The Myth of Twelve More Bytes. Security on the Post- Scarcity Internet
|
|
|
- Hester Strickland
- 8 years ago
- Views:
Transcription
1 The Myth of Twelve More Bytes Security on the Post- Scarcity Internet
2 IPv6
3 The Myth of 12 More Bytes HTTP DHCP HTTP TLS ARP TCP UDP Internet Protocol Link Layer Physical Layer ICMP
4 The Myth of 12 More Bytes HTTP DHCP HTTP TLS ARP TCP UDP Internet Protocol Link Layer Physical Layer ICMP
5 The Myth of 12 More Bytes HTTP DHCP HTTP TLS NDP MLD MRD ARP TCP UDP ICMP Internet Protocol Link Layer Physical Layer
6 Come Join the Party
7 Stateless Address Auto- Configuration Give Yourself a local address in your subnet Prefix: fe80:0:0:0: : IPv6 Address: fe80::f03c:91ff:fe96:d927 Ask what network you re in example: 2600:3c03:: Take your MAC Address, use it in the prefix MAC: f2:3c:91:96:d9:27 IPv6 Address: 2600:3c03::f03c:91ff:fe96:d927
8 Privacy Addresses Using your MAC in the last 64 bits identifies you, globally, to every website you visit, no matter where you are Super- Mega Evercookie RFC 4941 Privacy Addresses Generate a random /64 address Prefer it for outgoing communications
9 DHCPv6 Conceptually the same as DHCP Clients can get more than IP Address Can also get DNS Servers
10 The Default For Windows Don t Know, Need to Fill in: Getting an Address SLAAC? DHCPv6 or Both? DNS Servers RDNSS in NDP? Or DHCPv6?
11 ICMPv6 Critical Infrastructure
12 SLAAC: Stateless Address Auto- configuration NDP: Neighbor Discovery (ARP) MLD: Multicast Listener Discovery MRD: Multicast Router Discovery ICMPv6 IPv6
13 ICMPv6 Protocols Router Discovery Who s a Router? I m a Router!
14 New Protocols New Protocol Vulnerabilities (Same Tactics)
15 NDP Router Discovery Who s a Router? I m a Router!
16 NDP Router Discovery Who s a Router? I m a Router!
17 NDP Router Discovery Who s got 3ffe::1? That s me!
18 NDP NDP Spoofing is the New ARP Spoofing Who s got 3ffe::1? That s me!
19 ICMPv6 Protocols Duplicate Address Detection Does anyone have 3ffe::45?
20 ICMPv6 Protocols Router Discovery Does anyone have 3ffe::45? I do! Does anyone have 3ffe::46? I do!
21 ICMPv6 Protocols Duplicate Address Detection Who s a Router? I m a Router!
22 Extension Headers Pain in the Firewall
23 IPv6 Packet Format Version Traffic Class Flow Label Payload Length Next Header Hop Limit Source Address Destination Address Data
24 IPv6 Packet Format Version Traffic Class Flow Label Payload Length Next Header Hop Limit Source Address Destination Address Next Header Extension Length Options / Padding Options / Padding Data
25 Extension Headers + Fragmentation IPv6 Header Hop By Hop Routing Fragment 1 Fragmentation Header TCP Data Fragment 2
26 Stateless Filtering is Impossible IPv6 Header Hop By Hop Routing Fragment 1 Fragmentation Header TCP Data Fragment 2
27 Translation & Transition Mechanisms They re Such Nice Guys.
28 Translation & Transition Transition Translation IPv6 Island IPv4 Internet IPv6 Island IPv6 < - - > IPv4
29 Transition 6to4 IPv6 Island to IPv4 Network to IPv6 Island Relies on Nice people to run border routers 6rd or IPv6 Rapid Deployment Teredo ISATAP 6to4 but instead of nice people, it s an ISP running it, applicable only to their customers Host supporting IPv6 sits on an IPv4 Network Magic NAT- punching IPv6 in- IPv4 to a Teredo Service Provider (Can be open, can be paid) Allows an IPv6 Server to sit in an IPv4 Network Host supporting IPv6 sits on an IPv4 Network Can talk to IPv6 Internet, but not the reverse IPv6
30 Translation NAT- PT NAT64 Old, Deprecated IPv4 or 6 Clients to IPv6 or 4 Servers Has External IPv4 addresses for Internal IPv6 Servers Breaks a lot of stuff IPv6 Clients to IPv4 Servers Fakes a IPv6 Address for the IPv4 Server I talk to the NAT64 device, it forwards to IPv4
31 And More Time Limits =(
32 IPv6 Enumeration Mechanisms Internet- Based MAC Address Guessing using OUI Bits Sequential Address (DHCPv6 or Sysadmin) 8-16 bits Reverse Mapping ip6.arpa Very Efficient Limited to Local Network Multicast Echo nmap 0 Bits ICMPv6 Parameter Problem nmap 0 Bits Multicast Listener Discovery nmap 0 Bits SLAAC Fake- out nmap 0 Bits
33 Remember to Remove the Things We re Actually Talking About Multicast! Listener Discovery Listener Enumeration Router Discovery Router Enumeration Node Querying UDP/TCP Checksum Calculation Transition Mechanisms 6to4 6rd 4rd Teredo ISATAP 6in4 6over4 Address Autoconfirguarion SLAAC Neighbor Discovery Protocol Duplicate Address Detection Router, DHCP, and DNS Discovery Redirection SeND New Features in DHCPv6
