Research on IPv6 protocol security analysis and testing

In the previous section, we briefly introduced the security issues related to the IPv6 protocol, and now we have an analysis on the vulnerability of the Protocol that is also found. First, we need to understand the working principle of this Protocol so that we can understand the content in the test.

1. Vulnerability Analysis of neighbor discovery protocols

In IPv6, The NeighborDiscovery protocol is used to replace the ARP protocol in IPv4 to obtain the Mac address of machines in the LAN. This is a prerequisite for communication between hosts in the LAN. The Neighbor Discovery Protocol consists of two formats: the neighbor request NSNeighborSolicitation) and the neighbor request NANeighborAdvertisement ).

How neighbor discovery protocols work

Before communication between two hosts A and B in the LAN, A must first obtain the MAC address of B. The main steps are as follows:

1) A sends an ICMP IPv6 NS message to FE02: 1 in broadcast mode and asks B about its MAC address.

2) each node in the LAN can receive this NS request. When a node receives this NS request, it compares the target MAC address with its own MAC address. If they are inconsistent, otherwise, if the requested MAC address is the same as its own MAC address, the system responds to a neighbor's message NA, indicating that it is the node to be requested. In this example, under normal circumstances, only B responds to the NS request, and the response packet contains the MAC address of B.

Option of neighbor message announcement

Note that there are three special flag bits in the IPv6 protocol. R indicates whether it is a route, S indicates whether it is a declaration made by the target machine, and O indicates whether it overwrites the original cache. The main purpose of setting these signs was originally to improve the efficiency of LAN nodes.

Analysis of Security Risks of neighbor discovery protocols

Through the above analysis, we can see that the Neighbor Discovery Protocol in IPv6 is not improved in terms of security compared with the ARP protocol in IPv4. It is mainly reflected in the following aspects:

First, for NS ICMP6 packets, any node in the LAN can reply as long as it is listened to in the LAN, without authentication. Therefore, ARP spoofing in IPv4 can be replaced by NA spoofing in IPv6. The principle is the same and will not be repeated here.

Second, compared with the ARP response packet under IPv4, NA, as the IPv6 response packet, has three more signs mentioned above. It is undeniable that when all nodes in the LAN work normally, these three signs can undoubtedly improve the efficiency of LAN nodes, but once a malicious node exists, these three signs will undoubtedly become a powerful tool for malicious nodes.

First, through the R flag, malicious nodes can be disguised as ro, and through the S flag, malicious nodes can disguise the cost machine, which is the most favorable for malicious attacks, malicious nodes can insert false route information into the route table of the attacker. Because in IPv4, the neighbor cache table is refreshed once every certain time, malicious nodes may need to send a large number of false responses to overwrite the correct cache, which is easy to detect, however, to use the O flag to overwrite the correct cache in IPv6, you only need to send a small number of false NA packets, which is difficult to detect.

2. Analyze the vulnerability of ICMP IPv6 protocol duplicate address detection protocol

You can use either dynamic allocation or static settings to configure node addresses in an IPv6 network. to configure a widely used dynamic IPv6 address, follow these steps:

1) obtain the IPv6 address Prefix from the vro or the default gateway, for example, Prefix.

2) the node generates a Suffix

3) splice the Prefix address and Suffix address into a complete IPv6 address: Prefix-Suffix

4) execute the duplicate address detection DAD: DuplicateAddressDetection) to determine whether the Prefix-Suffix has been occupied by other nodes in the network:

A) A sends an icmp00006ns message to FE02: 1 in broadcast mode and asks whether Prefix-Suffix has been occupied by other nodes in the network.

B) each node in the LAN can receive this NS request. When a node receives this NS request, it compares the target address with its own address. If they are inconsistent, it does not respond; otherwise, the system responds to a neighbor's message NA, indicating that the IP address has been used.

5) If no response is received, configure the local address in Prefix-Suffix. Otherwise, go to step 1st and repeat the preceding steps.

ICMP IPv6 protocol duplicate address detection Protocol Security Risk Analysis

During the process of duplicate address detection, any node in the LAN can respond to the corresponding request due to the lack of authentication. In this way, the attacker can respond to the duplicate address detection message sent by a specific host or all hosts in the LAN, so that the corresponding node cannot configure the IPv6 address and thus cannot connect to the network.