Slashdot Mirror
Tunnelled IPv6 Attacks Bypass Network Intrusion Detection Systems (itnews.com.au)
"The transition to internet protocol version 6 has opened up a whole new range of threat vectors that allow attackers to set up undetectable communications channels across networks, researchers have found."
Slashdot reader Bismillah summarizes a report from IT News.
Researchers at NATO's Cooperative Cyber Defence Centre of Excellence and Estonia's University of Tallinn have worked out how to set up communications channels using IPv6 transition mechanisms, to exfiltrate data and for systems control over IPv4-only and dual-stack networks -- without being spotted by network intrusion detection systems.
The article argues that "Since IPv6 implementations and security solutions are relatively new and untested, and systems engineers aren't fully aware of them, the new protocol can become a network backdoor attackers can exploit undetected." The researchers' paper is titled "Hedgehog In The Fog."
The article argues that "Since IPv6 implementations and security solutions are relatively new and untested, and systems engineers aren't fully aware of them, the new protocol can become a network backdoor attackers can exploit undetected." The researchers' paper is titled "Hedgehog In The Fog."
IPv6 is called out unfairly here. Any kind of tunnel is potentially not handled by an IDS.
There's better ways to exfiltrate data. VPN anyone?
IPv6 transition mechanisms
ipv6 has been around nearly a decade. any company that doesnt have a competent dual-stack implementation deserves what they get. that having been said the number of vendors that recoil in shock and horror when you ask if they can route, or even support ipv6 is amazing.
Since IPv6 implementations and security solutions are relatively new and untested
but this has been an issue thats unaddressed by the industry, not security pros. I can think of maybe five vendors ive declined because their ipv6 implementation was either partial, shitty, or non-existent. I decided on implementing OpenBSD instead and so far havent found anything as robust.
systems engineers aren't fully aware of them
this happens when you have a baby-boomer tech employee who refuses to retire. you let him ride out his last days as a senior or manager while backfilling him with what you hope are more competent and open minds, but unless its from the vendor that bought him steak and told him he was a real straight shooter, hes not going out of his lane to potentially fail at this point in his career, or learn something new.
Good people go to bed earlier.
netsh interface teredo set state disabled
netsh interface isatap set state disabled
netsh interface 6to4 set state disabled
These IPV6 tunnels are use than useless in my experience.
Windows Homegroup depends on IPV6 being present & some other users of the machines I use find it useful so it can't be disabled as well all the time but at least it's not trying to tunnel out. When (though it's still rare), the network has IPV6 connectivity it also has IPV6 firewalls so it's less of an issue as well.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Er, my ISP provides a 6RD tunnel. Wasn't Hurricane Electric one of the frist to do this???
I mean, WTF. What kind of complete idiot would think that tunneling IPv6 in IPv4 is unpossible or that it's much different from an IPv4 over IPv4 tunnel?
Oh I know, the kind of complete idiot who develops Apping Apps! (Apps!) and thinks that a reverse HTTP proxy to prove that is web service isn't working correctly is unpossible.
How can we throw these idiots out of the profession?
I wonder how much of this is from win to denying that IPv6 is coming and not doing the homework and proper security analysis?
Jumpstart the tartan drive.
nobody can understand everything
"Understand" is a relative term. Most people who "understand" a problem really just have many years of experience making mistakes and have associated certain actions to get something seemingly working, aka cargo-cult. In nearly every situation where I got to meet a domain specialist, a quick 5 minute reading on the domain from wiki and talking to the specialist for a day or two allowed me to understand the domain better than the specialist. Logical problems can be solved 100% by logic, no knowledge or experience required.
Fluid intelligence is the general ability to think abstractly, reason, identify patterns, solve problems, and discern relationships
Fluid intelligence or fluid reasoning is the capacity to reason and solve novel problems, independent of any knowledge from the past
Once you understand the problem, the answer is obvious. Find someone with decent abstract reasoning and "understanding everything" becomes a reality.
Automatic transition mechanisms are beyond useless in todays dual stack world. They are not now nor will they ever be sufficiently reliable for production use and therefore universally ignored for purposes other than owning end users. Microsoft themselves shut down their own teredo servers due to stated reason of non-existent demand.
The only thing continuing to have teredo, isatap and 6to4 enabled by default on billions of machines does is help end users get owned.
Can I put this to use to clone a mesh network for private communications?
It little behooves the best of us to comment on the rest of us.
> I just deactivate IPv6 at all dual stack machines, that should fix this...
Wrong. If your ISP doesn't support IPV6, you can still get IPV6 via a "tunnel broker". Packets get tunnelled over an encrypted connection to IPV6-land. I know this is Slashdot, but please RTFA https://www.itnews.com.au/news...
> The researchers developed proofs of concept with tunnel-based IPv6 transition tools over
> IPv4-only, or IPv4/IPv6 dual-stack networks, that were able to pass traffic undetected by
> common network intrusion detection systems (NIDS) such as Snort, Suricata, Bro and Moloch.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Its one of those protocols hardly anyone uses in relation towards IPv4. You can turn it off on your system and everything runs just fine. It doesn't matter how old it is, but the "neck massager" was never really meant for your neck. Know what I mean ;) ? It was new and was supposed to be able to handle more web addresses. Cloud computing is getting worse, so maybe it'll get its use when we all have servers in our houses or maybe in our phones. You never know anymore. I still say cloud computing will destroy open source.
NAT is not security, it's a placebo, and it's still subject to NAT traversal attacks.
Also IPv6 can do NAT (eg. you can use it for a transparent proxy) and there are routers that let you define your own firewall rules so that cheap ADSL router with NAT is already available - so you can do it, just don't assume that NAT is going to keep anyone other than the honest out.
windows 10 enables the tunnel mechanisms by default.
and has no easy way to turn them off.
yeah, you can remove ipv6 from the network card - but are you so daft that you think it actually removes this threat? hahahahha. of course no. you have to go into registry to disable ipv6. and of course they will reset it on update, because fuck you, that's why. and disabling any ipv6 support entirely wouldn't help either if the offending sw gets to write it's own ethernet packets(though thats more complicated than some powershell script. oh yeah don't try disabling powershell either, it will break half the system, because again, fuck you).
of course, if you can't turn off the iot mesh shit either then why worry about this.
world was created 5 seconds before this post as it is.
Hell, Windows XP enables them by default. (once IPv6 is installed)
Just like in IPv4 classful addressing was the first to go out the window once the address limitation hit, I predict this 64:64 split will be the first to go in IPv6. People love doing a numbers analysis, but that flies in the face of what IPv6 authors have recommended in terms of addressing structures. They recommend people to go out and get anything from /48 to /32 allocations from their RIR, making the allocations rather ridiculous. It also assumes a one size fits all for all networks, and gives the networks a ridiculous size that will never be remotely reached by any subnet, but are just there for autoconfiguration
Instead, having a fixed 64-bit global prefix, and then a variable option of 32:32 or 16:48 for a subnet:host split would have made more sense. A clean hierarchical routing would have been possible with IPv6, but still allowed generous allocations to ISPs and downstream organizations, including Provider independent addresses. Instead, once these limits show up, the IETF/IANA will have to come out with an IPv7 that will be IPv6, but with a change in the network/host divide. People can argue that one can do this now, but as you point out, those splits have been hard coded into silicon, so that any change would probably be cleanly implemented in a newer version of the IP - say IPv7 (I know all the versions have been pre-emptively defined, but that may need another look).