IPv6 Security Considerations: Future Challenges

Transcription

1 IPv6 Security Considerations: Future Challenges Prof. Sukumar Nandi Company LOGO Dept of Computer Sc. & Engg. Indian Institute of Technology Guwahati

2 Agenda Outline Motivation for IPv6 Brief comparision between IPv6 and IPv4 IPv6 Addressing Architecture IPv6 Header Fields IPv6 Extension Headers IPv6 Options Internet Control Message Protocol version 6 (ICMPv6) Neighbor Discovery for IPv6 Address Resolution Stateless Address Auto-configuration (SLAAC)

3 If you use IPv4? I m Running IPv4 Does This Affect Me? Your network may be IPv4 but your devices may be another story!

4 What about all These?

5 IPv4 vs IPv6 IPv4 IPv6 Addressing 32 bits 128 bits Address resolution Autoconfiguration ARP DHCP & ICMP RS/RA Fault Isolation ICMPv4 ICMPv6 ICMPv6 NS/NA (+ MLD) ICMPv6 RS/RA & DHCPv6 (optional) (+MLD) IPsec support Optional Mandatory (to "optional") Fragmentation Both in hosts and routers Only in hosts

6 Protocol Format

7 Brief comparision of IPv4 and Header formats: IPv6 (II)

8 IPv6 header Fixed-length (40-bytes) header

9 The Big IPv6 Security Question Built-In IPSec Offers Better Security Right? IPSec is a mandatory part of the IPv6 Protocol

10 First and foremost issue! Unfamiliarity Causes Misconfigurations Many network administrators and IT practitioners are still relatively unfamiliar with all IPV6 s ins and outs Common issues: Not realizing IPv6 is already in their network Ignorance of Tunneling Mechanisms Lack of ACL policy for IPv6 multi-homing Unawareness of potential privacy issues Over permissiveness, just to get it to work

11 What is IPSec? Internet Protocol Security (IPSec) is a standard for adding strong authentication, message integrity, antireply, and encryption (confidentiality) to IP packets, thus providing secure and private communications. Among other things, IPSec consists of: Authentication Headers (AH) Provides data origin authentication and integrity (protects against replay attacks) Encapsulating Security Payloads (ESP) Adds encryption to the mix to provide confidentiality

12 What are IPv6 Extension Remember IPv6 Headers? Dropped options need to go somewhere header simplification? IPv6 Header IPv6 Header IPv6 Header Payload Version Traffic IHL Class Extension Header Payload Identification Length Time to Live Extension Header IPv4 IPv6 Header (20 (40 bytes) Type of Service Next Heade r Protocol Source Address Source Address Flow Total Label Length Flag s Destination Address Destination Address Options Payload Fragmen Hop Limit t Offset Header Checksum Extension Header Padding Ext. headers may include: Hop-by-hop options Destination Options Routing Fragmentation AH Header ESP Header Etc Dropped Payload

13 Built-In IPSec Offers Better Security Right? IPSec is a mandatory part of the IPv6 Protocol What does this really mean? Part of IPv6 protocol stack, not an optional add-on Implemented with AH and ESP Extension Headers Follows one standard (less interop issues) Every IPv6 device can do IPSec However, IPSec usage is still OPTIONAL! Manual configuration of Security Associations (SA) and this can be a tedious or impractical task considering the volume. Even if SAs were established, it is not possible to verify the ownership of dynamically generated IP addresses. SAs can be created only through using the Internet Key Exchange (IKE). But IKE requires a functional IP stack in order to function and this result in a bootstrapping problem.

14 Wait! Doesn t IPv4 Offer IPSec too? Some truths about IPv6 s additional IPSec Security: IPv4 has it too (though, not natively ) You don t have to use it, and most don t Still complex May require PKI Infrastructure So is this really a security benefit? Short term probably no measureable advantage over IPv4 IPSec Long term More applications will leverage it now that it s mandatory!

15 A Look Back at IPv4 ARP Poisoning And Hey I , also Everyone. have I And have Who has ? I Do. Here s my MAC No authentication or security

16 Neighborhood Discovery Suffers from Similar Issues I Do. Send traffic to me Neighbor Solicitation Neighbor Advertisement ND Spoofing Who has 2001::3/64? I Do. Here s my Layer 2 address No authentication or security

17 Many Other Neighbor and Router Discovery Issues Other ND related attacks: Duplicate Address Detection (DAD) DoS attack ND spoofing attack for router (allows for MitM) Neighbor Unreachability Detection (NAD) DoS attack Last Hop Router spoofing (malicious router advertisements) And many more ( Solution: SEcure Neighbor Discovery (SEND) RFC 3971 Essentially adds IPSec to ND communications Requires PKI Infrastructure Not available in all OSs yet X also an option

18 New Multicast Protocol Helps with Reconnaissance IPv6 multicast includes a ton of reserved addresses. Here s a few: Multicast Address FF02::1 FF02::2 FF02::9 FF02::A FF02::B FF02::1:2 FF05::2 FF05::1:3 FF05::1:4 IPv6 multicast addresses: FF0X::101 FF0X::106 Reservation All Host Address All Router Address (LL) RIP Routers EIGRP Routers Mobile-Agents All DHCP Agents All Router Address (SL) All DHCP Servers ALL DHCP Relays NTP Name Service Server Attackers can use these multicast addresses to enumerate your network.

19 IPv6 Security Controls Lagging Hacking Arsenal/Tools Attacker already have many IPv6 capable tools: THC-IPv6 Attack Suite THC-IPv6 Attack Suite Alive6 Parasite6 Redir6 Fake_Router6 Detect-New-IPv6 DoS-New-IPv6 Smurf6 rsmurf6 TooBig6 Fake_MIPv6 Nmap Wireshark Multi-Generator (MGEN) IPv6 Security Scanner (vscan6) Halfscan6 Strobe Netcat6 Fake_mld6 Fake_Advertiser6 SendPees6 DNSDict6 Trace6 Flood_Router6 Flood_Advertise6 Fuzz_IP6 etc TCPDump COLD Spak6 Isic6 Hyenae SendIP Packit 4to6ddos 6tunneldos Imps6-tools Unfortunately, Relay6 IPv6 security controls and 6tunnel products seems to be a bit behind. NT6tunnel VoodooNet Scapy6 Metasploit (etc.) Web Browsers (XSS & SQLi)

20 Typical IPv6 Devices Have Multiple Addresses At least a Link-Local Address (FE80::/10) Likely a Unique Global Address (2000::/3) Possibly a Site-Local Address (FC00::/7) You will probably need MULTIPLE Firewall or ACL policies for these extra networks within your organization

21 Extra Security Can Cause Insecurity Internet

22 Firewalls (and Admins) Must Learn New Tricks How to filter ICMPv6? Handling new extension headers Filtering Multicast and Anycast Hosts w/multiple addresses

23 EXTRA: The Same There are some security issues that IPv6 has little effect on: Application-layer attacks Sniffing Rogue Devices Man-in-the-Middle Attacks Flooding/DoS Attacks

24 THANK YOU

25 Major References IPv6 and IPv4 Threat Comparison and Best-Practice Evaluation v6-v4-threats.pdf IPv6 Security Challenges v6securitychallenges.pdf IPv6 Security Challenges by Samuel Sotillo IPv6 Security Best Practices ecurity_best_practices.pdf IPv6 Security Considerations and Recommendations NIST: Guidelines for the Secure Deployment of IPv6 IPv6 Transition/Coexistence Security Considerations (RFC 4942) And many more.