The document discusses IPv6 security basics and attacks. It explains that IPv6 is now commonly deployed and enabled by default on many systems. It notes that traditional ARP spoofing defenses for IPv4 are ineffective in IPv6. The document then covers several IPv6 attacks like neighbor advertisement spoofing for man-in-the-middle attacks, router solicitation flooding for denial of service, and SSL stripping or sniffing of HTTPS connections. It emphasizes that IPv6 brings new risks and that old IPv4 security controls are not enough, advising readers to properly configure or disable IPv6 if possible to protect their networks and systems.

1. Hachetetepé dos puntos
SLAAC SLACC
Chema Alonso
chema@informatica64.com

2. IPv6 Basics & Attacks
• Watch NCN’12 video
– http://www.elladodelmal.com/2012/11/fc
001-algunos-ataques-en-ipv6.html

3. IPv6 is on your box!

4. And it works!: ipconfig

5. And it works!: route print

6. And it works!: ping

7. And it works!: ping

8. LLMNR

9. And it works!: Neightbors

10. ICMPv6
• No ARP
– No ARP Spoofing
– Tools anti-ARP Spoofing are useless
• Neighbor Discover uses ICPMv6
– NS: Neighbor Solicitation
– NA: Neighbor Advertisement

11. NS/NA

12. NA Spoofing

13. NA Spoofing

14. Demo 1: Mitm using NA Spoofing

15. ICMPv6: SLAAC
• Stateless Address Auto Configuration
• Devices ask for routers
• Routers public their IPv6 Address
• Devices auto-configure IPv6 and Gateway
– RS: Router Solicitation
– RA: Router Advertisement

16. DNS Autodiscovery

17. And it works!: Web Browser

18. Windows Behavior
• IPv4 & IPv6
– DNSv4 queries A & AAAA
• IPv6 Only
– DNSv6 queries A
• IPv6 & IPv4 Local Link
– DNSv6 queries AAAA

19. DNS64 & NAT64

20. HTTP-s Connections
• SSL Strip
– Remove “S” from HTTP-s links
• SSL Sniff
– Use a Fake CA to create dynamicly Fake CA
• Evil FOCA does SSL Strip (so far)

21. Demo 2: hachetetepé dos puntos
SLAAC SLACC

22. SLAAC D.O.S.

23. Conclusions
• IPv6 is on your box
– Configure it or kill it (if possible)
• IPv6 is on your network
– IPv4 security controls are not enough
– Topera

24. Conclusions
FEAR (the EVIL) FOCA!

25. Thanks to
• THC (The Hacking Choice)
– Included in Back Track
– Parasite6
– Redir6
– Flood_router6
– …..
• Scappy

26. …and some last words