Tag Info

Hot answers tagged

16

IPv6 only: Unlimited size of header chain can make filtering difficult. IPsec is not a panacea: IPv6 mandates the implementation of IPsec IPv6 does not require the use of IPsec Some organizations believe that IPsec should be used to secure all flows: Interesting scalability issue Need to trust endpoints and end-users because the network cannot secure the ...


8

1) There doesn't appear to be a usual policy. Many ISP's do now drop packets with spoofed addresses, but there are still loads that do not. 2) When NAT'ing, a correctly configured router will have a small list of rules which define the IP address which will be attached, so the usual attack is to send from a location where this doesn't happen. 3) One of the ...


7

Many sites use private addressing inside their network, and the router runs NAT so that outgoing connections are feasible. The NAT thing implies, by construction, the same effect than a firewall which would prevent any incoming connection from the outer world to one of the machines in the inner network. When you enable IPv6, inner machines become externally ...


5

I would assume that the range you are trying to scan is fe80:0000:0000:0000:0000:0000:0000:0000/112 which is the last 16 bits (the last section) of the address. That range includes 65,536 IPv6 addresses, probably all of which are going to time out when scanned. It will probably take most of a day (86,400 seconds - close enough to 65,536 at one second per ...


5

If you are not using NAT, then they will be assigning an IPV6 address to each device and will be able to identify them. You could still use NAT however and they would be unable to detect how many devices are behind the gateway device since only the one gateway device would make all requests. A NAT conceals the information about your internal network ...


5

DNSSEC provides something rather different than IPSec, and either or both may meet your needs. IPSec can encrypt packets and sign them, providing evidence that they come from something you trust, IF you have a PKI (Public Key Infrastructure) you can trust. But that "IF" is a very tall order, especially given the presence these days in most common "trusted" ...


5

You shouldn't be worried about it. It looks as if Teredo is a IPv6 tunneling technology. According to this Wikipedia article it allows for IPv6 connectivity by tunneling IPv6 packets through your router encapsulated in IPv4/UDP datagrams (so you can still talk IPv6 even though your router doesn't).


5

People who scan the internet will have to find a different source of addresses than just sequential enumeration. Search engines provide a great database of in-use hostnames and addresses, as does DNS. Scanning the neighborhood might be feasible, but that depends on the neighborhood. In a subnet where DHCPv6 is being used, you can still scan other ...


5

There was an interesting presentation from Metasploit on this recently (blog post is here) From that there are a number of techniques that nmap can use to identify IPv6 hosts on the local network which could be of use to you Scanning your local subnet for all IPv6-enabled systems in one shot: nmap -6 --script=targets-ipv6-multicast-* Port scanning the ...


4

All this is quite simple to work around, just turn Teredo off. From 'Accessories', run 'Command Prompt' with a right-click 'run as Administrator', then when you get the command prompt, type in: netsh interface teredo set state disable then exit and close the CMD prompt window. You will need a reboot to effect the change completely. If you find you now ...


4

Teredo can be used for malicious purposed. unfortunately without seeing a traffic capture of what is actually being send across the port it is difficult to determine what its purpose is. I recommended using wireshark to capture traffic destined for that port on the local machine. It is also possible that it simply is Teredo. I will be happy to assist you ...


4

I ran across a recent paper on the subject: CPNI VIEWPOINT - SECURITY IMPLICATIONS OF IPv6 - MARCH 2011. The main points it makes are risks shared by many new technologies: less mature than IPv4, so probably more bugs less support in security products more complex => bigger attack surface, especially for dual-stack environments less familiarity by support ...


3

You can do NAT with IPv6, of course. The good thing about IPv6 is precisely that you do not need to do NAT: there are enough IPv6 possible addresses that there is no need for sharing an address between distinct machines. Having a publicly visible address for each of your computers allows you to run accessible servers on each of them, which is great for some ...


3

1- The speaker does a pretty good job of explaining what is happening. To sum up, a Linux machine on the same local network as a windows machine sends out thousands of "router advertisements" (RA). These advertisements are usually sent out by routing devices to tell other devices on the network what network prefix to use, and where to route external IPv6 ...


3

Most security tools have had IPv6 compatibility built in for years. For example, see nmap’s multitude of IPv6 options. With nmap6 being launched yesterday, it’s even more clear that nmap is much more than a vulnerability scanner. Nessus has supported IPv6 since version 3.2, which was out in 2007. Similarly, Metasploit has had it since 2007 (version 3.1), ...


