IPv6 Cyber Security Briefing May 27, Ron Hulen VP and CTO Cyber Security Solutions Command Information, Inc.

Transcription

1 IPv6 Cyber Security Briefing May 27, 2010 Ron Hulen VP and CTO Cyber Security Solutions Command Information, Inc. 2610:f8:ffff:2010:05:27:85:1

2 Attack Surfaces Protocol Translator IPv4 Native Dual-Stack IPv6 Native IPv4 + Tunnels Dual-Stack + Tunnels IPv6 + Tunnels Tunnels Encapsulation and/or Encryption 2610:f8:ffff:2010:05:27:85:2

3 Known IPv6 Vulnerabilities 2610:f8:ffff:2010:05:27:85:3

4 The IPv6 Header is completely different The Next Header field indicates what type of header follows the IPv6 base header All extension header information is within the payload, and not the IPv6 base header Fewer fields (8 vs. 13 for IPv4) No checksums Streamlined, efficient Options aligned on 64 bit boundaries 2610:f8:ffff:2010:05:27:85:4

5 IPv6 Extension Headers can be Indefinite IPv6 Header, NH=TCP TCP Header + DATA IPv6 Header, NH=HbHIPv6 Header, NH=HbH IPv6 Header, NH=HbH IPv6 Header, IPv6 Header, HbH Header NH=HbH NH=TCP HbH Header NH=HbH IPv6 Header, NH=HbH NH=RH HbH Header HHbH Header HbH HeaderHbH Header NH=RH NH=RH NH=RH TCP Header NH=RH + DATARouting Header Routing Header Routing Header Routing Header NH=TCP Routing Header NH=FH NH=FH NH=FH NH=FH Fragment Header Fragment Header Fragment Header TCP Header NH=HDR A NH=HDR A NH=HDR A + DATA Fragment Header Ext Hdr A Ext Hdr A NH=TCP Ext Hdr A NH=HDR B NH=HDR B NH=TCP How many combinations are there? TCP Header + DATA TCP Header + DATA Ext Hdr B NH=TCP TCP Header + DATA Ext Hdr B NH=HDR C Ext Hdr C NH=TCP TCP Header + DATA 2610:f8:ffff:2010:05:27:85:5

6 RH0 Extension Header Attack ICMPv6 Probe to CI s router w/ source routing.. Unknown UDP data sent (source port 80, destination port 36666) Because CI Router was not online 2610:f8:ffff:2010:05:27:85:6

7 ICMPv6 Probe to CI s router w/ source routing.. Malicious traffic from authorized network (using CI as friendly network to attack from) If CI router had been online 2610:f8:ffff:2010:05:27:85:7

8 IPv4 Security Must Account For IPv6! Tunnels Dual Stack 2610:f8:ffff:2010:05:27:85:8

9 IPv6 Tunnels are a Transition Mechanism Protocol 41 and 47 Tunnels 6in4 6to4 6RD IPv6 in GRE IPSec Tunnels AH ESP Null UDP Based Tunnels Teredo (Port 3544) AYIYA (Port 5072) Heartbeat (Port 3740) TIC (Port 3874) TSP (Port 3653) 2610:f8:ffff:2010:05:27:85:9

10 Tunneled Packet Processing is Complex IPv6 -in-v4 -in-ipv4/ipv4/gre V TC Flow Label Payload Length NH HLim Src Address Dest Address Payload V TTL H L Identifier ToS Prot Payload Length Flg Src Address Dest Address (Options + Padding) Src Address Dest Address Total Length V TC Flow Label NH Payload Offset Hdr Checksum HLim C V V TTL TTL H L Identifier H L Identifier Res0 ToS Prot V TC Flow Label Payload Length Flg Src Address Dest Address (Options + Padding) ToS Prot Dest Address NH Src Address Total Length Offset Hdr Checksum Flg Src Address (Options + Padding) V Opt Checksum Total Length Offset Hdr Checksum Protocol Type Res1 HLim How many encapsulations are there? Dest Address Payload 2610:f8:ffff:2010:05:27:85:10

11 Tunnels Need to be Protected ACL s can protect against Protocol 41, 47, IPSec and port specific UDP traffic What if you don t know the Port? Miredo: Teredo configured to run on any port GoGoNet6: TSP can listen on any UDP port (ie 53, 80, 443, etc) 2610:f8:ffff:2010:05:27:85:11

12 utorrent Teredo and IPv6-Capable Uses ephemeral port for connections User may randomly choose port Port may be randomly chosen on restart IPv6 support on by default 2610:f8:ffff:2010:05:27:85:12

13 utorrent Teredo Peers utorrent runs well over Teredo BitTorrent community is discovering IPv6 2610:f8:ffff:2010:05:27:85:13

14 IPv4 AAAA DNS Queries Broadcast IPv6 Microsoft Dual Stack enabled on ALL Vista / Windows 7 systems AAAA Queries present on every network we monitored. Considered harmless by Security and Network Personal Must be disabled by DoD MO2 guidelines 2610:f8:ffff:2010:05:27:85:14

15 IPv4 AAAA DNS loaded gun Remote Hacker sees an organization sending 100,000+ AAAA queries a day Hacker Floods an organization s mail servers with SPAM It only takes one user with elevated privileges to open one SPAM message to execute the encapsulated malware Consider MS Malware establishes an IPv6 in UDP tunnel through an organization s firewall to Remote Hacker on UDP port 53 Such as Miredo or GoGoNet6 Remote Hacker exfiltrates sensitive data from an organization s enterprise network 2610:f8:ffff:2010:05:27:85:15

16 ICMPv6 is Required for IPv6 Type Description 1 Destination Unreachable 2 Packet to Big 3 Time exceeded 4 Parameter problem 128 Echo Request 129 Echo Reply Router Redirection PING MLD Traceroute ARP Replacement Prefix Advertisement 130 Multicast Listener Query sent to ff02::1 (all nodes) 131 Multicast Listener Report 132 Multicast Listener Done sent to ff02::2 (all routers) 133 Router Solicitation (RS) sent to ff01::2 (all routers) 134 Router Advertisement (RA) sent to ff01::1 (all nodes) 135 Neighbor Solicitation (NS) sent to ff02:0:0:0:0:1:ff00::/ Neighbor Advertisement (NA) 137 Redirect message 2610:f8:ffff:2010:05:27:85:16

17 Malevolent RAs: the threat inside IPv6-enabled workstations (untouched Vista, 7, Linux, Mac, etc) always listen for Router Advertisements User A downloads that pesky malware Sets up tunnel like the non-standard UDP port example (or port 53) Installs basic router advertisement daemon & IPv6 forwarding It sends RAs out to IPv6-enabled machines with User A as it s default gateway Now there are active IPv6 malware on an enterprise that can t be detected 2610:f8:ffff:2010:05:27:85:17

18 Summary IPv6 Threats are Real both native and tunneled Hackers are using IPv6 to tunnel into networks undetected by current security tools Companies must develop a security policy to address IPv :f8:ffff:2010:05:27:85:18

19 IPv6 Cyber Security War Plan Knowledge Analysis Planning Securing Monitoring Lifecycle Management 2610:f8:ffff:2010:05:27:85:19

20 Thank You Ron Hulen Command Information :f8:ffff:2010:05:27:85:20