what you don't know can hurt you
Showing 1 - 25 of 71 RSS Feed

Files from Fernando Gont

Email addressfernando at gont.com.ar
First Active2005-07-23
Last Active2019-03-14
IPv6 Security For IPv4 Engineers
Posted Mar 14, 2019
Authored by Fernando Gont

This document provides an overview of IPv6 security that is specifically aimed at IPv4 engineers and operators. Rather than describing IPv6 in an isolated manner, it aims to re-use as much of the existing IPv4 knowledge and experience as possible. It highlights the security issues that affect both protocols in the same manner, as well as those that are new or different for the IPv6 protocol suite. Additionally, it discusses the security implications arising from the co-existence of the IPv6 and IPv4 protocols.

tags | paper, protocol
SHA-256 | 6299f730e51fc8b49a0c729d3a77152a920e8d27a689dc30f3a33ca697c63524
RFC7359 - Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages In Dual-Stack Hosts/Networks
Posted Aug 27, 2014
Authored by Fernando Gont

The subtle way in which the IPv6 and IPv4 protocols coexist in typical networks, together with the lack of proper IPv6 support in popular Virtual Private Network (VPN) tunnel products, may inadvertently result in VPN tunnel traffic leakages. That is, traffic meant to be transferred over an encrypted and integrity- protected VPN tunnel may leak out of such a tunnel and be sent in the clear on the local network towards the final destination. This document discusses some scenarios in which such VPN tunnel traffic leakages may occur as a result of employing IPv6-unaware VPN software. Additionally, this document offers possible mitigations for this issue.

tags | paper, local, protocol
SHA-256 | fa98023a273f3231dab648bba72fdf7f52dd2a529b75297420d89773222e1c25
IPv6 Extension Headers In The Real World
Posted Aug 22, 2014
Authored by Fernando Gont

This is a draft of IPv6 Extension Headers in the Real World. IPv6 Extension Headers allow for the extension of the IPv6 protocol, and provide support for some core functionality such as IPv6 fragmentation. However, IPv6 Extension Headers are deemed to present a challenge to IPv6 implementations and networks, and are known to be intentionally filtered in some existing IPv6 deployments. This summarizes the issues associated with IPv6 extension headers, and presents real-world data regarding the extent to which packets with IPv6 extension headers are filtered in the public Internet, and where in the network such filtering occurs. Additionally, it provides some guidance to operators in troubleshooting IPv6 blackholes resulting from the use of IPv6 extension headers. Finally, this document provides some advice to protocol designers, and discusses areas where further work might be needed.

tags | paper, protocol
SHA-256 | 4f100808cfb77d0cea54d4c5b190d179c17b9bd141d9d61bb6013c9766d28960
IPv6 Toolkit 1.5.2
Posted Jan 17, 2014
Authored by Fernando Gont | Site si6networks.com

SI6 Networks' IPv6 toolkit is a security assessment and troubleshooting tool for the IPv6 protocols. It can send arbitrary IPv6-based packets.

Changes: Minor issues are addressed.
tags | tool, arbitrary, scanner, protocol
systems | unix
SHA-256 | 299af685fad82f9b373ea0fc9daa53ca62c81b717d9ddeb59f7329ffa2ea8212
Security Assessments Of IPv6 Networks And Firewalls
Posted Jun 16, 2013
Authored by van Hauser, Fernando Gont

These are presentation slides from the German IPv6 Kongress that was held in Frankfurt, Germany in 2013.

tags | paper
SHA-256 | bc707bd82aae4f68dfff095f7eb059d3eff1bb8aae00edc3d6984f3f773c302b
IPv6 Network Reconnaissance: Theory And Practice
Posted Jun 15, 2013
Authored by Fernando Gont

These slides are from an IPv6 reconnaissance presentation given at CONFidence 2013.

tags | paper
SHA-256 | 1c0197c1d3e4ff5a462e99d9c291cb0c37f2ad96066b8709c6893ec713075389
Generating Stable Privacy-Enhanced Addresses With IPv6
Posted Jun 4, 2013
Authored by Fernando Gont | Site ietf.org

This document specifies a method for generating IPv6 Interface Identifiers to be used with IPv6 Stateless Address Autoconfiguration (SLAAC), such that addresses configured using this method are stable within each subnet, but the Interface Identifier changes when hosts move from one network to another. This method is meant to be an alternative to generating Interface Identifiers based on hardware address (e.g., using IEEE identifiers), such that the benefits of stable addresses can be achieved without sacrificing the privacy of users. The method specified in this document applies to all prefixes a host may be employing, including link-local, global, and unique- local addresses.

