A Sampling of Internetwork Security Issues Involving IPv6

Transcription

1 A Sampling of Internetwork Security Issues Involving IPv6 John Kristoff DPU IPv6 Day John Kristoff Team Cymru 1

2 Agenda diff -u ipv4 ipv6 head What is the netsec community working on? What are the miscreants doing? DPU IPv6 Day John Kristoff Team Cymru 2

3 IPv4 vs. IPv6 Header Formats DPU IPv6 Day John Kristoff Team Cymru 3

4 96 more bits, no magic? OS protocol stack software and APIs Address manipulation and storage Neighbor discovery Auto-configuration ICMPv6 Fragmentation on an end-to-end basis only Network and security tools Transition technologies Note: IPsec MUSTSHOULD be supported DPU IPv6 Day John Kristoff Team Cymru 4

5 Scanning Scans of the entire address space impractical intelligent address scanning imperfect, but practical DNS enumeration Non-random addresses SLAAC address space with known OUIs Multicast discovery Local neighbor discovery messages See IETF I-D draft-gont-opsec-ipv6-host-scanning DPU IPv6 Day John Kristoff Team Cymru 5

6 Spam Surprise, spam travels over IPv6 transport Many DNSBLs have used rbldnsd When it comes to IPv6, rbldnsd just doesn't scale Some software and usage changes required This is true for any IP address reputation system First SMTP over IPv6 to comcast.net was spam DPU IPv6 Day John Kristoff Team Cymru 6

7 Routing Fair amount of focus on extension header issues Neighbor cache maintenance issues e.g. IETF RFC 6547 (using /127's for IRLs) Team Cymru IPv6 full bogons service IETF RFC 6666 A Discard Prefix for IPv6 Additional consideration likely needed here: Aggregation / disaggregation / hijack events Control plane protection for IPv6 transport DPU IPv6 Day John Kristoff Team Cymru 7

8 Packet Flooding / DoS Some evidence of IPv6-specific DoS Single D, not seeing evidence of IPv6-specific DDoS Some unintentional use of IPv6 transport for DDoS Mostly IRC-based miscreants experimenting with it Traffic levels are relatively modest thus far DPU IPv6 Day John Kristoff Team Cymru 8

9 Transition Technologies 6in4/6to4/6rd/ISATAP/Teredo/tunnel brokers, OH MY! Are protections congruent? Can you monitor them? Mitigate problems over them? Whose relay? Do they monitor? Do you trust them? DPU IPv6 Day John Kristoff Team Cymru 9

10 NAT NAT just makes my life harder As pro-nat a statement I could make, IETF RFC 5902 IAB Thoughts on IPv6 Network Address Translation Next slide PLEASE! DPU IPv6 Day John Kristoff Team Cymru 10

11 Local Network Threats Router advertisements (RAs) presents a challenge As does much of the neighbor discovery mechanisms Who do you trust? How do you trust them? Similar to the known threats with ARP and DHCP SEcure Neighbor Discovery (SEND) IETF RFC 3971 Also see IETF RFC 3756 IPv6 Neighbor Discovery Trust Models and Threats 6Guard: a honeypot-based IPv6 attack detector DPU IPv6 Day John Kristoff Team Cymru 11

12 An IPv6 Business Case is Born March 17, 2003 <A> get an ipv6 host./packetpeople wont know what to do <B> A we have ipv6 <C> most packet kiddies cant hit ipv6 yet <D> Im testing a ipv6 scanner i just made <E> i seen someone make a ddos for ipv6/ipv4 Later that same day, ipv6ddos.c released DPU IPv6 Day John Kristoff Team Cymru 12

13 IPv6 4SALE in the Underground November 11, 2003 <A> Got E-Gold Accounts, PayPaL Accounts, Vhosted Shells (ushells.net), Vhosts ( ipv4 - ipv6 ), Full Domin, Root, Root Scan, Root Nuke, Proxy Serv, Fresh CC's, Fresh Cvv2 I Verify 1st DPU IPv6 Day John Kristoff Team Cymru 13

14 Hiding behind the IPv6 More recently: <A>./gem -h T0 -t <B> that should do it <A> i got 5000mbit hitting <C> v6 is back up on X and Y just new ips <C> D got our vps working as a tunnel broker now <C> need a /64? <A> already has native IPv6 on ciscos DPU IPv6 Day John Kristoff Team Cymru 14

15 udp6.pl, udp.pl w/ IPv6 transport <-- working ipv6ddos flood.pl --port=dst-port --size=pkt-size --time=secs --bandwidth=kbps --delay=msec ip-address [-6] Defaults: * random destination UDP ports are used unless --port is specified * random-sized packets are sent unless --size or --bandwidth is specified * flood is continuous unless --time is specified * flood is sent at line speed unless --bandwidth or --delay is specified * IPv4 flood unless -6 is specified DPU IPv6 Day John Kristoff Team Cymru 15

16 Dissent on DDoS Resilience <A> no its nearly impossible to ddos an ipv6 connection <B> average bitch ddos kiddies couldn't ddos ipv6 <C> i only know 2 people that know how to ddos ipv6 <D> and its impossible to ddos ipv6 <E> i can ddos ipv6 tunnel down DPU IPv6 Day John Kristoff Team Cymru 16

17 Who Took Down Their Routers? Very large hosting provider site in Chicago goes dark Carefully aimed DDoS at infrastructure router Routing protocol packets being dropped Remedied with streamlined control plane filters Miscreant controlled via IRC from an IPv6 bounce DPU IPv6 Day John Kristoff Team Cymru 17

18 PING Flood 1 Gb/s ICMPv6 echo requests sent to IRC server Random source-address spoofed by a single source urpf briefly enabled, but that feature melted router Source ISP eventually fixed the host DPU IPv6 Day John Kristoff Team Cymru 18

19 What We (Don't) See Today IPv6 is widely used as a transport, but not a platform IPv6 dark nets are dark Lack of IPv6-specific malware Anecdotal evidence of malware using IPv6 as transport Some evidence of miscreants using IPv6 to hide origin Some evidence of using IPv6 to hide from monitoring Some evidence of using IPv6 to mitigate retribution Useful and necessary IPv6 threat research ongoing Relatively little IPv6 opsec measurement occurring DPU IPv6 Day John Kristoff Team Cymru 19

20 Resources and References DPU IPv6 Day John Kristoff Team Cymru 20