3

Microsoft Dynamic DNS allows hosts to request a specific host name they would like to use. (That's what the dynamic means!) As you'd expect, you can't use this feature to steal an existing host's name, but there's a related attack where you steal the name of a host that doesn't exist, but that clients look for as part of an autodiscovery protocol. For ...


3

If you are interested in IPv6 security then you should look at the ipv6hackers mailing list: http://lists.si6networks.com/listinfo/ipv6hackers Tools you should look at include thc-ipv6 at http://www.thc.org/thc-ipv6/ and the IPv6 Toolkit at http://www.si6networks.com/research/tools.html Bogon lists are maintained by Team Cymru, just like for IPv4: ...


3

Is there a new set of Bogon IPs that can be filtered? Yes, and it's expansive. https://github.com/haypo/python-ipy/blob/master/IPy.py#L34 is a decent start to look at how allocations are setup. See the IPv6ranges table. Is there any proof-of-work or whitelisting possible for valid connections? That one I don't know anything helpful for. Are ...


3

NAT is a solution to the IPv4 address-shortage problem: you hide many systems behind one IP address. With IPv6, an end-user will have many addresses, so the need for NAT disappears. This is great from a networking standpoint, since NAT is an ugly hack (from the network perspective) that makes many applications harder. From a security standpoint however, NAT ...


3

The first problem, that comes to my mind, is that you may have an IPv6 connection that you are not even aware of. Microsoft Windows has build in support for Teredo. Teredo tunnels IPv6 through IPv4 UDP packets. This provides full duplex IPv6 connectivity. Furthermore Teredo is designed to work through IPv4 NAT: The client regularly sends queries to the ...


3

NAT Traversal A method for two clients, each isolated behind separate firewalls working in NAT, can establish communication with each other, even if the connection is explicitly allowed. UDP packets does not contain any state. When an initial UDP packet leaves the firewall with NAT, it will allow UDP traffic to be returned through the same "session". When ...


3

I ran across also this mysterious Toredo port which one day just popped up on my "vintage" XP box. After a bit of searching now I understand that Win7/8 creates these ports but how on earth did it open on my XP? Wellllll, one day I shared a drive on my Win7 laptop to my XP box which evidently opened up the Toredo port. Mystery solved :) Bill ***Update: ...


2

Using nmap Write a short script to generate the IPv6 range you want to scan, then pass that to nmap using -iL nmap -Pn -sS -p 80 -6 -iL ipv6.txt IPv6 Target File For the script (if you need help with this part) do a for loop: for i in {1..234}; do echo "FE80::$i" >> ipv6.txt; done The only limit I see with this setup, is that you will have to ...


2

Sounds like you will want to settle in with a cup of coffee, a copy of the spec, and the libpcap man pages. It should not be too difficult to write a program that will craft and transmit these packets for you. The high level flow will be Iterate through your use cases (let's use the echo reply for example) Fill out the data structure that contains the ...


1

Remember that IPv6 is not that different than IPv4. Layer 2 is still the same, as is Layer 4 and above. Routing protocols also remains the same. So a good old "lets fill the victims internet link" attack, works similar in IPv6, but with different tools. What one could hope, is that ISP's does a better job stopping spoofed adresses from leaving their ...


1

A 'Reflection-based DoS Attack' in the traditional sense means that a number of computers spoof their source IP address to the same address (10.1.1.99) who is supposed to be the intended victim, and then the computers connect to a 'reflector' (10.1.1.88). The reflector attempts to respond to all those connection attempts by connecting to the spoofed address, ...


1

Not entirely sure why the answer from @balgan had a downvote, but to expand essentially I would recommend the same thing which is to use the windows firewall which ships with Server 2008 to protect that host and block access to services over the IPv6 tunnel interface. If you've not running the firewall already to block IPv4 connections, you could add a ...


1

I agree with Chris - the effect on automated scanning is not changed all that much. For me the biggest security implication of IPV6 is the support for source routed traffic (an essential part of its mobile device support). So trying to authenticate remote systems based on IP address (which was always a very dubious idea) becomes plain silly.



Only top voted, non community-wiki answers of a minimum length are eligible