34 DNS(SEC)
35 DNSSEC Chain att.com?
36 DNSSEC Chain ICANN att.com?
37 DNSSEC Chain ICANN?.com Verisign att.com?
38 DNSSEC Chain ICANN.com Verisign att.com?
39 DNSSEC Chain ICANN.com Verisign att.com
40 Everything Is Signed $ dig +dnssec nic.cz +short A nic.cz. IWGHqGORGO0jh4UuZnwx1P2qoCGYDOcHLhJBIQVJm h6+0fskr6sh2dgj E6BHQJQJ9HuzSDCHOvJkH98QkK4ZUgMCLSN5DHuVc mj/j/g5vmjews3i NmLQVmcvpizwfYVo7cuCg1OteazB2QH7JRp+/KhR+Q +P8tNpDZKe2kEN VMQ=
41 Everything Is Signed $ dig +dnssec nic.cz ;; ANSWER SECTION: nic.cz IN A nic.cz IN RRSIG A nic.cz. IWGHqGORGO0jh4UuZnwx1P2qoCGYDOcHLhJBIQVJmh6+0Fskr6Sh2dgj E6BHQJQJ9HuzSDCHOvJkH98QkK4ZUgMCLSN5DHuVcmJ/J/ g5vmjews3i NmLQVmcvpizwfYVo7cuCg1OteazB2QH7JRp+/KhR+Q+P8tNpDZKe2kEN VMQ= ;; AUTHORITY SECTION: nic.cz IN NS a.ns.nic.cz. nic.cz IN NS b.ns.nic.cz. nic.cz IN NS d.ns.nic.cz. nic.cz IN RRSIG NS nic.cz. aawmfodbeahet6nxuaiu82wwil+9jmmh+evbx4jds5viydnsv/lb+hlr dezlvgbosg5vdgkz2y7cx8fgf8w9/9u1fiovowffp0donz5zgas9dnxm CzHV0+1LiiY0KKSUvPHq9y+thOOwfgkwkFEiofvvRtck1rh8fGfZCFL8 4JY= ;; ADDITIONAL SECTION: a.ns.nic.cz IN A b.ns.nic.cz IN A d.ns.nic.cz IN A a.ns.nic.cz IN AAAA 2001:678:f::1 b.ns.nic.cz IN AAAA 2001:678:10::1 d.ns.nic.cz IN AAAA 2001:678:1::1 a.ns.nic.cz IN RRSIG A nic.cz. Aj/zemlwTy2FM8+XDZPlDSKhcoKtKSSySugtqrQ8YZx/nOe7i3l/4H3D XW7cQO/ND1lpW5VR +1RLbsQuovhAcQRtJj47WTkxYwWa4GdWH327aNn2 aklcdcoz6f8bgqz2af9egqizy+0rk22fiqzc2qlpnouki0hfc0a6op82 9/E= b.ns.nic.cz IN RRSIG A nic.cz. XZVf0rEBg1R1j1KHGXt/2lx76s5EbBqfe9a2tU3eyO0MnudsKiPu1VM4 +cbligvduszmhoax7i/qhalaata98cuckiqkiwsvvg9kqewv+ommrze3 01xjVd6KNGq77jDyEVz2l6yiTIt/8U7KHDtM3haUXITeyUGJZcJvZ3Ta IOc= d.ns.nic.cz IN RRSIG A nic.cz. nfn5nwmibodvqyurwwdolliqbewr0hsh+6ojdgrnscpggxiwr9vdeahm XFWehN/uVa6a +TpwJgnJFYkPzDVrVaFxTGdgNqqTFNcVtwLupbvc6Qq0 Nh6/0yKxbFEkK7n4R0m9Akwnr0BXVkdkpwy3xvZZGlMvfJMq/AKESqlD t3a= a.ns.nic.cz IN RRSIG AAAA nic.cz. ghupnuas+8f08ofpuczg3/p+doqqrdtyhozvh8toyecfqstu3+yip7hb +O9hStK2RASMLi8lonzASZ2YbQRPZXmoBN +zeazi6s3pif3efx7v388a UMowRyTyeh1qvf7fHn0llHDc2K1L4TZ5ZFuUg2PVNBaqcSSdI1mLDHsX AUM= b.ns.nic.cz IN RRSIG AAAA nic.cz. MxlTDSe0Dkfyzbf9qdDj0Cs0oWrMpzkRsN8g4mfi1uWMuYlHTdUuu9d/ ec27we65x5b/ SJJ6+Lb40A030BuuzJyvpuPNvpXh1fFCLZuvNuFPbhs9 MbptJmuEKjutraaA8jnxgK1KLT4kB+Nekf2IrwSC3oxAoyn5wXZJF0Fu /6o= d.ns.nic.cz IN RRSIG AAAA nic.cz. AIRg88oIb4AR1QYeu5J0VBd6pjgeHI8vWAvJzy7m7O6Mmpn+KldrHu4M gz7voypwzk8qnsve/ ldm7gz3verbvvprcwsvzazctb8h2wo1vxpx9tva GQLo2yPTtX9gUqNBMRr/xS7CwyJLVNy3ZJTrQ3G8HyYOyRUVf/SubxPr sri=
42 Everything Is Signed Where is att.com? RRSIG( isecpartners.com, ATT- Key ZSK ) What are ATT s Keys? Zone Signing Key AE363FF13468D83.. Key Signing Key 563ADF RRSIG(.., ATT- Key KSK ) Can I trust ATT- Key KSK? RRSIG( ATT- Key KSK Fingerprint,.com- Key ZSK )
43 Signatures Are Large DNS UDP Limit is 512 EDNS UDP Limit is 4096 DNS TCP has no limit 24 Residential and SOHO routers were tested 18 of 24 Devices tested couldn t support EDNS 23 of 24 Devices tested couldn t support TCP en.pdf
44 Everything Is Signed - Including No s Where is doesntexist.att.com? There is no doesntexist.att.com RRSIG( There is no doesntexist.att.com, ATT- Key ZSK )
45 Denial of Service Where is doesntexist1.att.com? There is no doesntexist1.att.com RRSIG( There is no doesntexist1.att, ATT- Key ZSK ) Where is doesntexist2.att.com? There is no doesntexist2.att.com RRSIG( There is no doesntexist2.att, ATT- Key ZSK ) Where is doesntexist3.att.com? There is no doesntexist3.att.com RRSIG( There is no doesntexist3.att, ATT- Key ZSK )
46 Sign a Single Response? Where is doesntexist.att.com? No Record RRSIG( No Record, ATT- Key ZSK )
47 Man in the Middle att.com Doesntexist.att.com RRSIG( No Record ) RRSIG( No Record )
