Re: SLAAC Attack - 0day Windows Network Interception Configuration Vulnerability

[Joe Klein <jsklein () gmail com>]

Sorry Adam, the whole ‘ND MITM’ issue is old news, has been discussed
at IETF meeting, mailing lists and published in multiple RFC's.  I
have also been teaching, demoing this and other IPv6 attack technique
for at least seven years, as has Marc Heuse (Marc - Nice job on the
IPv6 THC Tools and your presentations!).

What you might find interesting is the reason Microsoft doesn’t
include SEND in their current products. It seems after the engineers
from Microsoft and Ericsson finished writing the IETF document, they
also wrote and filed a patent on the process. So Microsoft has
concerns implementing SEND, due to legal concerns with Ericsson. I
have been privately requesting Microsoft to address this issue since
2005 and publicly requested a status from the MSRC at their Q&A
session during Black Hat Vegas 2009. The status so far is --- there is
no status. Anyone form Microsoft want to provide a status?

On mitigating this problem, you have multiple choices:

1.      Disable IPv6 on all devices.

This is the best option if you do not have security products which
support IPv6 – really support IPv6! That level of support should
include parity with the current IPv4 product, support for all active
RFC’s, device discovery and vulnerabilities.  I presented a list of
those high level items during HOPE/Toorcon/Sector 2010, if you anyone
is interested.

So over the last 5 years, I have interviewed hundreds of vendors
claiming to support IPv6, many of them monitor this list. I have a
“Trust but verify”, so I tested many of these products, and the result
is they all FAILED. I presented on my finding back in 2005 but have
been updating this list yearly. I have considered publishing my
findings, but legal consul recommended against it. This year might be
different, stay tuned – maybe Black Hat or Defcon.

If you do have products which support IPv6, or your vendor has
convinced you of it, then leave IPv6 enabled. The cost of disabling,
then enabling the protocol on a large network can be very expensive.
Also, don’t be that guy that removes the IPv6 binaries as a method to
protect your networks. It seems if you remove the binaries from many
operating systems, it will require a complete reload of the operating
system and applications.

2.      If you don’t currently support IPv6 in your environment, block
layer 2 protocol number 86DD.

3.      If by chance you have IPv6 enabled or support IPv6, enable RA
guard. Note, that many switches either don’t support RA Guard and will
requiring a switch replacement, while others require a software
upgrade.

4.      Again if you don’t currently support IPv6, you can also block and
log protocol 41 on routers. This will not solve the problem, but will
at least provide an indication an attack is accruing. Look for the
router advertising packets.

5.      There are a bunch of other methods, but sadly don’t have time to
enumerate all them here.

6.      Implement SEND.

This in theory is easy, but in practice can take a lot of work. It
will require all hosts and routers to support IPv6 SEND/CGA. It will
also require implementing a certificate authority.

On the router/switch side, Cisco and Juniper have implemented SEND in
their devices. Outside of these two vendors, your only option are for
FreeBSD or LINUX system:

-       Use the DoCoMo Labs USA OpenSource implementation of RFC 3971, 3972,
and 3779 for SEcure Neighbor Discovery (SEND). The code and
documentation can be downloaded at:
http://www.aestheticscientist.com/082406/lab_opensource.html
-       Use IPv6-SEND-CGA (http://code.google.com/p/ipv6-send-cga/)
For the client side, consider Easy-SEND (at
http://sourceforge.net/projects/easy-send) or IPv6-SEND-CGA
(http://code.google.com/p/ipv6-send-cga/), for Linux.

Adam, one good outcome of your teams posting this vulnerability is,
the security and IT community are discussing potential risks involving
in poor deployment of IPv6 networks.

JoeKlein
#IPv6sec
_______________________________________________
Dailydave mailing list
Dailydave () lists immunityinc com
https://lists.immunityinc.com/mailman/listinfo/dailydave