection regulations evolve rapidly, organizations operating in multiple jurisdictions face mounting challenges to ensure compliance and safeguard customer data. With state-specific privacy laws coming up in multiple states this year, it is essential to understand what their unique data protection regulations will require clearly. How will data privacy evolve in the US in 2024? How to stay compliant? Our panellists will guide you through the intricacies of these states' specific data privacy laws, clarifying complex legal frameworks and compliance requirements. This webinar will review: - The essential aspects of each state's privacy landscape and the latest updates - Common compliance challenges faced by organizations operating in multiple states and best practices to achieve regulatory adherence - Valuable insights into potential changes to existing regulations and prepare your organization for the evolving landscape

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

TrustArc

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Rafal Los

Tata AIG General Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Neo4j

Strategies for Landing an Oracle DBA Job as a Fresher

Remote DBA Services

Recently uploaded (20)

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Powerful Google developer tools for immediate impact! (2023-24 C)

Data Cloud, More than a CDP by Matt Robison

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

GenCyber Cyber Security Day Presentation

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Finology Group – Insurtech Innovation Award 2024

Histor y of HAM Radio presentation slide

AWS Community Day CPH - Three problems of Terraform

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

How to Troubleshoot Apps for the Modern Connected Worker

Advantages of Hiring UIUX Design Service Providers for Your Business

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Tata AIG General Insurance Company - Insurer Innovation Award 2024

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Strategies for Landing an Oracle DBA Job as a Fresher

Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept

1. DUAL STACK SECURITY A simple proof of concept on IPv4/IPv6 stacks Some thoughts about current dual stack setups Eduardo Coelho http://coelho.pro.br

2. SCENARIO • virtual •2 simulated environment linux vms, 1 windows8 vm • vmware built-in IPv4 DHCP server, host-only network • simulated rogue IPv6 ra/dhcp/dns with regular linux software

3. DEMO

4. DUAL STACK MAY NOT BE SMOOTH FROM A SECURITY STAND POINT

5. IPV6 ADDRESSING • global • link unicast local • unique local • others: anycast, multicast, reserved and special

6. AUTOCONF IS A BIG THING • lets try to understand how it works: • stateless • router • IPv6 autoconf advertisement and preﬁx distribution routing

7. DNS SETTINGS DELIVERY • llmnr • stateless • dns-ra dhcp6 (problem:windows non-compliance to rfc6106) • remember naming is now more important than with ipv4, due to human difﬁculty manually handling ipv6 addresses

8. AUTOCONF CONCERNS • rogue routers • rogue dhcp servers • snifﬁng • spooﬁng (man in the middle attacks)

9. CONCLUSIONS • we have provided a simple proof of concept for a rogue ra/ dns server on a dual-stack ipv4/ipv6 environment • ipv6 technologies should be very well understood, specially on dual-stack setups, which is how most of networks are set • some of the security issues are not ipv6 speciﬁc, but have a greater impact due to current lack of precautions • most issues are due to stack implementation or by design, which makes it difﬁcult to mitigate

10. REFERENCES Unique Local Address http://en.wikipedia.org/wiki/ Unique_local_address ! Unique Local Unicast Addresses http://tools.ietf.org/html/rfc4193 ! Deprecating Site Local Addresses http://tools.ietf.org/rfc/rfc3879.txt ! IPv6 Support in Home Routers http://msdn.microsoft.com/en-us/ library/windows/hardware/ gg463251.aspx ! Prefix delegation http://en.wikipedia.org/wiki/ Prefix_delegation ! Requirements for IPv6 Prefix Delegation http://tools.ietf.org/html/rfc3769 Internet powers flip the IPv6 switch (FAQ) http://news.cnet.com/ 8301-1001_3-57445316-92/internetpowers-flip-the-ipv6-switch-faq/ ! IPv6-capable devices: Make sure they are ready http://www.techrepublic.com/blog/ networking/ipv6-capable-devicesmake-sure-they-are-ready/2522 ! IPv6 Ready Logo Program https://www.ipv6ready.org Router Advertisement (radvd) configuration http://wiki.openwrt.org/doc/uci/radvd ! ! ! IPv6: When do you really need to switch? http://www.zdnet.com/blog/networking/ ipv6-when-do-you-really-need-toswitch/2444 ! ! Portal IPv6 NIC.br http://ipv6.br ! IPv6 http://en.wikipedia.org/wiki/IPv6 ! IPv6 transition mechanisms http://en.wikipedia.org/wiki/ IPv6_transition_mechanisms IPv6 Prefix Options for DHCP version 6 http://www.ietf.org/rfc/rfc3633.txt ! IP Version 6 Addressing Architecture http://tools.ietf.org/html/rfc4291 ! Comparison of IPv6 support in operating systems http://en.wikipedia.org/wiki/ Comparison_of_IPv6_support_in_oper ating_systems Internet Protocol Version 6 Address Space http://www.iana.org/assignments/ipv6address-space/ipv6-address-space.xml ! ! Does Win7 or W2K8 server support RFC 6106? http://social.technet.microsoft.com/ Forums/en-US/ipv6/thread/ 5757980a-5983-4efca5f3-27687b90fe41/ ! Delivering DNS via IPv6 Router http://www.itdojo.com/2011/05/02/ delivering-dns-via-ipv6-routeradvertisements/

Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept

Recommended

Recommended

More Related Content

What's hot

What's hot (18)

Viewers also liked

Viewers also liked (20)

Similar to Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept

Similar to Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept (20)

More from Eduardo Coelho

More from Eduardo Coelho (12)

Recently uploaded

Recently uploaded (20)

Dual stack IPv4 / IPv6 Security Issues - A simple proof of concept