48 Sign The Ranges Where is doesntexist.att.com? There is nothing between admin.att.com and keyserver.att.com RRSIG( There is nothing between, ATT- Key ZSK ) Called NSEC
49 Sign The Ranges Where is doesntexist.att.com? There is nothing between admin.att.com and keyserver.att.com RRSIG( There is nothing between, ATT- Key ZSK )
50 Hash, then Sign The Ranges Where is doesntexist.att.com? doesntexist.att.com - > hash it - > da There is nothing between a and ff RRSIG( There is nothing between, ATT- Key ZSK ) Called NSEC3!
51 Put It In DNSSEC
52 Shoving Stuff in DNSSEC Example.com?
53 Shoving Stuff in DNSSEC Example.com?
54 Shoving Stuff in DNSSEC Example.com? Example.com? What s your SSL Certificate? ,
55 Shoving Stuff in DNSSEC Example.com? What s your SSL Certificate? , ClientHello ServerHello, Certificate, ServerHelloDone
56 Shoving Stuff in DNSSEC =
57 Bootstrapping Security
58 SSL Certs (DANE) Product Update Checks
59 SSL Certs (DANE) Product Update Checks SSH ssh - o "VerifyHostKeyDNS yes RFC 4255 OpenPGP gpg - - auto- key- locate pka S/MIME draft- hoffman- dane- smime- 01.txt
60 DPF Crazy Awesome
61 gtlds.com.org.net.biz.museum.coop.whatever.you.like
62
63
64 .bugatti
65 A Little History Jon Postel basically used to run the Internet by himself ICANN was charted in 1998 to: Diversify management of the Internet Introduce democratic, multi- stakeholder model Preempt UN Action
66 Where ICANN Ended Up
67 Where ICANN Ended Up
68 Where ICANN Ended Up
69 Batching What would you do?
70 When(performing(these(tests,(we(recommend(the(following:( Set(your(computer(time(to(UTC(to(match(the(time(zone(of(the(batching(server( When(you(click(on(the(Generate(button(during(the(test,(make(note(of(the(exact(time( you(clicked(the(button.((you(can(compare(that(time(to(the(time(that(appears(on(the( subsequent(confirmation(screen(to(identify(any(time(variances.( (( Click(on(the(Click!Here!to!Run!a!Test(link.(A(screen(will(appear(that(will(ask(you(to(set(your( target(time(using(the(dropdowns(below.((( Batching What ICANN Decided ( Batching(System(User(Guide( 7(June(2012(( ( ( ( Select(a(target(time(a(minute(or(two(after(the(current(server(time,(then(click(the(Next( button.((( ( Version(1.1(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( ( 9( (
71 Batching Our Response
72 Competition and Public Interest
73 Competition and Public Interest
74 Internationalized ممثثاالل.ا إخختتبباارر//: http 例 子. 測 試 דוגמה.טעסט//: http
75 A word you will hear often Homograph! xn- - fsqu00a.xn g8w231d xn- - fsqu00a.xn- - g6w251d
76 PunyCode ممثثاالل.ا إخختتبباارر//: http xn- - mgbh0.xn- - kgbechtv 例 子. 測 試 xn- - fsqu00a.xn- - g6w251d xn- - e1afmkfd.xn- - 80akhbyknj4f דוגמה.טעסט//: http xn- - fdbk5d8ap9b8a8d.xn- - deba0ad
77 Top Level Websites Supposed to be outlawed How do you represent them AC has address AI has address BT has address CM has address DK has address GG has address
78 Thank You Alex Stamos Tom Ritter
Security of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
IPv6 Trace Analysis using Wireshark Nalini Elkins, CEO Inside Products, Inc. Nalini.elkins@insidethestack.com
1 IPv6 Trace Analysis using Wireshark Nalini Elkins, CEO Inside Products, Inc. Nalini.elkins@insidethestack.com Agenda What has not changed between IPv4 and IPv6 traces What has changed between IPv4 and
CIRA s experience in deploying IPv6
CIRA s experience in deploying IPv6 Canadian Internet Registration Authority (CIRA) Jacques Latour Director, Information Technology Ottawa, April 29, 2011 1 About CIRA The Registry that operates the Country
Firewalls und IPv6 worauf Sie achten müssen!
