IPv6 Security Vendor Point of View. Eric Vyncke, Distinguished Engineer Cisco, CTO/Consulting Engineering

Transcription

1 IPv6 Security Vendor Point of View Eric Vyncke, Distinguished Engineer Cisco, CTO/Consulting Engineering 1

2 ARP Spoofing is now NDP Spoofing: Threats ARP is replaced by Neighbor Discovery Protocol Nothing authenticated Static entries overwritten by dynamic ones Stateless Address Autoconfiguration rogue RA (malicious or not) All nodes badly configured DoS Traffic interception (Man In the Middle Attack) Attack tools exist (from THC The Hacker Choice) Parasit6 Fakerouter6... 2

3 ARP Spoofing is now NDP Spoofing: Mitigation 3

4 Securing Link Operations: First Hop Trusted Device Cisco Future Advantages central administration, central operation Complexity limited to first hop Transitioning lot easier Efficient for threats coming from the link Efficient for threats coming from outside Certificate server Disadvantages Applicable only to certain topologies Requires first-hop to learn about end-nodes First-hop is a bottleneck and single-point of failure Time server 4

5 IPv6 Header Manipulation Unlimited size of header chain (spec-wise) can make filtering difficult Potential DoS with poor IPv6 stack implementations More boundary conditions to exploit Can I overrun buffers with a lot of extension headers? Perfectly Valid IPv6 Packet According to the Sniffer Header Should Only Appear Once Destination Header Which Should Occur at Most Twice Destination Options Header Should Be the Last See also: 5

6 Parsing the Extension Header Chain IPv6 hdr HopByHop Routing AH TCP data IPv6 hdr HopByHop Routing AH Unknown L4??? IPv6 hdr HopByHop Unk. ExtHdr AH TCP data 6

7 The IPsec Myth: IPsec End-to-End will Save the World Recommendation: do not use IPsec end to end within an administrative domain. Suggestion: Reserve IPsec for residential or hostile environment or high profile targets. 7

8 PCI DSS Compliance and IPv6 Payment Card Industry Data Security Standard requires the use of NAT for security Yes, weird isn t it? There is no NAT IPv6 <-> IPv6 in most of the firewalls IETF has just started to work on NAT66 PCI DSS compliance cannot be achieved for IPv6? How important is NAT for security? Not clear feedback from customers. 8

9 The security value of NAT-PT Does it really bring something? Block connection from the outside Same as a stateful firewall Topology hiding? Dubious utility Techniques exist to by-pass Counting host by ID field (Steve Bellovin 2002) Counting host by TCP timestamps (Ellie Lupin 2010) Analysis of the TTL field Analysis of RFC 822 headers Multiple users hidden behind a single address Forensic is more complex 9

10 What Default Security Policy for CPE? Do we need to do same IPv4 NAT? Allow only all inside initiated connections? IPv6 hosts are usually more secure than legacy OS IPv6 has the benefit of end-to-end connectivity Even IETF is unclear 10

11 Dual-Stack IPS Engines Service HTTP 11

12 Anti-Spam Challenges Little SMTPv6 s Not a lot of data to test heuristics How to build an address reputation database? Based on /128? /64? /56? Need more customers, more SMTPv6 12

13 Summary of Cisco IPv6 Security Products ASA Firewall Since version 7.0 (released 2005) Flexibility: Dual stack, IPv6 only, IPv4 only SSL VPN for IPv6 (ASA 8.0) Stateful-Failover (ASA 8.2.2) IOS Firewall IPS IOS 12.3(7)T (released 2005) Since 6.2 (released 2008) Security Appliance (ESA) under beta testing early 2010 Web Security Appliance (WSA) end

14 Key Take Away 14

15 15

16 Reference Slides For Reference Only 16

17 Secure Neighbor Discovery (SEND) RFC 3971 Certification paths Anchored on trusted parties, expected to certify the authority of the routers on some prefixes Cryptographically Generated Addresses (CGA) IPv6 addresses whose interface identifiers are cryptographically generated RSA signature option Protect all messages relating to neighbor and router discovery Timestamp and nonce options Prevent replay attacks Requires IOS 12.4(24)T 17

18 Cryptographically Generated Addresses CGA RFC 3972 (Simplified) Each devices has a RSA key pair (no need for cert) Ultra light check for validity Prevent spoofing a valid CGA address RSA Keys Priv Pub Signature Modifier Public Key Subnet Prefix CGA Params SHA-1 SEND Messages Subnet Prefix Interface Identifier Crypto. Generated Address 18

19 Securing Neighbor and Router Advertisements with SEND Adding a X.509 certificate to RA Subject Name contains the list of authorized IPv6 prefixes Neighbor Advertisement Source Addr = CGA CGA param block (incl pub key) Signed Trust Anchor X.509 cert X.509 cert Router Advertisement Source Addr = CGA CGA param block (incl pub key) Signed 19