Subject: Is this true?

From: jean-michel bernier de portzamparc <[email-masked]>
Date: Thu, 26 Aug 2010 22:51:03 +0200

IPv6 in the press
http://www.theregister.co.uk/2010/08/06/ipv6_security_nightmare/

Portzamparc
Internet User

---

From: Fred Baker <[email-masked]>
Date: Thu, 26 Aug 2010 14:16:57 -0700

> http://www.theregister.co.uk/2010/08/06/ipv6_security_nightmare/

It's true that a marginally-informed person said that at DefCon. The scary part isn't that he said it, it's that he teaches courses at a junior college and therefore has the ear of a large number of even-less-well-informed people. It's true that some publicity-seeking journalist, doing no investigation and asking nobody who is better-informed what reality might be, wrote an article with the intention of creating publicity. What passes for journalism these days often has a pretty tenuous relationship with reality.

There are in fact firewalls, if you consider a firewall to be a security solution. There is one format (RFC 4291) that puts a MAC address into an IPv6 address, just like XNS, IPX, DECNET V, and OSI did. you might take a look at RFC 4941. The predecessor of RFC 4941 was written in 2001, the last time this flap ran around the Internet. yada yada yada

Go back to sleep.

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 27 Aug 2010 09:27:59 +1200

It's certainly true that you need to use security products that
support IPv6 as well as they support IPv4. If they don't, change
vendors. Apart from that, it's scare-mongering. Consider that
the basic model for IPv6 is not fundamentally different than IPv4;
why would the underlying security vulnerabilities be fundamentally
different?

I happen to be aware that a serious independent analysis of IPv6 security
is being carried out, and hopefully will appear in the not too distant
future. It will not be scare-mongering, judging by the draft I've seen.

Regards
   Brian Carpenter

On 2010-08-27 08:51, jean-michel bernier de portzamparc wrote:
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Thu, 26 Aug 2010 23:37:42 +0200

It's true that someone said all that. It's probably true that the 
firewall your boss bought in 2006 doesn't support IPv6. It's probably 
even true that some people consider this a problem of IPv6 rather than 
of the firewall.

The rest is all bullshit.

Conferences with presentations should have a "most bullshit per minute" 
prize, with some sort of plaque.

Arnt

---

From: Dave Cridland <[email-masked]>
Date: Thu, 26 Aug 2010 23:36:33 +0100

On Thu Aug 26 22:37:42 2010, Arnt Gulbrandsen wrote:
> firewall your boss bought in 2006 doesn't support IPv6. It's  
> probably even true that some people consider this a problem of IPv6  
> rather than of the firewall.
> 
> Conferences with presentations should have a "most bullshit per  
> minute" prize, with some sort of plaque.

Could we award it in the plenary, like the Postel Award?

Only problem is who to name it after.

Without being sued for defamation, I mean - there's no shortage of  
candidates.

Dave.
-- 
Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 27 Aug 2010 11:24:25 +1200

On 2010-08-27 11:10, Dave CROCKER wrote:
> 
> 
> On 8/26/2010 2:27 PM, Brian E Carpenter wrote:
>>   Apart from that, it's scare-mongering. Consider that
> well, just to give that question its due, interesting changes in details
> can sometimes produce interesting changes in the behavior of a model and
> therefore of its implications.
> 
> in this case, the vastly larger address space of IPv6 permits attackers
> to switch to new addresses at a rate that was not possible with IPv4. 
> this is likely to defeat the substantial infrastructure of
> attack-tracking that is address-based, such as for anti-spam.

True, but the same property means that scanning attacks are infeasible
against IPv6 subnets. Attack tracking based on subnets may work
fine, though. Swings and roundabouts.

Anyway - nobody is saying that there are no security issues with IPv6.

    Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 27 Aug 2010 12:57:14 +1200

On 2010-08-27 11:36, Dave CROCKER wrote:
> 
> 
> On 8/26/2010 4:24 PM, Brian E Carpenter wrote:
> ...
> Your original comment was about differences in vulnerabilities.  You
> asserted that there was no fundamental difference and I was observing
> that one difference that is clear and is already of concern to the
> anti-spam/anti-abuse community does quality as a fundamental
> difference.  (It is likely to render and entire infrastructure of
> address-based white- and black-listing useless.)
> 
> 
> How is your statement, above, not saying /exactly/ that?

