In the previous parts of this series
(part 1,
part 2,
part 3,
part 4)
we covered several aspects of IPv6 security, mainly on the infrastructure level.
In today’s post I will follow up by briefly discussing so-called First Hop
Security features.
IPv6 First Hop Security (“IPv6 FHS”) is a collection of features (initially
implemented, and named, by Cisco but available on other platforms too) that can
be found on many access layer switches to prevent different attacks in IPv6
networks. The availability of those features is sometimes divided into three
phases and started in 2010 with the release of IOS images containing mainly RA
Guard (see below) and port-based IPv6 ACLs. Phase two was released in early
2012 and contained some more features (namely from the “IPv6 Snooping”
framework) whereas phase three was released at the end of 2012 and contained
some more advanced features (e.g. IPv6 Source Guard). Nowadays usually “phase
one” features are supported on many platforms, at least on physical ones
(support on virtual switches is still somewhat lacking).
There’s
an excellent Cisco FHS Wiki maintained by
Andrew Yourtchenko,
Scott Hogg wrote a
good overview,
as
did Ivan Pepelnjak,
and
this is a nice presentation
on some elements by Jim Small from 2013. Still, from our perspective the main
question is: which of those features should be deployed in production
networks/can be observed in real-life enterprise networks. Actually it’s only
two:
Niklaus and me had the chance to talk about our research on RedStar OS on the
32nd Chaos Communication Congress in Hamburg this year. You can see the talk
online at
media.ccc.de
or on Youtube.
We talked about the details of the watermarking mechanism that
we found in July
and additional features of RedStar OS like it’s “Virus Scanner” and the system
architecture. During the days after our talk we were able to find watermarks
applied by RedStar OS in the wild on some sites on the Internet. We can confirm
at least 7 different instances of RedStar OS that have applied watermarks to
JPGs. Cleaning up the data is work in progress and we will get back to you with
the results! Niklaus has put our presentation and additional resources in the
git. Feel free to join us in our
research and make the world a safer place!
Rafael Schaefer: Advanced IPv6 Attacks Using Chiron. Hands-On Workshop
Outline: During the IPv6 Security Summit at Troopers 14,
Chiron, an all-in-one IPv6 penetration
testing framework was released publicly for first time. Since then, the advanced
features of Chiron were used to discover some 0-day evasion techniques against
high-end commercial and open-source Intrusion Detection / Prevention Systems.
Moreover, for Troopers 15 it was enhanced with new features, like advanced MLD
support and a fake DHCPv6 server, which can be combined with its other features,
like the use of arbitrary Extension Headers and fragmentation to leverage really
advanced attacks.
In this workshop, after a quick refreshing to the basic capabilities of Chiron,
we will focus on the advanced IPv6 functionalities that the framework offers. We
will not only show how to reproduce the latest published IPv6 attacks, but
moreover, how you can create your own arbitrary IPv6 attacking scenarios for
your own security assessments or penetration testing purposes. A lab will be set
up in order not only to reproduce the presented techniques, but to also try your
skills and – why not – to discover your own 0-day techniques :).
As we come to the end of the year we can’t help but take a moment to thank all
of your who made TROOPERS15 special! It just makes us all the more pumped to
kick it up a notch for TROOPERS16!! #BestWeekEver
Happy Holiday and much Joy to you in the New Year!
The BetterCrypto Project started out in the fall of 2013 as a collaborative
community effort by systems engineers, security engineers, developers and
cryptographers to build up a sound set of recommendations for strong
cryptography and privacy enhancing technologies catered towards the operations
community in the face of overarching wiretapping and data-mining by nation-state
actors. The project has since evolved with a lot of positive feedback from the
open source and operations community in general with input from various browser
vendors, linux distribution security teams and researchers.
In this part of our little series
(part 1,
part 2,
part 3)
we continue discussing IPv6 specific filtering of network traffic, namely at
intersection points.
As stated in the 1st part, a number of potential security problems in IPv6
networks are related to Extension Headers of IPv6, in particular when
combined with fragmentation. At the same time, as of today (December 2015) there
is no Internet service or application that actually needs those headers.
Before we dive into the analysis, I wanted to mention that if you are going to
analyze anything unknown/potentially malicious, do it in a safe environment (VM
with no internet connection, in the best case on a separate physical analysis
device, or at least strip all unnecessary functionality from that VM
(CVE-2015-3456 is an example to answer the “why”)). Even things like looking at
content with a text editor or extracting zip files should be done in the safe
environment, as those tools could contain vulnerabilities.
Here at TROOPERS HQ we are well into the Holiday (read TROOPERS) Spirit so we
thought we would publish another round of talks! The current agenda can be
found here.
Happy Holidays!
Your TROOPERS Team
===
2nd Day Keynote FIRST TIME TROOPERS SPEAKER
Bio: Ben Zevenbergen joined the Oxford Internet Institute to pursue a DPhil
on the intersection of privacy law, technology, social science, and the
Internet. He runs a side project that aims to establish ethics guidelines for
Internet research, as well as working in multidisciplinary teams such as the EU
funded Network of Excellence in Internet Science. He has worked on legal,
political and policy aspects of the information society for several years. Most
recently he was a policy advisor to an MEP in the European Parliament, working
on Europe’s Digital Agenda. Previously Ben worked as an ICT/IP lawyer and policy
consultant in the Netherlands. Bendert holds a degree in law, specialising in
Information Law.
As part of my research on the security of paravirtualized devices, I reported a
number of vulnerabilities to the Xen security team, which were patched
today. All of them are double
fetch vulnerabilities affecting the different backend components used for
paravirtualized devices. While the severity and impact of these bugs varies
heavily and is dependent on a lot of external factors, I would recommend
patching them as soon as possible. In the rest of this blog post I’ll give a
short teaser about my research with full details coming out in the first quarter
of 2016 .
So this is the third part of our little series on securing IPv6 in enterprise
environments. In the
first part
we tried to develop an understanding of threats in IPv4 networks as a kind-of
baseline while analyzing the main differences induced by IPv6 and in the
second part
we laid out protection strategies on the infrastructure level, focusing on
network isolation on the routing layer. Today I’ll dive into discussing
IPv6-specific filtering of network traffic.
In this blogpost we will briefly explain a well known Syscall hooking technique
(a more detailed explanation can be gathered from e.g.
http://resources.infosecinstitute.com/hooking-system-service-dispatch-table-ssdt/)
used by multiple malware samples (like the laqma trojan) and right after discuss
how some memory analysis tools have trouble in the analysis and/or reporting of
these.
Before we go further, I just shortly wanted to say, that this post is not
intended to be a bashing of any tool. We have the greatest respect for all the
effort and work which has been and most probably will be done in the future.