Changes: Revision 9 of this document.
tags | paper, local
SHA-256 | aea1ddd79e402a7e6cae6940341f56386d8efe61f639f9142e54a9dda4b93d71
Hacking IPv6 Networks
Posted Apr 25, 2013
Authored by Fernando Gont

These are the slides for the "Hacking IPv6 Networks" security training course as given at BRUCON 2012.

tags | paper
SHA-256 | e3087a85f87af2ef63cb6ee55ffaad7558a549d506e6ff8988c95b01399882ad
SI6 Networks' IPv6 Toolkit 1.3.4
Posted Apr 18, 2013
Authored by Fernando Gont

This toolkit houses various IPv6 tools that have been tested to compile and run on Debian GNU/Linux 6.0, FreeBSD 9.0, NetBSD 5.1, OpenBSD 5.0, Mac OS 10.8.0, and Ubuntu 11.10.

Changes: IPv6-host tracking support in the scan6 tool. A new tool, address6, to analyze IPv6 addresses. Minor bug fixes.
tags | tool
systems | linux, netbsd, unix, freebsd, openbsd, debian, ubuntu
SHA-256 | 75ff27cd30407cd57f35a7646b82e6fede9cfc7e1fac089b3da43e547424af48
SI6 Networks' IPv6 Toolkit 1.3.3
Posted Mar 11, 2013
Authored by Fernando Gont

This toolkit houses various IPv6 tools that have been tested to compile and run on Debian GNU/Linux 6.0, FreeBSD 9.0, NetBSD 5.1, OpenBSD 5.0, Mac OS 10.8.0, and Ubuntu 11.10.

Changes: This minor update incorporates the "--tgt-known-iids" option, which can be used to track systems across networks, even if they employ the so-called "Privacy Address" (and yes, that includes Microsoft Windows systems).
tags | tool, scanner
systems | linux, netbsd, unix, freebsd, openbsd, debian, ubuntu
SHA-256 | 8392ec6c2414194f839d154313ea7965a2c6503286828f22860c4c50a635d099
SI6 Networks' IPv6 Toolkit 1.3
Posted Feb 17, 2013
Authored by Fernando Gont

This toolkit houses various IPv6 tools that have been tested to compile and run on Debian GNU/Linux 6.0, FreeBSD 9.0, NetBSD 5.1, OpenBSD 5.0, Mac OS 10.8.0, and Ubuntu 11.10.

Changes: Addition of a full-fledged IPv6 address scanning tool. Includes support for tunnels. Various other additions and updates.
tags | tool, scanner
systems | linux, netbsd, unix, freebsd, openbsd, debian, ubuntu
SHA-256 | 182d3e7b34ea800eae21d5fbf5fd4fa7f13792f27d9a4c5f61947ae0e178a720
Security Implications Of IPv6 Fragmentation With IPv6 Neighbor Discovery Revision 03
Posted Jan 20, 2013
Authored by Fernando Gont | Site ietf.org

IPv6 Extension Headers with Neighbor Discovery messages can be leveraged to circumvent simple local network protections, such as "Router Advertisement Guard". Since there is no legitimate use for IPv6 Extension Headers in Neighbor Discovery messages, and such use greatly complicates network monitoring and simple security mitigations such as RA-Guard, this document proposes that hosts silently ignore Neighbor Discovery messages that use IPv6 Extension Headers.

Changes: Revision 3 of this document.
tags | paper, local
SHA-256 | 88c1519d37583c204027fbdd3ae3a25828b219b714e31c6f02daeaa96b3e1490
DHCPv6-Shield: Protecting Against Rogue DHCPv6 Servers
Posted Jan 19, 2013
Authored by Fernando Gont

This document specifies a mechanism for protecting hosts connected to a broadcast network against rogue DHCPv6 servers. The aforementioned mechanism is based on DHCPv6 packet-filtering at the layer-2 device on which the packets are received. The aforementioned mechanism has been widely deployed in IPv4 networks ('DHCP snooping'), and hence it is desirable that similar functionality be provided for IPv6 networks.

tags | paper
SHA-256 | 46631cfae65fdb6654ab9e329ade0ad4a20f0dd648446b6619a9a7a7b9676a5d
VPN Traffic Leakages In Dual-Stack Hosts/Networks
Posted Jan 19, 2013
Authored by Fernando Gont

