Feeds

Covert channel tool hides data in IPv6

But VoodooNet not new magic

Top three mobile application threats

An independent security researcher showed off an early version of a tool for creating covert channels that, he claims, can pass undetected through most firewalls and intrusion detection systems.

The tool, dubbed VoodooNet or v00d00n3t, uses the ability of most computers to encapsulate next-generation network traffic, known as Internet Protocol version 6 (IPv6), inside of today's network communications standard, or IPv4.

Because most security hardware appliances and host-based intrusion detection programs have not been programmed to inspect IPv6 packets in depth, data can bypass most network security, said independent security researcher Robert Murphy, who presented the tool at the DEFCON hacking conference last weekend.

"Most network hardware only knows to pass the traffic along," Murphy said. "For example, the Windows firewall does not handle IPv6 so these packets pass right though."

The tool takes advantage of a lack of understanding of many of the issues that the next-generation network data standard poses to organisations' network security. The US federal government and many major corporations are transitioning to the standard by the end of the decade. The US Department of Defense and the White House's Office of Management and Budget have mandated that the military services and federal agencies move their backbone systems to IPv6 by 30 June, 2008.

While many network security applications have not been programmed to inspect IPv6 data, the standard is widely supported by routing software. Linux, Mac and Windows XP allow IPv6 networking for compatibility, while Microsoft's next-generation operating system, Vista, uses the standard as the default networking protocol. Microsoft supports wrapping IPv6 packets inside of IPv4 data, known as 6to4 tunneling, so that networks sending data using IPv6 can communicate across the Internet, which mainly runs IPv4. Most routers also support the next-generation networking standards as well.

Transitioning technologies always poses problems for security managers, said Joe Klein, a network expert with the North American IPv6 Task Force and a senior security consultant with Honeywell.

"We are expecting a lot here to be discovered and disclosed," Klein said. "But just like the early implementation of any technology, we expect to find defects and covert channels."

The tool uses Internet Control Message Protocol version 6, or ICMPv6, to send ping packets from one computer to another, hiding information in certain fields of the packets without violating any existing Internet Request for Comment (RFC)--the documents that set the technical guidelines for Internet technology.

The packets have a target address for the network where the recipient PC resides and a key, which identifies which covert PC on that network is the destination. The stealthiest mode only sends a single byte per ping, but up to 32 bytes can be sent, sacrificing stealth for throughput.

Klein believes that the communications would not be detected by existing IPv4 devices, and that bot nets, among other threats, could use the technology for stealthier command and control channels. However, programming devices with knowledge of IPv6 could easily detect the channel.

"The solution is network devices that understand IPv6 better," Klein said. "Intrusion detection systems that fully implement IPv6, for instance."

He also points to one feature of the system that could give away any PCs that are taking part in covert communications using the tool: The initial version of the tool sets the endpoint computers to listen in promiscuous mode to pick up data sent to their network.

Dan Kaminsky, a well-known network security expert, points out that covert channels are nothing new, and while an implementation using ICMP packets may not have been created yet, sending data using 6to4 tunneling has been around for a few years.

"Yes, firewalls need to be more aware that these transition technologies exist and need to handle them better," Kaminsky said. "But ICMP tunnels have existed for, what, 10 or 15 years? Doing it using IPv6 is not difficult. You break into a box and hit IPv6 enable."

While the technique may work today, as more companies start deploying IPv6, security will quickly catch up.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.