Recent advances in IPv6 insecurities reloaded Marc van Hauser Heuse GOVCERT NL Marc Heuse

Transcription

1 Recent advances in IPv6 insecurities reloaded Marc van Hauser Heuse GOVCERT NL Marc Heuse

2 Hello, my name is

3 Basics Philosophy Vulnerabilities Vendor Responses & Failures Recommendations

4

5 Basics 2011 Marc Heuse

6

7 The future is here already

8 IPv6 16 octets addresses 2a01:2b3:4:a::1

9 Separated by colons Leading zeros are omitted 2a01:2b3:4:a::1 2 octets each, hexadecimal The longest chain of :0:0: is replaced with ::

10 Subnets are / x the size of the Internet!

11 Features! Autoconfiguration IPSEC Mobility Enough addresses!

12 Most in IPv6 is OPTIONAL

13 Mandatory Multiple IPv6 addresses per interface ARP => ICMPv6 Router Advertisements No router & routes via DHCPv6! Multicast (local)

14 IPv6 is much simpler than IPv4

15 in theory.

16 Philosophy 2011 Marc Heuse

17 Eliminate IPv4

18 True end-to-end communication No NAT No defragmentation by firewalls No fragmentation by routers Many ICMPv6 msgs must pass the firewall

19 IPv6 is secure IPv6 has mandatory IPSEC

20 Security Model is from 1995 Local = Trusted Security = Encryption Security = Filter Rules Networking + Features > Security

21 Blatant mistakes No DNS server in autoconfiguration No private addresses IPSEC does not work with multicast Many protocol security design problems

22 Vulnerabilities 2011 Marc Heuse

23 Local Remote Vulnerabilities Design Implementation

24 Excerpt!

25 Local Design I m p l e m Vulnerabilities e n t a t i o R e m o t e

26 Neighbor Discovery Spoofing A B 1. NS 2. NA 1. NS: ICMP Type = 135 Src = A Dst = All-Nodes Mulitcast Query= Who-has IP B? parasite6: Answers to every NS, claims to be every system on the LAN 2. NA: ICMP Type = 136 Src = B Dst = A Data= MAC ARP spoofing in IPv4 more dangerous due OVERRIDE flag Source: common knowledge Tool: parasite6

27 Duplicate Address Detection DOS A 1. NS 1. NS: ICMP Type = 135 Src = A Dst = All-Nodes Mulitcast Query= Who-has IP B? dos-new-ipv6: Answer to every NS, claim to be every system on the LAN optional in IPv4, mandatory in IPv6 for all addresses Source: common knowledge Tool: dos-new-ipv6

28 Router Advertisement Spoofing A 1. RA fake_router6: Sets any IP as default router, defines network prefixes and DNS servers ICMP Type = 134 Src = Router Link-local Address Dst = FF02::1 Data= options, prefix, lifetime, autoconfig flag many, many attacks Source: common knowledge Tool: fake_router6

29 Router Advertisement Spoofing Become the default router MITM Assign multiple address spaces Paypal, Ebay, Amazon, Google == local MITM Remove real routing entry (spoofing lifetime 0) DOS

30 Router Advertisement Spoofing Turns IPv4 networks into Dual Stack environments MITM to remote dual stack targets Attack on IPv6 address potentially bypasses personal firewall

31 ICMP Redirect Spoofing Pong (V)ictim (A)ttacker (R)outer (T)arget redir6 Redirect Bypasses secure redirect check, default on all OS. IPv4: remote, IPv6: local only Ping Source: Sebastian Krahmer, Marc Heuse Tool: redir6

32 Multicast Listener Discovery DOS A Sends periodically MLD general query messages MLD Report: I am a multicast DNS server to all routers Spoof MLD general query message as fe80:: DNS multicast traffic Spoofs A MLD Done message flows to the network Send general query as fe80:: with special MAC Denies site/org multicast traffic to LAN Source: Marc Heuse Tool: fake_mld6

33 Local Remote Vulnerabilities Desig n Implementation

34 IPv6 Vulnerabilities (CVE)

35 Router Advertisement Flooding A B C Flood LAN with random RAs. DOS: Windows 7, 2008, 2003, XP Cisco IOS+ASA (fixed) Juniper Netscreen FreeBSD (should be fixed) Source: Marc Heuse Tool: flood_router6

