Rafa Sánchez & Fran Gomez - IoCker - When IPv6 met malware [rooted2019]
•
1 like•726 views
This document discusses dual stack IPv4 and IPv6 threat analysis. It notes that firewalls and intrusion detection systems may not recognize IPv6 traffic and could be bypassed. It also lists security considerations like vulnerabilities in IPv6, lack of vendor support, and lack of knowledge by security teams. Unauthorized deployment of IPv6 is highlighted as a risk since most current operating systems support IPv6 by default. The document provides information on analyzing IPv6 prefixes and addresses to identify threats and indicates various categories of malware, fraud, and anonymization threats that could be investigated.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Rafa Sánchez & Fran Gomez - IoCker - When IPv6 met malware [rooted2019]
Similar to Rafa Sánchez & Fran Gomez - IoCker - When IPv6 met malware [rooted2019] (20)
More from RootedCON
More from RootedCON (20)
Recently uploaded
Recently uploaded (20)
Rafa Sánchez & Fran Gomez - IoCker - When IPv6 met malware [rooted2019]
- 1. 1st Dual Stack Threat Feed
- 2. When your IDS/FW does not consider IPv6
- 4. Ngioweb represents a multifunctional proxy server which uses its own binary protocol with 2 layers of encryption. The proxy malware supports back-connect mode, relay mode, IPv4, IPv6 protocols, TCP and UDP transports with first samples seen in the second half of 2017. https://research.checkpoint.com/ramnits-network-proxy-servers/
- 7. #WhyNow
- 8. IPv6 and IPv4 Dual Stack Security Considerations ● Unauthorized deployment of IPv6 on existing IPv4 production networks ● Vulnerabilities present in IPv6 ● Complexity added by dual IPv4/IPv6 operations ● Immaturity of IPv6 security products and processes ● Lack of vendor support ● Operation team and security team lack of knowledge https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-119.pdf
- 9. Unauthorized deployment of IPv6 ● Most current operating systems now support IPv6 by default ● Firewall and IDS equipment not configured to recognize IPv6 traffic could be bypassed
- 10. #ThreatHunting
- 11. Threat analysis
- 12. Threat analysis
- 13. Threat analysis
- 14. Threat analysis
- 15. Why IPv6 prefix?
- 16. /64 in threat analysis IPv6 prefix (/64) IPv6 Address ASN
- 17. /64 in threat analysis IPv6 prefix (/64) IPv6 Address ASN IPv6 Address IPv6 Address IPv6 Address … 2^64
- 19. Threat analysis
- 20. /64 in threat analysis IPv6 prefix (/64) IPv6 Address ASNIPv6 Address IPv6 Address IPv6 Address IPv6 Address
- 21. /64 in threat analysis IPv6 prefix (/64) IPv6 Address ASNIPv6 Address IPv6 Address IPv6 Address IPv6 Address
- 22. #ShowMeTheData
- 23. IOCs clustered by ASN and Prefix
- 25. Dual Stack IOCs
- 27. Threat analysis
- 28. Threat analysis
- 29. Threat analysis
- 30. TOR
- 31. TOR ASN 14061
- 32. #Curious
- 35. FILTER “:dead:”
- 39. ASN
- 40. Why ASN?
- 41. Why ASN?
- 42. Why ASN?
- 43. Why ASN?
- 44. Why ASN?
- 45. Why ASN?
- 46. #HowDoWeDoIt?
- 47. How Do We Do It? Dual Stacks Analysis Fingerprinting CVE Scan ... IPv6 Discover IOC Sources
- 48. Categories ● Malware ○ botnet ■ C&C ■ Compromised ■ ExploitKit ■ Zeus ○ Sanbox ■ Malware ○ Distribution ■ Warez ■ ExploitKit ○ Trojan ■ Misc ○ Binary ○ HTA ○ Ransomware ○ DDoS ○ Shellcode ○ Exploit ○ Javascript ○ Downloader ○ Redirector ● Fraud ○ Phishing ■ Bulkphishing ○ Coinminer ■ Web ○ Market ■ Warez ■ Misleadingmarket ○ Spam ■ Astroturfing ■ Forumspammers ○ Hacking ■ Hijacking ○ Black market ■ Pharmacy ● Anonymization ○ TOR ■ Proxy
- 49. #Future
- 50. MrLooquer IPLake
- 51. Prefix scoring /64, /48 etc… ASN Scoring
- 52. The Alliance