Feeds

Defcon speaker calls IPv6 a 'security nightmare'

Growing pains for next-gen address system

The Power of One eBook: Top reasons to choose HP BladeSystem

The internet's next-generation addressing scheme is so radically different from the current one that its adoption is likely to cause severe security headaches for those who adopt it, a researcher said last week.

With reserves of older addresses almost exhausted, the roll-out of the new scheme — known as IPv6 or Internet Protocol version 6 — is imminent. And yet, the radical overhaul still isn't ready for prime time — in large part because IT professionals haven't worked out a large number of security threats facing those who rely on it to route traffic over the net.

“It is extremely important for hackers to get in here fast because IPv6 is a security nightmare,” Sam Bowne, an instructor in the Computer Networking and Information Technology Department at the City College of San Francisco, said on day one of the Defcon hacker conference in Las Vegas. “We're coming into a time of crisis and no one is ready.”

Chief among the threats is the issue of incompatible firewalls, intrusion-prevention devices, and other security appliances, Bowne said. That means many people who deploy IPv6 are forced to turn the security devices off, creating a dangerous environment that could make it easier for attackers to penetrate network fortresses.

What's more, internet addresses that use the new protocol by default contain a 64-bit string that's generated by a computer's MAC, or Media Access Control, address. The use of the so-called extended unique identifier means that people who want to remain anonymous online will have to take precautions that aren't necessary under today's IPv4 system.

“It means that everything you send or receive is labeled with your real MAC address and therefore if you were to do something naughty, like download copyrighted material, they would know who you are much better than they do if all they have is an IP version 4 address,” Bowne said.

Some operating systems, including Windows Vista and Windows 7, have privacy settings turned on by default that cause the string to be randomly generated. While this setting helps preserve anonymity, it also has the potential to break many end-to-end communications, so it may not always be available, Bowne warned. Many organizations require the use of the extended unique identifier so they can keep tabs on their employees' internet usage, he added.

To be sure, IPv6 offers many features, including a method for easier end-to-end encryption, that should make networking more secure.

“We've got a lot of benefits and we've taken a lot of the learning from a security perspective from IPv4 and implemented a lot of new security features into IPv6,” said Joe Klein, a subject matter expert with the North American IPv6 task force, who was also attending Defcon. “The problem with it is we're in a transition period and that's going to take anywhere from five to 10 years to fully implement it and start to provide end-to-end encryption.”

The new protocol, because it hasn't been tested as widely as IPv4, is also likely to suffer from vulnerabilities resulting from buffer overflows and similar bugs, he said. The flaws will likely be worked out as it gains wide acceptance, but that will also take years, he added.

Bowne and Klein aren't the only people warning of growing pains in the net's addressing system. This recent submission to the Full-disclosure list claims Google's Gmail service is also having trouble adapting to the scheme.

Bowne — who teaches classes in ethical hacking, network defense, and Windows 7 — also outlined several attacks that exploit unique characteristics of IPv6 to wreak havoc on networks. Packet amplification attacks place a 0 in the routing header of each packet, causing them to travel in a looped path. Ping-pong exploits take advantage of the wealth of /64 subnets available in the protocol, allowing attackers to send packets from one non-existent connection to another. The result is an endless series of “ICMP unreachable” error messages. As a result, networks are flooded with garbage data.

The transition to IPv6 is necessary to deal with the growing exhaustion of IPv4 addresses. The older protocol, which is based on a 32-bit addressing system, yields about 4 billion unique numbers, fewer than the 7 billion humans who populate the planet. At the current usage rate, the allocation of free addresses could be used up by June of next year, according to some estimates. IPv6, by contrast, is a 128-bit scheme that allows for over 3.4x1038 addresses, which ought to keep the world going for quite some time.

Slides and other materials from Bowne's talk are here. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.