IPv6 Security

www.progreso.com.sg1
IPv6 Cyber Security:
What Security Issues have you Missed Out?
6 September 2013

Agenda
 IPv6 Security Myths
 IPv6 Security Compromises
 Network Reconnaissance in IPv6
 IPv6 for Security Practitioners
 Ensuring Cybersecurity in IPv6 Transitions
 IPv6 Security Implementations

Myth on Increased Security
 IPv6 is more secure than IPv4, since
security was considered during the
design of the protocol and not as an
afterthought.

Myth on End-to-end Principle
 IPv6 will return the end-to-end
principle to the Internet,
hence security architectures
will switch from the network
to the hosts.

Myth on NAT
 IPv6 networks will be NAT-free.

Myth on Host Reconnaissance
 The massive IPv6 address space will make host
scanning unfeasible.

Agenda

The New Cyber Landscape
- Multiple threat vectors

Attack Vectors on IPv6
 IPv6 addressing architecture
 Network reconnaissance
 Spoofing and smurf attacks
 Worms and viruses
 Main packet header + extension header issues
 IPv6 layer-2 and layer-3 security compromises
 Security on the routing infrastructure
 Vulnerabilities in transition mechanisms

Hacking Groups
Script kiddies
Political
Hacktivists
Crime Rings
State
Sponsored
Teams

Kiddie Scripts

Nmap Scanning

Vulnerability Scanning using Nessus

Packet Crafting

Agenda

Dissecting an IPv6 Address
Global Routing Prefix
(length = a)
Subnet ID
(length = b)
Interface ID
(length = 128 - a – b)

Methods of Generating the IID
 EUI-64: Embedding the MAC
 Employ low-byte addresses
 Embed IPv4 address
 “Wordy” address
 Privacy or temporary address
 Transition/Coexistence mechanisms

EUI-64
IEEE OUI ff-fe Lower 24 bits of MAC
Known/searchable
(24 bits)
Fixed
(16 bits)
Unknown
(24 bits)
264 224

Low-Byte Addresses
2001:db8:1234:5678:0000:0000:0000:1234
2001:db8:1234:5678:0000:0000:0000:0001
2001:db8:1234:5678:0000:0000:0000:8888
264 216 or 28

Embedded IPv4 Addresses
2001:db8:1234:5678:0000:0000:c0a8:0101
2001:db8:1234:5678:0000:0000:0808:0808
264 232
8.8.8.8
192.168.1.1

Wordy Addresses
264 232
2001:db8:1234:5678:dec:1ded:c0:ffee
Dictionary-based scanning
2a03:2880:2110:3f02:face:b00c::

Privacy/Temporary Addresses
 RFC 4941
2001:db8:1234:5678:e24a:71c:d93f:7b0
2001:db8:1234:5678:0000:0000:0000:8888
Host is still compromised!

Transition/Coexistence Technologies
6to4 = 2002:c0a1:c0fe:1:2e0:18ff:fefb:7a25/48
ISATAP = fe80::5efe:c0a1:c0fe
NAT64 = 64:ff9b::c0a1:c0fe

Agenda

IPv6 Education and Training

Upgrade Security Tools

Additional Configurations

Risks of Tunneling Protocols

New Features Adds Complexity

Agenda

Transitions and Cybersecurity

Apply Rigorous Oversight

Leverage Accredited IPv6 Test Program

Don’t Get Intimidated

Incremental Deployment

Don’t Lose Sleep Over Dual Stacking

Agenda

IPv6 Security Measures
 Endpoint security
 Standalone firewalls
 Packet filters
 Data link level security

IPv6 Security Implementation Concerns
 IPv6 protocol stack vulnerabilities
 Lack of IPv6 exposure and operational experience
 Unintentional connectivity via tunneling
 Lack of first-hop security features
Application
TCP UDP
IPv4 IPv6
Data Link

Call to Action
 IPv6 is the future of the Internet
 There are significant differences between IPv4 and
IPv6
 Don’t lag behind in IPv6 knowledge
 Join now to learn more!

Are You Ready?

IPv6 Security

More Related Content

What's hot (19)

Viewers also liked (16)

Similar to IPv6 Security (20)

Recently uploaded (20)

IPv6 Security