Hot answers tagged

22

There is some widespread confusion about NAT. NAT has never been meant to be used as a security feature. However, it so happens that in most cases (not all), when a machine has access to the Internet through NAT only, then the machine is somehow "protected". It is as if the NAT system was also, inherently, a firewall. Let's see how it works: An IP packet ...


17

IPv6 only: Unlimited size of header chain can make filtering difficult. IPsec is not a panacea: IPv6 mandates the implementation of IPsec IPv6 does not require the use of IPsec Some organizations believe that IPsec should be used to secure all flows: Interesting scalability issue Need to trust endpoints and end-users because the network cannot secure the ...


9

1) There doesn't appear to be a usual policy. Many ISP's do now drop packets with spoofed addresses, but there are still loads that do not. 2) When NAT'ing, a correctly configured router will have a small list of rules which define the IP address which will be attached, so the usual attack is to send from a location where this doesn't happen. 3) One of the ...


9

Many sites use private addressing inside their network, and the router runs NAT so that outgoing connections are feasible. The NAT thing implies, by construction, the same effect than a firewall which would prevent any incoming connection from the outer world to one of the machines in the inner network. When you enable IPv6, inner machines become externally ...


7

People who scan the internet will have to find a different source of addresses than just sequential enumeration. Search engines provide a great database of in-use hostnames and addresses, as does DNS. Scanning the neighborhood might be feasible, but that depends on the neighborhood. In a subnet where DHCPv6 is being used, you can still scan other addresses,...


7

There was an interesting presentation from Metasploit on this recently (blog post is here) From that there are a number of techniques that nmap can use to identify IPv6 hosts on the local network which could be of use to you Scanning your local subnet for all IPv6-enabled systems in one shot: nmap -6 --script=targets-ipv6-multicast-* Port scanning the ...


7

I would assume that the range you are trying to scan is fe80:0000:0000:0000:0000:0000:0000:0000/112 which is the last 16 bits (the last section) of the address. That range includes 65,536 IPv6 addresses, probably all of which are going to time out when scanned. It will probably take most of a day (86,400 seconds - close enough to 65,536 at one second per ...


6

All this is quite simple to work around, just turn Teredo off. From 'Accessories', run 'Command Prompt' with a right-click 'run as Administrator', then when you get the command prompt, type in: netsh interface teredo set state disable then exit and close the CMD prompt window. You will need a reboot to effect the change completely. If you find you now ...


6

You shouldn't be worried about it. It looks as if Teredo is a IPv6 tunneling technology. According to this Wikipedia article it allows for IPv6 connectivity by tunneling IPv6 packets through your router encapsulated in IPv4/UDP datagrams (so you can still talk IPv6 even though your router doesn't).


5

Teredo can be used for malicious purposed. unfortunately without seeing a traffic capture of what is actually being send across the port it is difficult to determine what its purpose is. I recommended using wireshark to capture traffic destined for that port on the local machine. It is also possible that it simply is Teredo. I will be happy to assist you ...


5

DNSSEC provides something rather different than IPSec, and either or both may meet your needs. IPSec can encrypt packets and sign them, providing evidence that they come from something you trust, IF you have a PKI (Public Key Infrastructure) you can trust. But that "IF" is a very tall order, especially given the presence these days in most common "trusted" ...


5

Most of these security issues arise when a host accepts IPv4-mapped IPv6 traffic over the network, rather than accepting IPv4 traffic and presenting it to an application on an IPv6 socket with a mapped address. An application may have no good way to tell the difference and detect a potential attack in progress. Of course no host should ever be accepting ...


5

Sort of. The IPv6 range is big. Really big. You just won't believe how vastly, hugely, mind-bogglingly big it is. I mean, you may think it's a long way down the road to the chemist, but that's just peanuts to space the IPv6 range. (with apologies to Douglas Adams) There are 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses in the IPv6 space. ...


4

I ran across a recent paper on the subject: CPNI VIEWPOINT - SECURITY IMPLICATIONS OF IPv6 - MARCH 2011. The main points it makes are risks shared by many new technologies: less mature than IPv4, so probably more bugs less support in security products more complex => bigger attack surface, especially for dual-stack environments less familiarity by support ...


4

NAT is a solution to the IPv4 address-shortage problem: you hide many systems behind one IP address. With IPv6, an end-user will have many addresses, so the need for NAT disappears. This is great from a networking standpoint, since NAT is an ugly hack (from the network perspective) that makes many applications harder. From a security standpoint however, NAT ...


