Check your IPv6 address component to prevent it from being vulnerable.

Check your IPv6 address component to prevent it from being vulnerable.

IPv6 "neighboring discovery" (ND) is the core part of the IPv6 protocol stack. It is used for IPv6 address resolution and automatic configuration of IPv6 stateless addresses. This article discusses how different IPv6 components will be attacked based on ND.

IPv6 nodes are required when an IPv6 Stateless Address is automatically configured (SLAAC. In SLAAC, the local router provides IPv6 network configuration information to the local host, and the local host uses this information to establish an IPv6 connection, including IPv6 address configuration. Unlike Dynamic Host Configuration Protocol version 6, there is no "lease" address here ". On the contrary, the host automatically configures (or "rent") the IPv6 address. SLAAC uses router requests and router announcement messages to request and communicate IPv6 network and IPv6 address management configuration information. The procedure of automatic configuration is as follows:

1. Host Configuration link local address;
2. Check whether the host address is unique. That is, the host performs duplicate address detection (DAD) on the (temporary) address );
3. The host sends a router request message;
4. After receiving the router notice (RA), the host configures one or more temporary IPv6 addresses for each prefix in the received router notice;
5. Check whether the host address is unique, that is, execute DAD for the temporary address;
6. If the address is unique, it is usually the "preferred" address and can be actively used for network communication.

In essence, this means that a node first configures a local IPv6 address of the link, and then configures one or more global IPv6 addresses based on the prefix information in the RA message. RA messages may obtain other network configuration information, such as the IPv6 path to a specific network, the IPv6 address of the recursive Domain Name System server, and the maximum transmission unit (that is, the maximum packet size ).

Some IPv6 deployments fail to perform a verification check on the information in the RA message, or fail to perform a size limit on the corresponding data structure.

For example, some deployments configure an IP address for each prefix in the RA message, but do not limit the maximum number of IPv6 addresses they configure. Therefore, attackers can use flood attacks on victims with multiple RA messages (including multiple automatically configured prefixes). The victims will automatically configure many IPv6 addresses, the response will eventually crash or stop.

To help you understand the basis of this attack, the IT administrator can use the ra6 tool in the IPv6 toolkit of SI6 Networks to perform this attack, as shown below:
Ra6-I eth0 -- flood-prefixes 10-d ff02: 1-l-z 1-v

This command will send an RA message to all local nodes, containing 10 (random) prefixes per second. This causes each node to configure an IPv6 address for each random prefix.

In Unix systems, the ifconfig command can be deployed on any victim node to check automatically configured IPv6 addresses.

Figure 1 ifconfig command can be used to detect automatically configured addresses

Of course, in real-world attacks, RA messages are sent at a higher rate, such as at least 100 messages per second. However, as this attack may cause all local nodes to crash, this example uses a more conservative packet rate to perform the attack.

All RA messages contain the router life value, which indicates how long the router can act as the default router after the message is sent. The local host obtains this value from the RA message and tracks it through the local timer. The local router attempts to "Update" the timer of the local host by regularly sending (unrequested) RA messages. Therefore, under normal circumstances, the life of the router will never expire. However, attackers can use this timer or parameter for DoS purposes. If an attacker can simulate a local router and send a RA message with a router life value of 0 (or other small values), the victim node will delete the counterfeit Router from the default router list, this causes a denial of service.

Assume that the valid local router of a specific subnet is fe80: 1. The attacker uses ra6 to execute DoS attacks on all local nodes as follows:
Ra6-I eth0-s fe80: 1-d ff02: 1-t 0

"-I eth0" indicates the network interface used to launch the attack; "-s fe80: 1" indicates the source address of the attack data packet (the legitimate local router is counterfeited); "-d ff02:: 1 indicates that the attack packet is sent to the "local multicast address of all node links", and "-t 0" indicates that the "vro life value" is 0.

 

The Netstat command can be used to check the route table of the victim node and confirm that the default path pointing to fe80: 1 node has been deleted.

Duplicate address detection

Before an IPv6 address is used for network communication, the address needs to be checked for uniqueness-this is usually called duplicate address detection. The working principle of DAD is roughly as follows:

· Nodes that are willing to use IPv6 addresses will send a neighbor request (NS) message to the preceding addresses.
· If a neighbor notice (NA) is received in the response and the address is considered to be duplicate, DAD fails.
· If the address's NA message is not received (probably after a series of NS messages are resold), the address is considered unique and DAD is successful.

The corresponding NS message of DAD is sent, which contains the source address set to unspecified address (: :). Therefore, it is easy to distinguish it from the NS message used for address resolution (instead of duplicate address detection.

Attackers can use the following command to easily execute DoS attacks on local nodes using the na6 tool:
Na6-I eth0-B:-L-v

This command indicates that the network interface eth0 of the na6 listener ("-L") contains an NS message whose source address is set to an unspecified address ("-B, response to NA when receiving such a message. Therefore, when a node is guided and an IPv6 address is automatically configured, each address it attempts to configure will be considered as a duplicate address, and SLAAC will fail.

The Ifconfig command can be used to check the configurations of the victim's network interface card, as shown below:

Figure 2 Check network interface card configuration

From above, pay attention to at least two things. First, the local link address is marked as "DUPLICATE ". Second, the Global IPv6 address is not configured for this interface because SLAAC is terminated when the DAD of the local link address fails temporarily. Therefore, DoS attacks occur.

Network reachable detection (NUD) is another component of IPv6, including testing the path to the adjacent node. If the current path fails, you can select an alternative path. Most importantly, the only thing attackers can do to infect NUD is to make the Protocol believe that the failure path can work normally.

Compared with other ND-based attacks, this vulnerability is not so attractive to attackers. Therefore, you do not need to worry too much about this attack method.