Publié le 08-04-2011 18:04 sur la mailing-list Dailydave

Pub : Tous les logiciels antiphishing gratuits disponibles sur Internet

Sorry Adam, the whole =91ND MITM=92 issue is old news, has been discussed
at IETF meeting, mailing lists and published in multiple RFC's. I
have also been teaching, demoing this and other IPv6 attack technique
for at least seven years, as has Marc Heuse (Marc - Nice job on the
IPv6 THC Tools and your presentations!).

What you might find interesting is the reason Microsoft doesn=92t
include SEND in their current products. It seems after the engineers
from Microsoft and Ericsson finished writing the IETF document, they
also wrote and filed a patent on the process. So Microsoft has
concerns implementing SEND, due to legal concerns with Ericsson. I
have been privately requesting Microsoft to address this issue since
2005 and publicly requested a status from the MSRC at their Q&A
session during Black Hat Vegas 2009. The status so far is --- there is
no status. Anyone form Microsoft want to provide a status?

On mitigating this problem, you have multiple choices:

1. Disable IPv6 on all devices.

This is the best option if you do not have security products which
support IPv6 =96 really support IPv6! That level of support should
include parity with the current IPv4 product, support for all active
RFC=92s, device discovery and vulnerabilities. I presented a list of
those high level items during HOPE/Toorcon/Sector 2010, if you anyone
is interested.

So over the last 5 years, I have interviewed hundreds of vendors
claiming to support IPv6, many of them monitor this list. I have a
=93Trust but verify=94, so I tested many of these products, and the result
is they all FAILED. I presented on my finding back in 2005 but have
been updating this list yearly. I have considered publishing my
findings, but legal consul recommended against it. This year might be
different, stay tuned =96 maybe Black Hat or Defcon.

If you do have products which support IPv6, or your vendor has
convinced you of it, then leave IPv6 enabled. The cost of disabling,
then enabling the protocol on a large network can be very expensive.
Also, don=92t be that guy that removes the IPv6 binaries as a method to
protect your networks. It seems if you remove the binaries from many
operating systems, it will require a complete reload of the operating
system and applications.

2. If you don=92t currently support IPv6 in your environment, block
layer 2 protocol number 86DD.

3. If by chance you have IPv6 enabled or support IPv6, enable RA
guard. Note, that many switches either don=92t support RA Guard and will
requiring a switch replacement, while others require a software
upgrade.

4. Again if you don=92t currently support IPv6, you can also block and
log protocol 41 on routers. This will not solve the problem, but will
at least provide an indication an attack is accruing. Look for the
router advertising packets.

5. There are a bunch of other methods, but sadly don=92t have time to
enumerate all them here.

6. Implement SEND.

This in theory is easy, but in practice can take a lot of work. It
will require all hosts and routers to support IPv6 SEND/CGA. It will
also require implementing a certificate authority.

On the router/switch side, Cisco and Juniper have implemented SEND in
their devices. Outside of these two vendors, your only option are for
FreeBSD or LINUX system:

- Use the DoCoMo Labs USA OpenSource implementation of RFC 3971, 3972,
and 3779 for SEcure Neighbor Discovery (SEND). The code and
documentation can be downloaded at:
http://www.aestheticscientist.com/082406/lab_opensource.html
- Use IPv6-SEND-CGA (http://code.google.com/p/ipv6-send-cga/)
For the client side, consider Easy-SEND (at
http://sourceforge.net/projects/easy-send) or IPv6-SEND-CGA
(http://code.google.com/p/ipv6-send-cga/), for Linux.

Adam, one good outcome of your teams posting this vulnerability is,
the security and IT community are discussing potential risks involving
in poor deployment of IPv6 networks.

JoeKlein
#IPv6sec
_______________________________________________
Dailydave mailing list
[email protected]
https://lists.immunityinc.com/mailman/listinfo/dailydave

Votre compte Facebook a-t-il été infiltré ?

24-05-2012 à 12:09 - 0 commentaire(s)

Info zataz - Une vague de faux messages vise des milliers de comptes Français Facebook. Prudence aux photos sexy diffusées.

Fuite de données pour iPhone

22-05-2012 à 00:43 - 0 commentaire(s)

Info zataz - Un iPhone jailbreaké couplé avec Tweak Bulletin permet de passer outre le mot de passe d´ouverture du téléphone.

Téléphone portable ZTE piégé

22-05-2012 à 00:38 - 0 commentaire(s)

Le fabricant chinois de téléphone portable ZTE a confirmé la présence d'une porte dérobée dans l'un de ses smartphones sous Android.

Le Bureau de Justice US piraté

22-05-2012 à 00:31 - 0 commentaire(s)

Info zataz - Des milliers de données sensibles volées par des Anonymous au Bureau of Justice US.

Anonymous contre pédophiles

22-05-2012 à 00:09 - 0 commentaire(s)

Info ZATAZ : Plusieurs dizaines d´informations concernant des pédophiles présumés venant du réseau Darknet diffusées par des Anonymous.

Vulnérabilité sur les site de FHM, ELLE et Forbes

20-05-2012 à 20:38 - 0 commentaire(s)

Info zataz - Des failles découvertes sur les sites des magazines FHM, ELLE et Forbes peuvent mettre en danger les lecteurs internautes.

Anonymous menacent le gouvernement québécois

20-05-2012 à 20:28 - 0 commentaire(s)

Info @zataz - Le gouvernement Québécois veut faire interdire des manifestations étudiantes. Les Anonymous répondent en lançant des attaques informatiques.

Class action de 15 milliards contre Facebook

20-05-2012 à 20:23 - 0 commentaire(s)

Facebook rentre en bourse, des internautes lancent une Class Action de 15 milliards de dollars contre Facebook.