IPv6 Security : ICMPv6 Vulnerabilities. Navaneethan C. Arjuman National Advanced IPv6 Centre December 2012

Transcription

1 IPv6 Security : ICMPv6 Vulnerabilities Navaneethan C. Arjuman nava@nav6.usm.my National Advanced IPv6 Centre December

2 Understanding ICMP What is ICMP? Internet Control Message Protocol (ICMP) ICMP integral part IP implementation Must be implemented in all IP module 2

3 ICMP Goal Goal of ICMP? Defined under RFC 792 Primary Goal Error messages for non-transient error conditions Provide a way to probe the network in order to determine general characteristics about the network 3

4 ICMP Categories Two (2) Categories ICMP Error Messages ICMP Query Messages 4

5 Understanding ICMP Currently there are two (2) types ICMPv4 ICMPv6 5

6 ICMPv4 Core Protocol of Internet Protocol Suite Defined under RFC 792 Mainly used to provide error message ICMP messages are typically generated in response to errors in IP datagrams (as specified in RFC 1122) or for diagnostic or routing purposes ICMP errors are always reported to the original source IP address of the originating datagram. 6

7 ICMPv4 IP Datagram Bits TYPE CODE CHECKSUM 32 REST OF HEADER Type ICMP type as specified below. Code Subtype to the given type. Checksum Error checking data. Calculated from the ICMP header+data, with value 0 for this field. The checksum algorithm is specified in RFC Rest of Header Four byte field. Will vary based on the ICMP type and code. 7

8 ICMPv4 - Type Type Range There are types 0 till 41 already defined 42 till 255 reserved Special attention focused on the following type Type 3 Type 9 and 10 Type 15 and 16 Type 17 and 18 Type 37 and 38 8

9 ICMPv4 - Type 3 Below are special codes that required main attention Code Range 0 - Destination network unreachable 1 - Destination host unreachable 2 - Destination protocol unreachable 3 - Destination port unreachable 6 - Destination network unknown 7 - Destination host unknown 9

10 ICMPv4 - Type Source host isolated 9 - Network administratively prohibited 10 - Host administratively prohibited 11 - Network unreachable for TOS 12 - Host unreachable for TOS 13 - Communication administratively prohibited 10

11 ICMPv4 - Others Type Type 9, Code 0 -Router Advertisement Type 10, Code 0 - Router discovery/selection/ solicitation Type 15, Code 0 - Information Request Type 16, Code 0 - Information Reply Type 17, Code 0 - Address Mask Request Type 18, Code 0 - Address Mask Reply Type 37, Code 0 - Domain Name Request Type 38, Code 0 - Domain Name Reply 11

12 ICMPv4 ICMP Fault Monitoring Features Sample Capture 12

13 ICMPv6 Internet Control Message Protocol (ICMP) for Internet Protocol version 6 (IPv6) Defined under RFC 4443 Mainly used for error message Several extensions have been published, defining new ICMPv6 message types as well as new options for existing ICMPv6 message types Neighbor Discovery Protocol (NDP) is a node discovery protocol in IPv6 which replaces and enhances functions of ARP 13

14 ICMPv6 Secure Neighbor Discovery Protocol(SEND) is an extension of NDP with extra security. Multicast Router Discovery (MRD) allows discovery of multicast routers. ICMPv6 messages may be classified into two categories: error messages and information messages ICMPv6 messages are transported by IPv6 packets in which the IPv6 Next Header value for ICMPv6 is set to

15 ICMPv6 IP Datagram Bit Offset Type Code Checksum 32 Message Body Type ICMP type as specified below. Code Subtype to the given type. Checksum Error checking data. Calculated from the ICMP header+data, with value 0 for this field. 15

16 ICMPv6 - Type Special attention focused on the following type Type 1 Type 128 and 137 Type 139 and

17 ICMPv6 - Type 1 Below is special codes that required attention when scanning take place Code Range 0 - no route to destination 1 - communication with destination administratively prohibited 2 - beyond scope of source address 3 - address unreachable 4 - port unreachable 17

18 ICMPv6 - Type source address failed ingress/egress policy 8 - reject route to destination 18

19 ICMPv6 - Others Type Type 128, Code 0 - Echo Request Type 129, Code 0 Echo Reply Type 130, Code 0 - Multicast Listener Query Type 133, Code 0 - Router Solicitation (NDP) Type 134, Code 0 - Router Advertisement (NDP) Type 135, Code 0 - Neighbor Solicitation (NDP) Type 136, Code 0 - Neighbor Advertisement (NDP) 19

20 ICMPv6 - Others Type Type 139, Code 0 till 2 - ICMP Node Information Query Type 140, Code 0 till 2 - ICMP Node Information Response Type 141, Code 0 - Inverse Neighbor Discovery Solicitation Message Type 142, Code 0 - Inverse Neighbor Discovery Advertisement Message Type 144, Code 0 - Home Agent Address Discovery Request Message 20

21 ICMPv6 - Others Type Type 145, Code 0 - Home Agent Address Discovery Reply Message Type 146, Code 0 till 2 - Mobile Prefix Solicitation Type 147, Code 0 - Mobile Prefix Advertisement Type 151- Multicast Router Advertisement (MRD) Type Multicast Router Solicitation (MRD) 21

22 ICMP Attacks Man in the Middle (MITM) Denial of Services 22

23 Man in the Middle Attacks Sniffing and session hijacking IPv4 ARP cache poisoning DHCP spoofing IPv6 ARP replaced by ICMPv6 neighbor discovery process DHCP may be replaced by the alternative process called stateless auto-configuration 23

24 Man in the Middle Attacks MITM some known techniques Man in the middle with spoofed ICMPv6 neighbor advertisement. Man in the middle with spoofed ICMPv6 router advertisement. Man in the middle using ICMPv6 redirect or ICMPv6 too big to implant route. Man in the middle to attack mobile IPv6 but requires ipsec to be disabled. Man in the middle with rogue DHCPv6 Server 24

25 Man in the Middle Attacks MITM some known techniques Man in the middle with spoofed ICMPv6 neighbor advertisement. Man in the middle with spoofed ICMPv6 router advertisement. Man in the middle using ICMPv6 redirect or ICMPv6 too big to implant route. Man in the middle to attack mobile IPv6 but requires ipsec to be disabled. Man in the middle with rogue DHCPv6 Server 25

26 MITM With Spoofed ICMPv6 Neighbor Advertisement ICMPv6 neighbor discovery requires two types of ICMPv6 ICMPv6 Neighbor solicitation (ICMPv6 Type 135) ICMPv6 neighbor advertisement (ICMPv6 type 136). 26

27 MITM With Spoofed ICMPv6 Neighbor Advertisement 27

28 MITM With Spoofed ICMPv6 Router Advertisement 28

29 MITM With Spoofed ICMPv6 Router Advertisement 29

30 Denial of Services Traffic flooding with ICMPv6 router advertisement, neighbor advertisement, neighbor solicitation, multicast listener discovery, or smurf attack. Denial of Service which prevents new IPv6 attack on the network. Denial of Service which is related to fragmentation. Traffic flooding with ICMPv6 neighbor solicitation and a lot of crypto stuff to make CPU target busy. 30

31 Smurf Attack 31

32 Duplicate Address Detection (DAD) 32

33 Duplicate Address Detection (DAD) 33

34 References /detection/complete-guide-ipv6-attackdefense_ Protocol 34

35 References 35

36 Thank You 36