36 Sniffer Detection

37 Sniffer Detection ping6 dst-mac: 33:33:ff:00:ff:00 A ping6 reply ping6 dst-mac: 33:33:ff:00:ff:00 C Discover: Windows 7, 2008, 2003, XP Linux FreeBSD Source: Marc Heuse Tool: thcping6

38 Weird stuff Speed-up packet transmission by x100 <sorry, to be published in May 2012 >

39 Implementation Design L Remote o c Vulnerabilities a l

40 Privacy Issues in Autoconfiguration Autoconfiguration: host address based on MAC address A 1. RA MAC address: 00:0c:29:69:a6:66 IPv6 host address: ::020c:29ff:fe69:a666 Identify a host wherever it travels ICMP Type = 134 Src = Router Link-local Address Dst = FF02::1 Data= options, prefix, lifetime, autoconfig flag Source: common knowledge Tool: not needed

41 Source Routing Internet Spoofing, DOS Now deprecated by RFC Source: Philippe Bondi Tool: alive6

42 Routing Loop Tunnel DOS Internet Multiple encapsulation headers specifying tunnel endpoints => DOS Source: Gabi Nakibly Tool: unknown

43 Reduce MTU (A)ttacker toobig6 (V)ictim (R)outer (T)arget Reduces MTU to 1280, limited impact Same as redirect attack, but remote Source: Marc Heuse Tool: toobig6

44

45 Vendor Responses & Failures 2011 Marc Heuse

46 The complexity problem

47 The vendor solution:

48 Different support of options Different maturity Changes with every update Product supports IPv6 means nothing

49 Firewalls IPv4: Whitelist / Deny anything unknown IPv6: Blacklist / Drop anything known evil

50 Covert Channels Company Internet Collector Host HTTP TCP Every field can be used (IPv6 header foo fields, Fragment ID, ) 1.4kb per packet (>90%) Source: Marc Heuse Destination Options [ENCRYPTED SECRET DATA] IPv6 Tool: covert_send6

51 Trust Local ( do nothing ) RA Guard / ND Security What vendors propose SeND IPSEC

52 SeND Trust Local ( do nothing ) G u a r d I What vendors P propose S E C a.k.a. as The Microsoft Approach R A

53 We consider this issue to be by design [and will not fix it]. The attack would require that an attacker has access to the targeted network - a situation that does not provide a security boundary. Microsoft statement

54 while there are no explicit RFC violations in our implementation, we do agree that there is room for improvement Juniper is currently working through the IETF to come up with a standard method of avoiding [and won t move a finger until then, see you again in two years] Juniper Statement

55 Source:

56 SeND ( do nothing ) IPSEC RA Guard / ND Security What vendors propose Trust Local

57 My opinion of RA guard

58 RA Guard

59 RA Guard / ND Security Bypass RA Prepend fragmentation and destination header RA RA Destination Options (large & empty) Fragmentation IPv6 Source: Marc Heuse Tool: fake_router6

60 Trust Local ( do nothing ) RA Guard / ND Security What vendors propose SeND IPSEC

61 Sorry, but: All devices must support it (printers!) No privacy extensions possible Key distribution => big overhead Only protects RA & ND (SeND)

62 SeND DOS A B 1. NS NS NS 1. NS: ICMP Type = 135 Src = A Dst = All-Nodes Mulitcast Query= Who-has IP B? CGA = signing information Flood NS: ICMP Type = 135 Src = Attacker Dst = All-Nodes Mulitcast Data= MAC CGA = fake signing information CGA verification => CPU expensive Flood => DOS Source: Will Damn Tool: seenpees6

63 More SeND & IPSEC attacks <I am not publishing this yet, sorry> Source: Marc Heuse Tool: ******6

64 The Problem: IPv4 thinking applied to IPv6

65 IPv6 requires a new thinking for Designing Implementing Configuring Hacking

66 Recommendations 2011 Marc Heuse

67 Sorry, no time

68 Contact 2011 Marc Heuse

69 Contact Marc Heuse

70 End 2011 Marc Heuse