Feeds

Covert channel tool hides data in IPv6

But VoodooNet not new magic

Choosing a cloud hosting partner with confidence

An independent security researcher showed off an early version of a tool for creating covert channels that, he claims, can pass undetected through most firewalls and intrusion detection systems.

The tool, dubbed VoodooNet or v00d00n3t, uses the ability of most computers to encapsulate next-generation network traffic, known as Internet Protocol version 6 (IPv6), inside of today's network communications standard, or IPv4.

Because most security hardware appliances and host-based intrusion detection programs have not been programmed to inspect IPv6 packets in depth, data can bypass most network security, said independent security researcher Robert Murphy, who presented the tool at the DEFCON hacking conference last weekend.

"Most network hardware only knows to pass the traffic along," Murphy said. "For example, the Windows firewall does not handle IPv6 so these packets pass right though."

The tool takes advantage of a lack of understanding of many of the issues that the next-generation network data standard poses to organisations' network security. The US federal government and many major corporations are transitioning to the standard by the end of the decade. The US Department of Defense and the White House's Office of Management and Budget have mandated that the military services and federal agencies move their backbone systems to IPv6 by 30 June, 2008.

While many network security applications have not been programmed to inspect IPv6 data, the standard is widely supported by routing software. Linux, Mac and Windows XP allow IPv6 networking for compatibility, while Microsoft's next-generation operating system, Vista, uses the standard as the default networking protocol. Microsoft supports wrapping IPv6 packets inside of IPv4 data, known as 6to4 tunneling, so that networks sending data using IPv6 can communicate across the Internet, which mainly runs IPv4. Most routers also support the next-generation networking standards as well.

Transitioning technologies always poses problems for security managers, said Joe Klein, a network expert with the North American IPv6 Task Force and a senior security consultant with Honeywell.

"We are expecting a lot here to be discovered and disclosed," Klein said. "But just like the early implementation of any technology, we expect to find defects and covert channels."

The tool uses Internet Control Message Protocol version 6, or ICMPv6, to send ping packets from one computer to another, hiding information in certain fields of the packets without violating any existing Internet Request for Comment (RFC)--the documents that set the technical guidelines for Internet technology.

The packets have a target address for the network where the recipient PC resides and a key, which identifies which covert PC on that network is the destination. The stealthiest mode only sends a single byte per ping, but up to 32 bytes can be sent, sacrificing stealth for throughput.

Klein believes that the communications would not be detected by existing IPv4 devices, and that bot nets, among other threats, could use the technology for stealthier command and control channels. However, programming devices with knowledge of IPv6 could easily detect the channel.

"The solution is network devices that understand IPv6 better," Klein said. "Intrusion detection systems that fully implement IPv6, for instance."

He also points to one feature of the system that could give away any PCs that are taking part in covert communications using the tool: The initial version of the tool sets the endpoint computers to listen in promiscuous mode to pick up data sent to their network.

Dan Kaminsky, a well-known network security expert, points out that covert channels are nothing new, and while an implementation using ICMP packets may not have been created yet, sending data using 6to4 tunneling has been around for a few years.

"Yes, firewalls need to be more aware that these transition technologies exist and need to handle them better," Kaminsky said. "But ICMP tunnels have existed for, what, 10 or 15 years? Doing it using IPv6 is not difficult. You break into a box and hit IPv6 enable."

While the technique may work today, as more companies start deploying IPv6, security will quickly catch up.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Beginner's guide to SSL certificates

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.