Feeds

Defcon speaker calls IPv6 a 'security nightmare'

Growing pains for next-gen address system

Protecting against web application threats using SSL

The internet's next-generation addressing scheme is so radically different from the current one that its adoption is likely to cause severe security headaches for those who adopt it, a researcher said last week.

With reserves of older addresses almost exhausted, the roll-out of the new scheme — known as IPv6 or Internet Protocol version 6 — is imminent. And yet, the radical overhaul still isn't ready for prime time — in large part because IT professionals haven't worked out a large number of security threats facing those who rely on it to route traffic over the net.

“It is extremely important for hackers to get in here fast because IPv6 is a security nightmare,” Sam Bowne, an instructor in the Computer Networking and Information Technology Department at the City College of San Francisco, said on day one of the Defcon hacker conference in Las Vegas. “We're coming into a time of crisis and no one is ready.”

Chief among the threats is the issue of incompatible firewalls, intrusion-prevention devices, and other security appliances, Bowne said. That means many people who deploy IPv6 are forced to turn the security devices off, creating a dangerous environment that could make it easier for attackers to penetrate network fortresses.

What's more, internet addresses that use the new protocol by default contain a 64-bit string that's generated by a computer's MAC, or Media Access Control, address. The use of the so-called extended unique identifier means that people who want to remain anonymous online will have to take precautions that aren't necessary under today's IPv4 system.

“It means that everything you send or receive is labeled with your real MAC address and therefore if you were to do something naughty, like download copyrighted material, they would know who you are much better than they do if all they have is an IP version 4 address,” Bowne said.

Some operating systems, including Windows Vista and Windows 7, have privacy settings turned on by default that cause the string to be randomly generated. While this setting helps preserve anonymity, it also has the potential to break many end-to-end communications, so it may not always be available, Bowne warned. Many organizations require the use of the extended unique identifier so they can keep tabs on their employees' internet usage, he added.

To be sure, IPv6 offers many features, including a method for easier end-to-end encryption, that should make networking more secure.

“We've got a lot of benefits and we've taken a lot of the learning from a security perspective from IPv4 and implemented a lot of new security features into IPv6,” said Joe Klein, a subject matter expert with the North American IPv6 task force, who was also attending Defcon. “The problem with it is we're in a transition period and that's going to take anywhere from five to 10 years to fully implement it and start to provide end-to-end encryption.”

The new protocol, because it hasn't been tested as widely as IPv4, is also likely to suffer from vulnerabilities resulting from buffer overflows and similar bugs, he said. The flaws will likely be worked out as it gains wide acceptance, but that will also take years, he added.

Bowne and Klein aren't the only people warning of growing pains in the net's addressing system. This recent submission to the Full-disclosure list claims Google's Gmail service is also having trouble adapting to the scheme.

Bowne — who teaches classes in ethical hacking, network defense, and Windows 7 — also outlined several attacks that exploit unique characteristics of IPv6 to wreak havoc on networks. Packet amplification attacks place a 0 in the routing header of each packet, causing them to travel in a looped path. Ping-pong exploits take advantage of the wealth of /64 subnets available in the protocol, allowing attackers to send packets from one non-existent connection to another. The result is an endless series of “ICMP unreachable” error messages. As a result, networks are flooded with garbage data.

The transition to IPv6 is necessary to deal with the growing exhaustion of IPv4 addresses. The older protocol, which is based on a 32-bit addressing system, yields about 4 billion unique numbers, fewer than the 7 billion humans who populate the planet. At the current usage rate, the allocation of free addresses could be used up by June of next year, according to some estimates. IPv6, by contrast, is a 128-bit scheme that allows for over 3.4x1038 addresses, which ought to keep the world going for quite some time.

Slides and other materials from Bowne's talk are here. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.