IPv6 and its Impact on Network Security and Investigations - High Tech Crime Investigation Association Conference
I'll be presenting an Introduction to IPv6 and its implications on network security and investigations on Monday September 17th at 3:30PM at the High Tech Crime Investigation Association Conference taking place at the Hershey Lodge in Hershey, PA.
My presentation can be found here:
I am working on a python script for IPv6 malicious packet handling. The script requires Scapy which can be downloaded from http://www.secdev.org/projects/scapy/
Be sure you are running at least Scapy (2.2.0-dev) The script was tested on Backtrack 5 R2
Currently the script performs the following tests:
1. Send HbH Header Flood
Test handling of a large number of HbH headers directed at a L3 device. Could DOS a router if there isn't proper policing of packets to the CPU.
2. Send RH0 Packets
Test for the filtering and/or handling of RH0 packets. RH0 packets have been deprecated and shouldn't be accepted.
3. Send Packets with two RH0 Headers
Tests the corner case of two RH0 headers; one after the other.
4. RA deamon killer
Some RA daemons will crash if you send RAs towards them with a spoofed source of themselves with a lifetime of zero
5. RA Flood
Send a flood of RAs with random prefixs. Will DOS Windows and possible other devices.
6. Hide Layer 4 Info for ACL Bypass
Test the handling of ACL and firewall rules with the layer 4 information "hidden" in the second fragment. Some firewalls will pass this since it doesn't find the layer 4 information in the first fragment.
You can download the current version of the script from github: ipv6-test.py
I turned up a 6over4 tunnel to Hurricane Electric with the IPv6 traffic from the tunnel passing through a Cisco ASA firewall. The stability and performance of the HE tunnel have been fantastic. Here is how it is setup:
While the Cisco ASA doesn’t support direct termination of IPv6 tunnels, it does have very rich support for IPv6 firewalling. The approach would be to take another external router which would sit outside of the ASA firewall and use that for tunnel termination. From there, bring the IPv6 inside interface of the router terminating the tunnel and connect that to an ASA interface which only has an IPv6 address.
You will need at least one additional static IP address on your outside network in order for this to work. Many Cable ISPs will offer this if you sign up for business level services usually for a nominal additional fee. It may still work with a dynamic address if it doesn't change all that much.
When you signup with HE they will provide two /64 networks and a /48. The first /64 IPv6 network is for the actual tunnel going from your external tunnel router to the HE tunnel server. The second /64 is for the connection between the inside interface of your tunnel router and the ASA. The final /48 is for internal subnets behind the ASA firewall.
As far as software goes, the ASA should be running software 8.2 or higher while the external IOS router could be running a recent image of 12.4T or Release 15. In my case I am using an 1800 series router running release 15.1.3T Advanced Enterprise.
Cisco ASA Firewall Configuration:
interface Vlan6 description ipv6 to HE Tunnel
no ip address
ipv6 address 2001:DB8:2222::1/64
interface Vlan1 description Internal Protected
ip address 192.168.100.1 255.255.255.0
ipv6 address 2001:DB8:F1F1::1/64
ipv6 nd prefix 2001:DB8:F1F1::/64 43200 43200
!!! The above /64 is taken from the /48 network assigned to you by HE
interface Vlan2 description IPv4
Internet nameif outside
ip address 220.127.116.11 255.255.255.248
route outside 0.0.0.0 0.0.0.0 18.104.22.168
ipv6 route ipv6-tunnel ::/0 2001:DB8:2222::2
Outside Tunnel Router IOS Configuration:
description Hurricane Electric IPv6 Tunnel Broker
no ip address
ip flow ingress
ipv6 address 2001:DB8:1111::2/64
tunnel source 22.214.171.124
tunnel mode ipv6ip
tunnel destination 126.96.36.199
ip address 188.8.131.52 255.255.255.248
ip access-group inbound in
no ip redirects
ip flow ingress
no ip address
ipv6 address 2001:DB8:1111:1/64
ipv6 route 2001:DB8:F1F1::/48 2001:DB8:2222::1
ipv6 route ::/0 Tunnel0
ip access-list extended inbound
permit 41 host 184.108.40.206 host 220.127.116.11
permit tcp any host 18.104.22.168 eq 22
permit udp any eq domain host 22.214.171.124
permit icmp any host 126.96.36.199
Copyright © 2015, Keith O'Brien. All rights reserved.