Firewalls und IPv6 worauf Sie achten müssen! Pascal Raemy CTO Asecus AG pascal.raemy@asecus.ch Asecus AG Asecus AG Security (Firewall, Web-Gateway, Mail-Gateway) Application Delivery (F5 Neworks with BIGIP)
Use Domain Name System and IP Version 6
Use Domain Name System and IP Version 6 What You Will Learn The introduction of IP Version 6 (IPv6) into an enterprise environment requires some changes both in the provisioned Domain Name System (DNS)
Vulnerabili3es and A7acks
IPv6 Security Vulnerabili3es and A7acks Inherent vulnerabili3es Less experience working with IPv6 New protocol stack implementa3ons Security devices such as Firewalls and IDSs have less support for IPv6
About the Technical Reviewers
About the Author p. xiii About the Technical Reviewers p. xv Acknowledgments p. xvii Introduction p. xix IPv6 p. 1 IPv6-Why? p. 1 IPv6 Benefits p. 2 More Address Space p. 2 Innovation p. 3 Stateless Autoconfiguration
IPv6 Associated Protocols
IPv6 Associated Protocols 1 New Protocols (1) New features are specified in IPv6 Protocol -RFC 2460 DS Neighbor Discovery (NDP) -RFC 4861 DS Auto-configuration : Stateless Address Auto-configuration -RFC
ProCurve Networking IPv6 The Next Generation of Networking
ProCurve Networking The Next Generation of Networking Introduction... 2 Benefits from... 2 The Protocol... 3 Technology Features and Benefits... 4 Larger number of addresses... 4 End-to-end connectivity...
Personal Firewall Default Rules and Components
Personal Firewall Default Rules and Components The Barracuda Personal Firewall comes with a default access ruleset. The following tables aim to give you a compact overview of the default rules and their
INLICHTINGEN DIENSTEN INLICHTINGEN DIENSTEN
Indien u hergebruik wenst te maken van de inhoud van deze presentatie, vragen wij u in het kader van auteursrechtelijke bescherming de juiste bronvermelding toe te passen. 17 juni 2014 De Reehorst in Ede
Recent advances in IPv6 insecurities Marc van Hauser Heuse Deepsec 2010, Vienna. 2010 Marc Heuse <mh@mh-sec.de>
Recent advances in IPv6 insecurities Marc van Hauser Heuse Deepsec 2010, Vienna 2010 Marc Heuse Hello, my name is The future is here already Let s start with the basics IPv4 4 octets 4.294.967.296
Discovering IPv6 with Wireshark. presented by Rolf Leutert
Discovering IPv6 with Wireshark presented by Rolf Leutert Instructor: Rolf Leutert, Network Expert & Trainer Leutert NetServices Troubleshooting & Trainings Zürich-Airport, Switzerland Sniffer certified
IPv6 SECURITY. May 2011. The Government of the Hong Kong Special Administrative Region
IPv6 SECURITY May 2011 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the express
Getting started with IPv6 on Linux
Getting started with IPv6 on Linux Jake Edge LWN.net jake@lwn.net LinuxCon North America 19 August 2011 History and Motivation IPng project July 1994 IPv6 - RFC 2460 December 1998 IPv5 - Internet Stream
IPv6 Fundamentals: A Straightforward Approach
IPv6 Fundamentals: A Straightforward Approach to Understanding IPv6 Rick Graziani Cisco Press 800 East 96th Street Indianapolis, IN 46240 IPv6 Fundamentals Contents Introduction xvi Part I: Background
Guide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP
Guide to Network Defense and Countermeasures Third Edition Chapter 2 TCP/IP Objectives Explain the fundamentals of TCP/IP networking Describe IPv4 packet structure and explain packet fragmentation Describe
Securing IPv6. What Students Will Learn:
Securing IPv6 When it comes to IPv6, one of the more contentious issues is IT security. Uninformed analysts, anit-v6 pundits, and security ne're-do-wells have created a mythos that IPv6 is inherently less
SECURITY IN AN IPv6 WORLD MYTH & REALITY. SANOG XXIII Thimphu, Bhutan 14 January 2014 Chris Grundemann
SECURITY IN AN IPv6 WORLD MYTH & REALITY SANOG XXIII Thimphu, Bhutan 14 January 2014 Chris Grundemann WHO AM I? DO Director @ Internet Society CO ISOC Founding Chair NANOG PC RMv6TF Board NANOG-BCOP Founder
Introduction to IP v6
IP v 1-3: defined and replaced Introduction to IP v6 IP v4 - current version; 20 years old IP v5 - streams protocol IP v6 - replacement for IP v4 During developments it was called IPng - Next Generation
Review: Lecture 1 - Internet History
Review: Lecture 1 - Internet History late 60's ARPANET, NCP 1977 first internet 1980's The Internet collection of networks communicating using the TCP/IP protocols 1 Review: Lecture 1 - Administration
Joe Davies. Principal Writer Windows Server Information Experience. Presented at: Seattle Windows Networking User Group June 1, 2011
Joe Davies Principal Writer Windows Server Information Experience Presented at: Seattle Windows Networking User Group June 1, 2011 2011 Microsoft Corporation IPv6 addressing and DNS review IPv6 subnetting
IPv6 Hardening Guide for Windows Servers
