Feeds

Covert channel tool hides data in IPv6

But VoodooNet not new magic

Protecting against web application threats using SSL

An independent security researcher showed off an early version of a tool for creating covert channels that, he claims, can pass undetected through most firewalls and intrusion detection systems.

The tool, dubbed VoodooNet or v00d00n3t, uses the ability of most computers to encapsulate next-generation network traffic, known as Internet Protocol version 6 (IPv6), inside of today's network communications standard, or IPv4.

Because most security hardware appliances and host-based intrusion detection programs have not been programmed to inspect IPv6 packets in depth, data can bypass most network security, said independent security researcher Robert Murphy, who presented the tool at the DEFCON hacking conference last weekend.

"Most network hardware only knows to pass the traffic along," Murphy said. "For example, the Windows firewall does not handle IPv6 so these packets pass right though."

The tool takes advantage of a lack of understanding of many of the issues that the next-generation network data standard poses to organisations' network security. The US federal government and many major corporations are transitioning to the standard by the end of the decade. The US Department of Defense and the White House's Office of Management and Budget have mandated that the military services and federal agencies move their backbone systems to IPv6 by 30 June, 2008.

While many network security applications have not been programmed to inspect IPv6 data, the standard is widely supported by routing software. Linux, Mac and Windows XP allow IPv6 networking for compatibility, while Microsoft's next-generation operating system, Vista, uses the standard as the default networking protocol. Microsoft supports wrapping IPv6 packets inside of IPv4 data, known as 6to4 tunneling, so that networks sending data using IPv6 can communicate across the Internet, which mainly runs IPv4. Most routers also support the next-generation networking standards as well.

Transitioning technologies always poses problems for security managers, said Joe Klein, a network expert with the North American IPv6 Task Force and a senior security consultant with Honeywell.

"We are expecting a lot here to be discovered and disclosed," Klein said. "But just like the early implementation of any technology, we expect to find defects and covert channels."

The tool uses Internet Control Message Protocol version 6, or ICMPv6, to send ping packets from one computer to another, hiding information in certain fields of the packets without violating any existing Internet Request for Comment (RFC)--the documents that set the technical guidelines for Internet technology.

The packets have a target address for the network where the recipient PC resides and a key, which identifies which covert PC on that network is the destination. The stealthiest mode only sends a single byte per ping, but up to 32 bytes can be sent, sacrificing stealth for throughput.

Klein believes that the communications would not be detected by existing IPv4 devices, and that bot nets, among other threats, could use the technology for stealthier command and control channels. However, programming devices with knowledge of IPv6 could easily detect the channel.

"The solution is network devices that understand IPv6 better," Klein said. "Intrusion detection systems that fully implement IPv6, for instance."

He also points to one feature of the system that could give away any PCs that are taking part in covert communications using the tool: The initial version of the tool sets the endpoint computers to listen in promiscuous mode to pick up data sent to their network.

Dan Kaminsky, a well-known network security expert, points out that covert channels are nothing new, and while an implementation using ICMP packets may not have been created yet, sending data using 6to4 tunneling has been around for a few years.

"Yes, firewalls need to be more aware that these transition technologies exist and need to handle them better," Kaminsky said. "But ICMP tunnels have existed for, what, 10 or 15 years? Doing it using IPv6 is not difficult. You break into a box and hit IPv6 enable."

While the technique may work today, as more companies start deploying IPv6, security will quickly catch up.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.