Feeds

Covert channel tool hides data in IPv6

But VoodooNet not new magic

5 things you didn’t know about cloud backup

An independent security researcher showed off an early version of a tool for creating covert channels that, he claims, can pass undetected through most firewalls and intrusion detection systems.

The tool, dubbed VoodooNet or v00d00n3t, uses the ability of most computers to encapsulate next-generation network traffic, known as Internet Protocol version 6 (IPv6), inside of today's network communications standard, or IPv4.

Because most security hardware appliances and host-based intrusion detection programs have not been programmed to inspect IPv6 packets in depth, data can bypass most network security, said independent security researcher Robert Murphy, who presented the tool at the DEFCON hacking conference last weekend.

"Most network hardware only knows to pass the traffic along," Murphy said. "For example, the Windows firewall does not handle IPv6 so these packets pass right though."

The tool takes advantage of a lack of understanding of many of the issues that the next-generation network data standard poses to organisations' network security. The US federal government and many major corporations are transitioning to the standard by the end of the decade. The US Department of Defense and the White House's Office of Management and Budget have mandated that the military services and federal agencies move their backbone systems to IPv6 by 30 June, 2008.

While many network security applications have not been programmed to inspect IPv6 data, the standard is widely supported by routing software. Linux, Mac and Windows XP allow IPv6 networking for compatibility, while Microsoft's next-generation operating system, Vista, uses the standard as the default networking protocol. Microsoft supports wrapping IPv6 packets inside of IPv4 data, known as 6to4 tunneling, so that networks sending data using IPv6 can communicate across the Internet, which mainly runs IPv4. Most routers also support the next-generation networking standards as well.

Transitioning technologies always poses problems for security managers, said Joe Klein, a network expert with the North American IPv6 Task Force and a senior security consultant with Honeywell.

"We are expecting a lot here to be discovered and disclosed," Klein said. "But just like the early implementation of any technology, we expect to find defects and covert channels."

The tool uses Internet Control Message Protocol version 6, or ICMPv6, to send ping packets from one computer to another, hiding information in certain fields of the packets without violating any existing Internet Request for Comment (RFC)--the documents that set the technical guidelines for Internet technology.

The packets have a target address for the network where the recipient PC resides and a key, which identifies which covert PC on that network is the destination. The stealthiest mode only sends a single byte per ping, but up to 32 bytes can be sent, sacrificing stealth for throughput.

Klein believes that the communications would not be detected by existing IPv4 devices, and that bot nets, among other threats, could use the technology for stealthier command and control channels. However, programming devices with knowledge of IPv6 could easily detect the channel.

"The solution is network devices that understand IPv6 better," Klein said. "Intrusion detection systems that fully implement IPv6, for instance."

He also points to one feature of the system that could give away any PCs that are taking part in covert communications using the tool: The initial version of the tool sets the endpoint computers to listen in promiscuous mode to pick up data sent to their network.

Dan Kaminsky, a well-known network security expert, points out that covert channels are nothing new, and while an implementation using ICMP packets may not have been created yet, sending data using 6to4 tunneling has been around for a few years.

"Yes, firewalls need to be more aware that these transition technologies exist and need to handle them better," Kaminsky said. "But ICMP tunnels have existed for, what, 10 or 15 years? Doing it using IPv6 is not difficult. You break into a box and hit IPv6 enable."

While the technique may work today, as more companies start deploying IPv6, security will quickly catch up.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.