4

Microsoft Dynamic DNS allows hosts to request a specific host name they would like to use. (That's what the dynamic means!) As you'd expect, you can't use this feature to steal an existing host's name, but there's a related attack where you steal the name of a host that doesn't exist, but that clients look for as part of an autodiscovery protocol. For ...


4

If you are not using NAT, then they will be assigning an IPV6 address to each device and will be able to identify them. You could still use NAT however and they would be unable to detect how many devices are behind the gateway device since only the one gateway device would make all requests. A NAT conceals the information about your internal network ...


4

Using the telnet interface over an insecure link (the Internet) is insecure, but simply having it there won't do much harm. The insecurity of telnet comes from its lack of encryption, but it's not an issue if you don't send anything sensitive through it in the first place. However, what is more concerning is the DNS port that is open - it could be abused to ...


3

Is there a new set of Bogon IPs that can be filtered? Yes, and it's expansive. https://github.com/haypo/python-ipy/blob/master/IPy.py#L34 is a decent start to look at how allocations are setup. See the IPv6ranges table. Is there any proof-of-work or whitelisting possible for valid connections? That one I don't know anything helpful for. Are there ...


3

Most security tools have had IPv6 compatibility built in for years. For example, see nmap’s multitude of IPv6 options. With nmap6 being launched yesterday, it’s even more clear that nmap is much more than a vulnerability scanner. Nessus has supported IPv6 since version 3.2, which was out in 2007. Similarly, Metasploit has had it since 2007 (version 3.1), ...


3

1- The speaker does a pretty good job of explaining what is happening. To sum up, a Linux machine on the same local network as a windows machine sends out thousands of "router advertisements" (RA). These advertisements are usually sent out by routing devices to tell other devices on the network what network prefix to use, and where to route external IPv6 ...


3

I ran across also this mysterious Toredo port which one day just popped up on my "vintage" XP box. After a bit of searching now I understand that Win7/8 creates these ports but how on earth did it open on my XP? Wellllll, one day I shared a drive on my Win7 laptop to my XP box which evidently opened up the Toredo port. Mystery solved :) Bill ***Update: ...


3

The first problem, that comes to my mind, is that you may have an IPv6 connection that you are not even aware of. Microsoft Windows has build in support for Teredo. Teredo tunnels IPv6 through IPv4 UDP packets. This provides full duplex IPv6 connectivity. Furthermore Teredo is designed to work through IPv4 NAT: The client regularly sends queries to the ...


3

http://www.thc.org/thc-ipv6/ a whole suite if ipv6 utilities, but sendpees6 has great examples of how to do CGA against SEND.


3

NAT Traversal A method for two clients, each isolated behind separate firewalls working in NAT, can establish communication with each other, even if the connection is explicitly allowed. UDP packets does not contain any state. When an initial UDP packet leaves the firewall with NAT, it will allow UDP traffic to be returned through the same "session". When ...


3

If you are interested in IPv6 security then you should look at the ipv6hackers mailing list: http://lists.si6networks.com/listinfo/ipv6hackers Tools you should look at include thc-ipv6 at http://www.thc.org/thc-ipv6/ and the IPv6 Toolkit at http://www.si6networks.com/research/tools.html Bogon lists are maintained by Team Cymru, just like for IPv4: http://...


3

NATs are not really magically more secure than public addresses (and have a lot of nasty warts of their own, due to the nature of address translation). To route to your private ipv4 address, an attacker simply needs to point at your router, and then it's entirely up to the firewall to filter out that traffic. The switch to ipv6 won't change anything in that ...


3

First of all, it is important to keep enough bits from the start of the address that it will still be clear which class of address it is. How many bits are needed in order to know that does however depend on which class of address it is. Here are a few examples: 2001:0:xxxx:xxxx:: a Teredo address - 32 bits (two groups of digits) is enough to know it is a ...


3

You can't, as there are too many addresses to scan for. Typically a residential ISP will assign a /64 subnet per customer, which means there are 18446744073709551616 possible addresses behind that router. That is a lot of IPs to scan. Also, the fact that IPv6 addresses are publicly routable doesn't mean the router can't get in the way and firewall off your ...



Only top voted, non community-wiki answers of a minimum length are eligible