We must interpret the word "fundamental" differently. The fundamental
issue we are getting at in your example is basically that it's trivial
to forge layer 3 addresses in a connectionless datagram network running
without cryptograhic signature of every packet. The exact exposures and
countermeasures differ between IP versions, of course.

   Brian

---

From: Dave CROCKER <[email-masked]>
Date: Thu, 26 Aug 2010 16:10:34 -0700

> why would the underlying security vulnerabilities be fundamentally

well, just to give that question its due, interesting changes in details can 
sometimes produce interesting changes in the behavior of a model and therefore 
of its implications.

in this case, the vastly larger address space of IPv6 permits attackers to 
switch to new addresses at a rate that was not possible with IPv4.  this is 
likely to defeat the substantial infrastructure of attack-tracking that is 
address-based, such as for anti-spam.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Dave CROCKER <[email-masked]>
Date: Thu, 26 Aug 2010 16:36:44 -0700

...
> fine, though. Swings and roundabouts.

Your original comment was about differences in vulnerabilities.  You asserted 
that there was no fundamental difference and I was observing that one difference 
that is clear and is already of concern to the anti-spam/anti-abuse community 
does quality as a fundamental difference.  (It is likely to render and entire 
infrastructure of address-based white- and black-listing useless.)

d/

-- 

   Dave Crocker

---

From: Florian Weimer <[email-masked]>
Date: Sat, 28 Aug 2010 22:13:25 +0200

> why would the underlying security vulnerabilities be fundamentally

Lack of NAT and an expectation of end-to-end reachability seem quite
fundamentally different from IPv4 as it is deployed to day.  (I'm not
saying that NAT is a security feature, I'm just pointing to a rather
significant difference.)

IPv6 also make IPsec mandatory, which seems a significant change over
IPv4, too.

---

From: Doug Barton <[email-masked]>
Date: Sat, 28 Aug 2010 13:26:34 -0700

> attack-tracking that is address-based, such as for anti-spam.

This statement is a bit oversimplified, so a slightly oversimplified 
response in return. In IPv4 attack-tracking the /32 is considered but 
most tools are smart enough to aggregate up to at least the /24, and 
often (for better or worse) up to shorter prefixes as well. If we 
consider the v6 /64 as roughly equivalent to the v4 /32; lather, rinse, 
repeat.

Even more vastly oversimplified response, Brian's right. :)

Doug

---

From: Fred Baker <[email-masked]>
Date: Sat, 28 Aug 2010 13:47:24 -0700

On Aug 28, 2010, at 1:13 PM, Florian Weimer wrote:

> IPv6 also make IPsec mandatory, which seems a significant change over IPv4, too.

I can point to IPv6 implementations that don't have it and IPv4 implementations that do. I've been using IPsec/IPv4 for roughly 15 years. That canard is a little long in the tooth.

---

From: Fernando Gont <[email-masked]>
Date: Sun, 29 Aug 2010 00:51:21 -0300

Florian Weimer wrote:

> Lack of NAT 

I am told that NAT for v6 is (ironically) among the most "asked for"
IPv6 features...

Nevertheless, it wouldn't be a surprise to me that stateful v6 firewalls
take NAT's place, such that "only return traffic is allowed".

("resistance to change", if you want)

> and an expectation of end-to-end reachability seem quite
> fundamentally different from IPv4 as it is deployed to day.

As ironic as it may sound, some people are actually *concerned* about
this. (no, not *me*)

> IPv6 also make IPsec mandatory, which seems a significant change over

As noted by Fred, this is mostly "words on paper".

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Fernando Gont <[email-masked]>
Date: Sun, 29 Aug 2010 04:22:15 -0300

Phillip Hallam-Baker wrote:

> That is one security use made of NAT, but reducing the amount of
> information leaked about the internal configuration of the network is
> another.
> 
> I don't have to make my network 100% secure to be secure, all I need
> to do to reduce my number of attacks is to make my network a bit
> harder and a bit more expensive to attack than your network.

Agreed. I just meant that even without v6 NATs, it shouldn't come as a
surprise if end-to-end connectivity is *not* restored by IPv6.

> It is hardly ironic. Pretty much all functionality can be employed by
> the bad guys as well as the good ones. So increasing the benefit to
> the good guys will inevitably increase the functionality for the bad
> ones.

Please let me re-phrase "It's ironic that what's supposed to be one of
the motivations for IPv6 is something that actually concerns many
people". (i.e., some see this as a "selling point", but for quite a few
of those that are expected to be "buyers" this is actually a concern).

