What Security Issues Does IPv6 Pose?
June 8, 2011 is World IPv6 Day but will IPv6 be more or less secure than IPv4? Is the industry ready for it?
Changing from IPv4 to IPv6 means messing with the veins and arteries of the Internet itself. When bridging and transitioning between IPv4 and IPv6, youre not just considering the specific set of security issues associated with either one youre considering the security aspects of both. This greatly increases the potential for attacks many of which will be the result of poor, flaw-ridden implementations or misconfigured systems.
Theres a lot to consider (too much to mention in one sitting) but here are several things that will ring a bell for those familiar with IPv4:
Poor implementation and misconfiguration - When things go wrong, its almost always at the implementation level. Even though many elements of IPv6 will be familiar from IPv4, were going to be treading on an immense amount of new territory, and this lack of experience could do us in, if we dont make strides in education; this is especially crucial for those who will be involved in the configuration process.
Flooding attacks - Due to IPv6s massive address space, it would take years to scan a single IPv6 block, versus seconds for an IPv4 block. You might think that this would prevent flooding attacks, but youd be wrong. Thanks to multicast traffic, which allows you to send a packet to multiple destinations with a single send operation, distributed denial of service (DDoS) attacks, like smurf, are possible.
With a smurf attack, a type of broadcast amplification attack, a victims IP address is used to send an echo-request message with subnet broadcasts destination address, along with a spoofed source address, causing all of the subnets end hosts to respond to the spoofed source address and flood the victim with echo-reply messages.
Dual stack attacks - The Internet is mostly IPv4 based these days, but were going to see an uptick in the number of IPv6 compatible networks. During this lengthy transitioning process, 6to4 stacks will take care of this, by implementing IPv6 and IPv4 separately, or in a hybrid manner, which allows applications to work transparently over both IPv4 and IPv6. However, now youre dealing with two non-interoperable protocols and their specific sets of security issues. This leads to more technical complexity, which will make configuration even harder and more prone to failure.
Spoofing attacks - The modification of a source IP address, as well as the ports on which they are communicating, can be done to make it appear as if traffic originated somewhere else. There are best practice methods for filtering, as in RFC 2827, but this isnt mandatory, which means many ISPs wont implement it.
The use of strong cryptography can thwart these attacks. On the other hand, even though IPSec support is mandatory on IPv6 (whereas it was optional for IPv4) its likely to experience the same hurdles as with IPv4 and not be widely deployed.
Header manipulation and fragmentation - Attacks exploiting header manipulation and fragmentation can do everything from bypass intrusion detection systems (IDS), intrusion prevention systems (IPS) and firewalls, by using out-of-order fragments, or even go after the networks infrastructure itself. Also, in IPv6, you have extension headers, which can be used to get around access control lists (ACL) on routers and firewalls, by causing devices at the end host to process router headers and forward them elsewhere.
Obviously, the concerns above are just a snapshot of what well face when IPv6 sees a wide rollout. Right now, its a game of testing, testing, and more testing.