IPv6 Hardening Guide for Windows Servers How to Securely Configure Windows Servers to Prevent IPv6-related Attacks Version: 1.0 Date: 22/12/2014 Classification: Public Author(s): Antonios Atlasis TABLE
DNS at NLnet Labs. Matthijs Mekking
DNS at NLnet Labs Matthijs Mekking Topics NLnet Labs DNS DNSSEC Recent events NLnet Internet Provider until 1997 The first internet backbone in Holland Funding research and software projects that aid the
IPv6 Network Security. its-security@lsu.edu
IPv6 Network Security its-security@lsu.edu IPv6 Raising awareness about IPv6 IPv6 Basics Windows notes Windows Firewall Demo Linux(RHEL) Firewall Demo [Mac OS 10.7 Lion Firewall Notes] [AAAA record via
Types of IPv4 addresses in Internet
Types of IPv4 addresses in Internet PA (Provider Aggregatable): Blocks of addresses that may be sub-assigned to other ISPs or to other companies that also may leased the addresses to their customers May
Lab 2. CS-335a. Fall 2012 Computer Science Department. Manolis Surligas surligas@csd.uoc.gr
Lab 2 CS-335a Fall 2012 Computer Science Department Manolis Surligas surligas@csd.uoc.gr 1 Summary At this lab we will cover: Basics of Transport Layer (TCP, UDP) Broadcast ARP DNS More Wireshark filters
Security Assessment of Neighbor Discovery for IPv6
Security Assessment of Neighbor Discovery for IPv6 Fernando Gont project carried out on behalf of UK Centre for the Protection of National Infrastructure LACNIC XV 15 al 20 de Mayo de 2011. Cancún, México
IPv6 Security ::/0. Poland MUM Warsaw March, 2012 Eng. Wardner Maia Brazil
IPv6 Security ::/0 Poland MUM Warsaw March, 2012 Eng. Wardner Maia Brazil Introduction Name: Wardner Maia Country: Brazil Electronic/Telecommunications Engineer Internet Service Provider since 1995 Training
IPv6 Infrastructure Security
IPv6 Infrastructure Security 2013 North American IPv6 Summit Jeffrey L Carrell Network Conversions Network Security Consultant IPv6 SME/Trainer 1 Agenda IPv6 address fundamentals Operating Systems support
IPv4 and IPv6 Integration. Formation IPv6 Workshop Location, Date
IPv4 and IPv6 Integration Formation IPv6 Workshop Location, Date Agenda Introduction Approaches to deploying IPv6 Standalone (IPv6-only) or alongside IPv4 Phased deployment plans Considerations for IPv4
Windows 7 Resource Kit
Windows 7 Resource Kit Mitch Tulloch, Tony Northrup, and Jerry Honeycutt To learn more about this book, visit Microsoft Learning at http://www.microsoft.com/mspress/books/ 9780735627000 2009 Microsoft
About Me. Work at Jumping Bean. Developer & Trainer Contact Info: Twitter @mxc4 Twitter @jumpingbeansa mark@jumpingbean.co.za
IPv6 & Linux About Me Work at Jumping Bean Developer & Trainer Contact Info: Twitter @mxc4 Twitter @jumpingbeansa mark@jumpingbean.co.za Goals & Motivation Why? Why IPv6? Why this talk? Information on
IPv6 Security Best Practices. Eric Vyncke evyncke@cisco.com Distinguished System Engineer
IPv6 Best Practices Eric Vyncke evyncke@cisco.com Distinguished System Engineer security 2007 Cisco Systems, Inc. All rights reserved. Cisco CPub 1 Agenda Shared Issues by IPv4 and IPv6 Specific Issues
19531 - Telematics. 9th Tutorial - IP Model, IPv6, Routing
19531 - Telematics 9th Tutorial - IP Model, IPv6, Routing Bastian Blywis Department of Mathematics and Computer Science Institute of Computer Science 06. January, 2011 Institute of Computer Science Telematics
IPv6 Security. Scott Hogg, CCIE No. 5133 Eric Vyncke. Cisco Press. Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA
IPv6 Security Scott Hogg, CCIE No. 5133 Eric Vyncke Cisco Press Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA Contents Introduction xix Chapter 1 Introduction to IPv6 Security 3 Reintroduction
Network Security TCP/IP Refresher
Network Security TCP/IP Refresher What you (at least) need to know about networking! Dr. David Barrera Network Security HS 2014 Outline Network Reference Models Local Area Networks Internet Protocol (IP)
OLD VULNERABILITIES IN NEW PROTOCOLS? HEADACHES ABOUT IPV6 FRAGMENTS
OLD VULNERABILITIES IN NEW PROTOCOLS? HEADACHES ABOUT IPV6 FRAGMENTS Eric Vyncke (@evyncke) Cisco Session ID: ARCH W01 Session Classification: Advanced Agenda Status of WorldWide IPv6 Deployment IPv6 refresher:
Dedication Preface 1. The Age of IPv6 1.1 INTRODUCTION 1.2 PROTOCOL STACK 1.3 CONCLUSIONS 2. Protocol Architecture 2.1 INTRODUCTION 2.
Dedication Preface 1. The Age of IPv6 1.1 INTRODUCTION 1.2 PROTOCOL STACK 1.3 CONCLUSIONS 2. Protocol Architecture 2.1 INTRODUCTION 2.2 COMPARISONS OF IP HEADER FORMATS 2.3 EXTENSION HEADERS 2.3.1 Options
Internet Protocol: IP packet headers. vendredi 18 octobre 13
Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)
IP(v6) security. Matěj Grégr. Brno University of Technology, Faculty of Information Technology. Slides adapted from Ing.
IP(v6) security Matěj Grégr Brno University of Technology, Faculty of Information Technology Slides adapted from Ing. Tomáš Podermański What is IP security? Encryption? Authentication? Authorization? Surveillance?
