Vulnerabilities / Threats
4/13/2011
02:20 PM
50%
50%

Windows IPv4 Networks Vulnerable To IPv6 Attack

A man-in-the-middle attack can use the IPv6 protocol to eavesdrop on IPv4 networks, though an attacker would have to physically place a router in the targeted environment for it to work.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
Users of Internet Protocol version 4 (IPv4) networks, beware man-in-the-middle attacks. That's because such networks can be exploited using capabilities built into IPv6, the next-generation standard for expanding the number of addresses for Internet-connected devices.

In particular, someone with malicious intent could "impose a parasitic IPv6 overlay network on top of an IPv4-only network, so that an attacker can carry out man-in-the-middle attacks on IPv4 traffic," said Alec Waters, a security researcher for InfoSec Institute, in a blog post. While his proof-of-concept attack scenario targets Windows 7, it should also work against Windows Vista, Windows 2008 Server, or "any operating system that ships with IPv6 installed and operational by default," he said.

The attack works by introducing an IPv6 router into an IPv4 network, but only connecting the router to the IPv4 Internet. Using router advertising (RA) to create addresses--via a process known as Stateless Address Auto Configuration (SLAAC)--the attacker can control where traffic travels. Next, an attacker can use NAT-PT, "an experimental protocol used to connect IPv6 only networks to the legacy IPv4 network," said Johannes Ullrich, chief research officer for the SANS Institute, in a blog post that analyzes this so-called SLAAC attack.

"By combining the fake RA advertisements with NAT-PT, the attacker has the ability to intercept traffic that would normally use IPv4," he said. "To make things more interesting, if a host has IPv6 and IPv4 connectivity, the IPv6 connection is preferred, causing this attack to work even better."

One mitigating factor, however, is that an attacker would have to physically place a router in the targeted environment--although that could also be a public Wi-Fi hotspot.

This vulnerability was filed with MITRE on April 6, though a Windows fix was absent from this month's mega-Patch Tuesday.

But is this a vulnerability or a feature? In fact, there's a dispute over whether this is a bug at all. According to the MITRE vulnerability listing, "it can be argued that preferring IPv6 complies with [the IPv6 protocol], and that attempting to determine the legitimacy of an RA is currently outside the scope of recommended behavior of host operating systems."

"The severity of the attack is disputed, because this is the default configuration of Windows Vista/7/2008 OSes, and it also follows the RFC recommended implementation of a 'dual stack' (IPv4 and IPv6) network stack," said Jack Koziol, a senior instructor and security program manager at InfoSec Institute, and co-author of The Shellcoder's Handbook: Discovering and Exploiting Security Holes, in an email interview. Regardless of how it's labeled, he said, IPv4 is still "vulnerable to the traffic interception and the SLAAC attack."

The IPv6 story has been a tale of slow adoption. But as IPv4 addresses dwindle, organizations have been urged to increase their adoption of IPv6, for which a standard was developed by the Internet Engineering Task Force (IETF) in 2003. Even the White House has put its muscle behind such a message, releasing a transition tool to emphasize the importance of adopting the newer protocol.

So, how can IPv4-using organizations protect themselves against a SLAAC attack? "IPv6 is a wonderful protocol. But if you don't need it: Turn it off. If you need it, then monitor and defend it like IPv4," said Ullrich.

Interestingly, there's a defense against the SLAAC attack, known as the Secure Neighbor Discovery (SEND) protocol, said Koziol. Except that Microsoft doesn't use SEND in its current products. "It seems after the engineers from Microsoft and Ericsson finished writing the IETF document, they also wrote and filed a patent on the process. So Microsoft has concerns implementing SEND, due to legal concerns with Ericsson," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.