-- Me, I wouldn't have my own systems reachable end-to-end unless
there's good reason for doing that.

> Looking at this thread,we have two ex-chairs who are not security
> specialists attacking a security specialist as 'ill-informed' when in
> fact they are merely repeating an ideological view of security that
> has negligible support outside the IETF. That is a really bad way to
> approach security.
> 
> There is more to security than throwing cryptography at packets.

Agreed. The work that we have done at CPNI on TCP & IP is probably along
those lines (i.e., more than throwing crypto) -- see
http://www.gont.com.ar/papers

Thanks!

Kind regards,

---

From: Paul Ferguson <[email-masked]>
Date: Sun, 29 Aug 2010 00:26:01 -0700

> surprise if end-to-end connectivity is *not* restored by IPv6.

It is refreshing to hear someone actually say that out loud.

Thank you.

- ferg

-- 
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 28 Aug 2010 23:12:28 -0400

Well I really would hope that if there were such an award that the
people awarding it would bother to review the actual presentation
rather than one journalists account of it.

In this case the speaker gives a heads up talk on IPv6 to DEFCON and
instead of thanking him you start accusing him of being ill informed
without bothering to read his presentation. So who is really the
uninformed party here? I did bother to read the slides and they are on
a par with more than a few IETF technical plenary talks I have sat
through.

I would also hope that the security of IPv6 is given rather more
serious review than 'someone is looking at it'. I find that less than
inspiring to be honest. The consensus IETF view of security is not
necessarily my view of security.

In particular, I do not care very much about the theoretical
equivalence of the protocols. Proof by analogy is a very dangerous
form of security argument. It has led to many security catastrophes.
So I would not accept the argument that IPv4=IPv6.

A real security specialist knows that even if IPv6 changes nothing in
principle, its use will exercise new code paths that have seen far
less use than their IPv4 equivalents. That in turn creates new
opportunities for the cracker. The security of a system is the
security of the system as implemented, and not according to the
theory.

The issue of exposing MAC addresses is a very important security
concern. It was not a security issue in OSI or Decnet Phase V because
they were dead as a parrot before the security issues could become
significant.

It is something I would hope that a speaker would raise in a security
talk. He does and he tells people to make sure they have the privacy
shield on so they are not exposing their MAC address - good advice.

The issue about firewalls is that a lot of appliances cannot cope with
IPv6 so they just bypass all IPv6 packets. This creates a real
security hole in many systems that can be exploited as a means of
firewall bypass.

I would imagine that the practical part of the talk involved attacking
actual firewalls that were not quite as IPv6 ready as the
manufacturers claimed. Back in the day more than a few firewalls have
shipped that fail open circuit when overloaded. So all that was
necessary to bypass the firewall was a flooding attack. And the same
is now true of many 'application firewall' products.

On Thu, Aug 26, 2010 at 6:36 PM, Dave Cridland <[email-masked]> wrote:
>> It's true that someone said all that. It's probably true that the firewall
>> your boss bought in 2006 doesn't support IPv6. It's probably even true that
>> some people consider this a problem of IPv6 rather than of the firewall.
>>

-- 
Website: http://hallambaker.com/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 28 Aug 2010 23:22:18 -0400

IPv6 made code to support IPSEC a requirement in the stack. Actual use
of IPSEC has never been a requirement because it still lacks a key
distribution mechanism for its original intended purpose of being a
pervasive security mechanism.

In practice, IPv6 will have NAT just like IPv4 had NAT even when the
IETF tried to prohibit it as an abomination. There will be no
transition from IPv4 to IPv6 without seamless address conversion
v4->v6 and v6->v4. So anyone who writes an application for IPv6 who
relies on the address being constant end to end is probably going to
find it is of no use in practice.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 29 Aug 2010 01:48:09 -0400

That is why security conscious people think twice before adding
functionality that they do not intend to use. And very security
conscious people run default-deny networks where 'nothing should
happen without a reason (SM)'.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 29 Aug 2010 08:14:50 -0400

> It is refreshing to hear someone actually say that out loud.

Agreed.

One of the biggest obstacles to deployment of IPv6 is the people who
imagine that this is an opportunity for them to establish their model
of the Internet architecture.

Ironically we are returning to the original model of the Internet.
Only we are returning to the 1970s model of Clark, Cerf et. al. in
which the only constant is that every network uses the Internet
Protocol for communication across the Internetwork. IP to the endpoint
was actually a later idea.