IP addressing and forwarding Network layer
The Internet Network layer Host, router network layer functions: IP addressing and forwarding Network layer Routing protocols path selection RIP, OSPF, BGP Transport layer: TCP, UDP forwarding table IP
Security in IPv6. Basic Security Requirements and Techniques. Confidentiality. Integrity
Basic Security Requirements and Techniques Confidentiality The property that stored or transmitted information cannot be read or altered by an unauthorized party Integrity The property that any alteration
Reverse DNS considerations for IPv6
Reverse DNS considerations for IPv6 Kostas Zorbadelos OTE David Freedman - ClaraNet Reverse DNS in IPv4 Every Internet-reachable host should have a name Make sure your PTR and A records match. For every
IPv6 Security - Opportunities and Challenges
IPv6 Security - Opportunities and Challenges Thomas Scheffler Beuth Hochschule Berlin, Germany {scheffler@beuth-hochschule.de} The Basics Agenda 1 The Basics IPv6 Network Security ICMPv6 / Autoconfiguration
IPv6 Security from point of view firewalls
IPv6 Security from point of view firewalls János Mohácsi 09/June/2004 János Mohácsi, Research Associate, Network Engineer NIIF/HUNGARNET Contents Requirements IPv6 firewall architectures Firewalls and
IPv6 Advantages. www.compaq.com. Yanick Pouffary. Yanick.Pouffary@compaq.com
IPv6 Advantages Yanick Pouffary Yanick.Pouffary@compaq.com IPv6 FORUM A world-wide consortium of leading Internet vendors and Research and Education Networks The IPv6 FORUM mission To promote IPv6 in order
Chapter 9. IP Secure
Chapter 9 IP Secure 1 Network architecture is usually explained as a stack of different layers. Figure 1 explains the OSI (Open System Interconnect) model stack and IP (Internet Protocol) model stack.
The Truth about IPv6 Security
The Truth about IPv6 Security Fernando Gont UTN/FRH FutureNet: MPLS, Ethernet and Beyond Boston, MA, USA, May 10-13, 2010 Agenda Brief comparision of IPv4 and IPv6 A few myths about IPv6 security Transition
IPv6 First Hop Security Protecting Your IPv6 Access Network
IPv6 First Hop Security Protecting Your IPv6 Access Network What You Will Learn This paper provides a brief introduction to common security threats on IPv6 campus access networks and will explain the value
IPv6 Security Nalini Elkins, CEO Inside Products, Inc. nalini.elkins@insidethestack.com
1 IPv6 Security Nalini Elkins, CEO Inside Products, Inc. nalini.elkins@insidethestack.com Agenda Hackers are already aware of the security vulnerabilities in IPv6, and there are implications across all
gianluca.verin verin@libero. @libero.itit Vicenza.linux.it\LinuxCafe 1
gianluca.verin verin@libero. @libero.itit Vicenza.linux.it\LinuxCafe 1 Agenda IPv6 Basics Connecting to 6Bone Why do we need IPv6? IPv6 Introduction-Transition IPv6 and open source community Future applications
Presentation_ID. 2001, Cisco Systems, Inc. All rights reserved.
Presentation_ID 2001, Cisco Systems, Inc. All rights reserved. 1 IPv6 Security Considerations Patrick Grossetete pgrosset@cisco.com Dennis Vogel dvogel@cisco.com 2 Agenda Native security in IPv6 IPv6 challenges
CSE 127: Computer Security. Network Security. Kirill Levchenko
CSE 127: Computer Security Network Security Kirill Levchenko December 4, 2014 Network Security Original TCP/IP design: Trusted network and hosts Hosts and networks administered by mutually trusted parties
8.2 The Internet Protocol
TCP/IP Protocol Suite HTTP SMTP DNS RTP Distributed applications Reliable stream service TCP UDP User datagram service Best-effort connectionless packet transfer Network Interface 1 IP Network Interface
Implementing DHCPv6 on an IPv6 network
Implementing DHCPv6 on an IPv6 network Benjamin Long benlong@iol.unh.edu 8-11-2009 Implementing DHCPv6 on an IPv6 network 2 Table of Contents DHCPv6 Overview...3 Terms used by DHCPv6...3 DHCPv6 Message
ICS 351: Today's plan. IP addresses Network Address Translation Dynamic Host Configuration Protocol Small Office / Home Office configuration
ICS 351: Today's plan IP addresses Network Address Translation Dynamic Host Configuration Protocol Small Office / Home Office configuration IP address exhaustion IPv4 addresses are 32 bits long so there
CS 457 Lecture 19 Global Internet - BGP. Fall 2011
CS 457 Lecture 19 Global Internet - BGP Fall 2011 Decision Process Calculate degree of preference for each route in Adj-RIB-In as follows (apply following steps until one route is left): select route with
Protocol Rollback and Network Security
CSE 484 / CSE M 584 (Spring 2012) Protocol Rollback and Network Security Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee,
IPv6.marceln.org. marcel.nijenhof@proxy.nl
IPv6.marceln.org marcel.nijenhof@proxy.nl RFC 1606 RFC 1606 A Historical Perspective On The Usage Of IP Version 9 1 April 1994, J. Onions Introduction The take-up of the network protocol TCP/IPv9 has been
Technology Brief IPv6 White Paper.
Technology Brief White Paper. Page 1 of 37 Table of Contents 1 Overview... 3 1.1 Background... 3 1.2 Advantages of... 5 2 Packet... 9 2.1 Basic Header... 9 2.1.1 Extension Headers... 11 2.1.2 ICMP Packet...