The subtle way in which the IPv6 and IPv4 protocols co-exist in typical networks, together with the lack of proper IPv6 support in popular Virtual Private Network (VPN) products, may inadvertently result in VPN traffic leaks. That is, traffic meant to be transferred over a VPN connection may leak out of such connection and be transferred in the clear on the local network. This document discusses some scenarios in which such VPN leakages may occur, either as a side effect of enabling IPv6 on a local network, or as a result of a deliberate attack from a local attacker. Additionally, it discusses possible mitigations for the aforementioned issue.

tags | paper, local, protocol
SHA-256 | 9effe2e0fcf845f3f698a422ede8446c43df6f4d6472aafb96dd9a13c554fe6a
Recommendations On Filtering IPv4 Packets Containing IPv4 Options
Posted Jan 19, 2013
Authored by Fernando Gont

This document document provides advice on the filtering of IPv4 packets based on the IPv4 options they contain. Additionally, it discusses the operational and interoperability implications of dropping packets based on the IP options they contain.

tags | paper
SHA-256 | f955987c95afee36773fb986f0bf5b02f89c6d9a9973c325dcbc1e926676ad9a
Security Implications Of IPv6 On IPv4 Networks Revision 02
Posted Jan 19, 2013
Authored by Fernando Gont

This document discusses the security implications of native IPv6 support and IPv6 transition/co-existence technologies on "IPv4-only" networks, and describes possible mitigations for the aforementioned issues.

Changes: Updated version for 01/2013.
tags | paper
SHA-256 | 903ddcb4eca069a1e4d2bb9516b478eda66b60596e5457b418a1891a5c85d510
Processing Of IPv6 Atomic Fragments
Posted Jan 19, 2013
Authored by Fernando Gont

The IPv6 specification allows packets to contain a Fragment Header without the packet being actually fragmented into multiple pieces (we refer to these packets as "atomic fragments"). Such packets typically result from hosts that have received an ICMPv6 "Packet Too Big" error message that advertises a "Next-Hop MTU" smaller than 1280 bytes, and are currently processed by some implementations as "fragmented traffic". Thus, by forging ICMPv6 "Packet Too Big" error messages an attacker can cause hosts to employ "atomic fragments", and then launch any fragmentation-based attacks against such traffic. This document discusses the generation of the aforementioned "atomic fragments", the corresponding security implications, and formally updates RFC 2460 and RFC 5722 such that fragmentation-based attack vectors against traffic employing "atomic fragments" are completely eliminated.

tags | paper
SHA-256 | feac00abce76ecd39bf1bb5b6c8804af13f2781cf51012a6d77c2a65a15888df
IETF I-D On Fragmentation Related Security Issues Revision 03
Posted Jan 19, 2013
Authored by Fernando Gont

This Internet Draft specifies the security implications of predictable fragment identification values in IPv6. It primarily focuses on countermeasures and mitigations.

Changes: Updated version for 01/2013.
tags | paper
SHA-256 | 38ea3e1b37df89d887edc1122b9c494c6779e2d1a05a220fd84e7a860c114607
Security Implications Of IPv6 Options Of Type 10xxxxxx Revision 01
Posted Jan 19, 2013
Authored by Fernando Gont

When an IPv6 node processing an IPv6 packet does not support an IPv6 option whose two-highest-order bits of the Option Type are '10', it is required to respond with an ICMPv6 Parameter Problem error message, even if the Destination Address of the packet was a multicast address. This feature provides an amplification vector, opening the door to an IPv6 version of the 'Smurf' Denial-of-Service (DoS) attack found in IPv4 networks. This document discusses the security implications of the aforementioned options, and formally updates RFC 2460 such that this attack vector is eliminated. Additionally, it describes a number of operational mitigations that could be deployed against this attack vector.

Changes: Updated version for 01/2013.
tags | paper
SHA-256 | fb4961bf8357488cad14ec9267d3578def97ef7eb554541ecd35f6f1114d3f2c
Security Assessment Of Neighbor Discovery (ND) For IPv6 Revision 01
Posted Jan 19, 2013
Authored by van Hauser, Fernando Gont

Neighbor Discovery is one of the core protocols of the IPv6 suite, and provides in IPv6 similar functions to those provided in the IPv4 protocol suite by the Address Resolution Protocol (ARP) and the Internet Control Message Protocol (ICMP). Its increased flexibility implies a somewhat increased complexity, which has resulted in a number of bugs and vulnerabilities found in popular implementations. This document provides guidance in the implementation of Neighbor Discovery, and documents issues that have affected popular implementations, in the hopes that the same issues do not repeat in other implementations.