Tomás P. de Miguel DIT-UPM. dit UPM
Tomás P. de Miguel DIT- 15 12 Internet Mobile Market Phone.com 15 12 in Millions 9 6 3 9 6 3 0 1996 1997 1998 1999 2000 2001 0 Wireless Internet E-mail subscribers 2 (January 2001) Mobility The ability
TCP/IP Network Essentials. Linux System Administration and IP Services
TCP/IP Network Essentials Linux System Administration and IP Services Layers Complex problems can be solved using the common divide and conquer principle. In this case the internals of the Internet are
CloudEngine Series Switches. IPv6 Technical White Paper. Issue 01 Date 2014-02-19 HUAWEI TECHNOLOGIES CO., LTD.
Issue 01 Date 2014-02-19 HUAWEI TECHNOLOGIES CO., LTD. 2014. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of
Chapter 12 Supporting Network Address Translation (NAT)
[Previous] [Next] Chapter 12 Supporting Network Address Translation (NAT) About This Chapter Network address translation (NAT) is a protocol that allows a network with private addresses to access information
IPv6 en Windows. Juan Jackson Pablo García
IPv6 en Windows Ignacio Cattivelli Juan Jackson Pablo García Dual lstack Architecture t Application Layer TCP/UDP TCP/UDP Tcpip6.sys Tcpip.sys IPv6 IPv4 Network Interface Layer In Windows XP and Windows
IETF IPv6 Request for Comments (RFCs) Updated 2008-12-01
IETF IPv6 Request for Comments (RFCs) Updated 2008-12-01 RFC Title 5380 Hierarchical Mobile IPv6 (HMIPv6) Mobility Management 5350 IANA Considerations for the IPv4 and IPv6 Router Alert Options 5340 OSPF
3.5 IPv6 Forum Certified Security Course, Engineer, Trainer & Certification (GOLD)
3.5 IPv6 Forum Certified Security Course, Engineer, Trainer & Certification (GOLD) The IPv6 Forum Certified Security Program (Security Course, Security Engineer, Security Trainer and Security Degree Exams
A Sampling of Internetwork Security Issues Involving IPv6
A Sampling of Internetwork Security Issues Involving IPv6 John Kristoff jtk@cymru.com FIRST 2013 John Kristoff Team Cymru 1 Agenda diff -u ipv4 ipv6 head What is the netsec community working on? How do
Linux as an IPv6 dual stack Firewall
Linux as an IPv6 dual stack Firewall Presented By: Stuart Sheldon stu@actusa.net http://www.actusa.net http://www.stuartsheldon.org IPv6 2001:0DB8:0000:0000:021C:C0FF:FEE2:888A Address format: Eight 16
Exam 1 Review Questions
CSE 473 Introduction to Computer Networks Exam 1 Review Questions Jon Turner 10/2013 1. A user in St. Louis, connected to the internet via a 20 Mb/s (b=bits) connection retrieves a 250 KB (B=bytes) web
Introduction to IPv6 and Benefits of IPv6
Introduction to IPv6 and Benefits of IPv6 Ammar Yasir Korkusuz 2012 Bogazici University, Electrical-Electronics Engineering Department MSc. Student EE 545 TERM PROJECT Abstract: IPv6 is a new internet
2. IP Networks, IP Hosts and IP Ports
1. Introduction to IP... 1 2. IP Networks, IP Hosts and IP Ports... 1 3. IP Packet Structure... 2 4. IP Address Structure... 2 Network Portion... 2 Host Portion... 3 Global vs. Private IP Addresses...3
IP Addressing. IP Addresses. Introductory material.
IP Addressing Introductory material. An entire module devoted to IP addresses. IP Addresses Structure of an IP address Classful IP addresses Limitations and problems with classful IP addresses Subnetting
Internetworking. Problem: There is more than one network (heterogeneity & scale)
Internetworking Problem: There is more than one network (heterogeneity & scale) Hongwei Zhang http://www.cs.wayne.edu/~hzhang Internetworking: Internet Protocol (IP) Routing and scalability Group Communication
About Firewall Protection
1. This guide describes how to configure basic firewall rules in the UTM to protect your network. The firewall then can provide secure, encrypted communications between your local network and a remote
EVALUATING STANDARD AND CUSTOM APPLICATIONS IN IPV6 WITHIN A SIMULATION FRAMEWORK. Brittany Michelle Clore
EVALUATING STANDARD AND CUSTOM APPLICATIONS IN IPV6 WITHIN A SIMULATION FRAMEWORK Brittany Michelle Clore Thesis submitted to the faculty of the Virginia Polytechnic Institute and State University in partial
IPV6 DEPLOYMENT GUIDELINES FOR. ARRIS Group, Inc.
IPV6 DEPLOYMENT GUIDELINES FOR CABLE OPERATORS Patricio i S. Latini i ARRIS Group, Inc. Current IPv4 Situationti IANA has already assigned the last IPv4 Blocks to the RIRs. RIRs address exhaustion may
IPv6 Infrastructure Security Jeffrey L Carrell Network Conversions Network Security Consultant, IPv6 SME/Trainer
IPv6 Infrastructure Security Jeffrey L Carrell Network Conversions Network Security Consultant, IPv6 SME/Trainer 1 IPv6 Infrastructure Security v1.1 - Copyright 2013 Jeffrey L. Carrell Agenda IPv6 address
IPv6 Infrastructure Security
TXv6TF 2013 Summit IPv6 Infrastructure Security Jeffrey L Carrell Network Conversions Network Security Consultant IPv6 SME/Trainer 1 Agenda IPv6 address fundamentals Operating Systems support ICMPv6 -
IPv6 Functionality. Jeff Doyle IPv6 Solutions Manager jeff@juniper.net
IPv6 Functionality Jeff Doyle IPv6 Solutions Manager jeff@juniper.net Copyright 2003 Juniper Networks, Inc. Agenda ICMPv6 Neighbor discovery Autoconfiguration Agenda ICMPv6 Neighbor discovery Autoconfiguration
Securing the Transition Mechanisms
Securing the Transition Mechanisms CRC/ITU/APNIC IPv6 Security Workshop 29 th June 1 st July 2015 Ulaanbaatar Last updated 13 July 2014 1 Where did we leave off? p We ve just covered the current strategies
GregSowell.com. Mikrotik Security
Mikrotik Security IP -> Services Disable unused services Set Available From for appropriate hosts Secure protocols are preferred (Winbox/SSH) IP -> Neighbors Disable Discovery Interfaces where not necessary.
IPV6 FRAGMENTATION. The Case For Deprecation. Ron Bonica NANOG58
IPV6 FRAGMENTATION The Case For Deprecation Ron Bonica NANOG58 BACKGROUND 2 Copyright 2013 Juniper Networks, Inc. www.juniper.net STATUS QUO In order to send a packet larger than the PMTU, an IPv6 node
Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology
SAST01 An Introduction to Information Security Part 5 DNS Security Martin Hell Department of Electrical and Information Technology How DNS works Amplification attacks Cache poisoning attacks DNSSEC 1 2
Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.
Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols
IP Addressing Introductory material.
IP Addressing Introductory material. A module devoted to IP addresses. Addresses & Names Hardware (Layer 2) Lowest level Ethernet (MAC), Serial point-to-point,.. Network (Layer 3) IP IPX, SNA, others Transport
IP address format: Dotted decimal notation: 10000000 00001011 00000011 00011111 128.11.3.31
IP address format: 7 24 Class A 0 Network ID Host ID 14 16 Class B 1 0 Network ID Host ID 21 8 Class C 1 1 0 Network ID Host ID 28 Class D 1 1 1 0 Multicast Address Dotted decimal notation: 10000000 00001011
IPv6 Basics Share Anaheim Session 14497
IPv6 Basics Share Anaheim Session 14497 Laura Knapp WW Business Consultant Laurak@aesclever.com ipv6hawaii@outlook.com 03/07/2014 Applied Expert Systems, Inc. 2014 1 What is IPv6 Updated version of the
Security with IPv6 Explored. U.S. IPv6 Summit 20032. Renée e Esposito Booz Allen Hamilton Richard Graveman RFG Security
Security with IPv6 Explored U.S. IPv6 Summit 20032 December 8-11, 8 2003 Renée e Esposito Booz Allen Hamilton Richard Graveman RFG Security IPv6 Security: Outline 1 Internet Security 2 IPv6: Core Protocols
A Very Incomplete Diagram of Network Attacks
A Very Incomplete Diagram of Network Attacks TCP/IP Stack Reconnaissance Spoofing Tamper DoS Internet Transport Application HTTP SMTP DNS TCP UDP IP ICMP Network/Link 1) HTML/JS files 2)Banner Grabbing
IPv6 Security Assessment and Benchmarking Abstract Test Suite
IPv6 Security Assessment and Benchmarking Abstract Test Suite Version 1.0 2013-01-22 EANTC AG Copyright (C) 2012, 2013 EANTC European Advanced Networking Test Center Aktiengesellschaft This document is
12/8/2015. Review. Final Exam. Network Basics. Network Basics. Network Basics. Network Basics. 12/10/2015 Thursday 5:30~6:30pm Science S-3-028
Review Final Exam 12/10/2015 Thursday 5:30~6:30pm Science S-3-028 IT443 Network Security Administration Instructor: Bo Sheng True/false Multiple choices Descriptive questions 1 2 Network Layers Application
Migrating to IPv6 Opportunity or threat for network security?
Migrating to IPv6 Opportunity or threat for network security? Executive summary Contents 02 Executive summary 03 1. Introduction 03 2. IPv6 security check 03 2.1 Addresses 04 2.2 NAT free operation 05
Internet Protocol Version 6 (IPv6)
Internet Protocol Version 6 (IPv6) Raj Jain Washington University Saint Louis, MO 63131 Jain@cse.wustl.edu These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 14-1 Overview
Network layer: Overview. Network layer functions IP Routing and forwarding
Network layer: Overview Network layer functions IP Routing and forwarding 1 Network layer functions Transport packet from sending to receiving hosts Network layer protocols in every host, router application
Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce. Domain Name System
Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce 18/02/15 Networks: DNS attacks 1 Domain Name System The domain name system (DNS) is an applica>on- layer protocol
Learn About Differences in Addressing Between IPv4 and IPv6
> Learn About Differences in Addressing Between IPv4 and IPv6 IPv6 is the most recent generation of the Internet Protocol (IP) defined by the Internet Engineering Task Force (IETF). Initially defined in
Recent Advances in IPv6 Security. Fernando Gont
Recent Advances in IPv6 Security Fernando Gont About... Security researcher and consultant at SI6 Networks Have worked on security assessment on communications protocols for: UK NISCC (National Infrastructure
Internet Protocol (IP) IP - Network Layer. IP Routing. Advantages of Connectionless. CSCE 515: Computer Network Programming ------ IP routing
Process Process Process Layer CSCE 515: Computer Network Programming ------ IP routing Wenyuan Xu ICMP, AP & AP TCP IP UDP Transport Layer Network Layer Department of Computer Science and Engineering University