Changes: Updated version for 01/2013.
tags | paper, vulnerability, protocol
SHA-256 | 00f877672b0a83b4dcaf16a1fcdecc660203df4d41d883646ee612d312f28996
Security / Robustness Assessment Of IPv6 ND Implementations
Posted Dec 18, 2012
Authored by Fernando Gont

Recent security research seems to indicate that a number of IPv6 Neighbor Discovery implementations fail to implement basic sanity checks on received packets and/or fail to properly manage protocol data structures, being subject of trivial Denial of Service (DoS) attacks. Additionally, some IPv6 protocol features allow a number of attacks, ranging from man-in-the-middle to Denial of Service (DoS). This document discusses how to conduct a security/robustness assessment of Neighbor Discovery implementations by means of the SI6 Networks' IPv6 toolkit - a free, portable, and fully-featured IPv6 security assessment and trouble-shooting toolkit. Additionally, it provides pointers to ongoing work in this area, such that the aforementioned issues can be mitigated where appropriate.

tags | paper, denial of service, protocol
SHA-256 | 00689e040da9e663b0fd1da9b9db7839be24c443cac8af491a0154bbdf4e6c94
Security Assessment Of Neighbor Discovery (ND) For IPv6
Posted Dec 18, 2012
Authored by van Hauser, Fernando Gont

Neighbor Discovery is one of the core protocols of the IPv6 suite, and provides in IPv6 similar functions to those provided in the IPv4 protocol suite by the Address Resolution Protocol (ARP) and the Internet Control Message Protocol (ICMP). Its increased flexibility implies a somewhat increased complexity, which has resulted in a number of bugs and vulnerabilities found in popular implementations. This document provides guidance in the implementation of Neighbor Discovery, and documents issues that have affected popular implementations, in the hopes that the same issues do not repeat in other implementations.

tags | paper, vulnerability, protocol
SHA-256 | 776720fc1a25b2e907c4a468e1b19348a3ea339fb5630e617a7932a7e2ea9b23
Network Reconnaissance In IPv6 Networks
Posted Dec 12, 2012
Authored by Fernando Gont, T. Chown

IPv6 offers a much larger address space than that of its IPv4 counterpart. The standard /64 IPv6 subnets can (in theory) accommodate approximately 1.844 * 10^19 hosts, thus resulting in a much lower host density (#hosts/#addresses) than their IPv4 counterparts. As a result, it is widely assumed that it would take a tremendous effort to perform address scanning attacks against IPv6 networks, and therefore IPv6 address scanning attacks have long been considered unfeasible. This document analyzes how traditional address scanning techniques apply to IPv6 networks, and also explores a number of other techniques that can be employed for IPv6 network reconnaissance. Additionally, this document formally obsoletes RFC 5157.

tags | paper
SHA-256 | 048514499a17396a23d97600ebed59b44a15828ff936fd26e985822b271d5d5f
UK CPNI IPv6 Toolkit 1.2.3
Posted Sep 17, 2012
Authored by Fernando Gont

This toolkit houses various IPv6 tools that have been tested to compile and run on Debian GNU/Linux 6.0, FreeBSD 9.0, NetBSD 5.1, OpenBSD 5.0, Mac OS 10.8.0, and Ubuntu 11.10.

Changes: Various updates and OSes supported.
tags | tool, scanner
systems | linux, netbsd, unix, freebsd, openbsd, debian, ubuntu
SHA-256 | 37fde545740ff58ff27a5cb9590cb1aef36206d163471d31c5f7531f501e90c5
IPv6 Address Monitoring Tool 1.0
Posted Sep 14, 2012
Authored by Fernando Gont

ipv6mon is a tool for monitoring IPv6 address usage on a local network. It is meant to be particularly useful in networks that employ IPv6 Stateless Address Auto-Configuration (as opposed to DHCPv6), where address assignment is decentralized and there is no central server that records which IPv6 addresses have been assigned to which nodes during which period of time. ipv6mon employs active probing to discover IPv6 addresses in use, and determine whether such addresses remain active.

Changes: Various updates.
tags | tool, local
systems | unix
SHA-256 | f714a877de4fbf80126c4b8ad2e3496739695ee1eb3a914eae344fdd6325e138
Page 1 of 3
Back123Next

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    19 Files
  • 25
    May 25th
    5 Files
  • 26
    May 26th
    12 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close