Indeed the ISATAP interface of the ISATAP router is meant to be an enterprise-interior (note that it is still assumed that the associated IPv4 address is non-private). As we explicitly note in the paper, the first three attacks will be mitigated if proper protocol-41 filtering is deployed on the site's border. However, note that RFC5214 does not mandate or require this filtering. It is only mentioned as a possible mitigation against incoming spurious protocol-41 packets. In addition, Section 10 of RFC5214 only mentions ingress not egress filtering. Hence it will not stop attack #2. In addition, as mentioned, protocol-41 filtering is not helpful when attack #3 is launched on two routers that reside in the same site. Note that it may be possible for the attack packet to be sourced from outside the site unless proper filtering of incoming IPv6 packets is deployed. If the attacker resides in the site, usually ingress filtering will not be helpful since it is deployed in general on the site's border.
In general, I would like to point out that indeed as in most other attacks these attacks may also be mitigated by proper firewall rules. However, I do not believe that this should be our only answer against these attacks. I believe that since these attacks are made possible due to the inherent characteristics of the tunnels they should be stopped intrinsically as much as possible by the tunnel participants and not relay on outside filtering rules. Gabi ________________________________ From: "Templin, Fred L" <fred.l.temp...@boeing.com> To: Gabi Nakibly <gnaki...@yahoo.com>; v6ops <v6...@ops..ietf.org> Cc: ipv6@ietf.org; sec...@ietf.org Sent: Monday, August 17, 2009 8:35:08 PM Subject: RE: Routing loop attacks using IPv6 tunnels Gabi, Thanks for publishing this work. In the document, attacks A, B and C correspond to a configuration that violates section 6.2 of RFC5214: > 6.2. ISATAP Interface Address Configuration > > Each ISATAP interface configures a set of locators consisting of IPv4 > address-to-interface mappings from a single site; i.e., an ISATAP > interface's locator set MUST NOT span multiple sites. In particular, in scenarios A, B and C the IPv4 locator used for ISATAP is seen both within the enterprise as site #1 and within the global Internet itself as site #2. If the ISATAP interface is to be used as an enterprise- interior interface, it should therefore not accept IP-proto-41 packets coming from an IPv4 source outside of the enterprise nor source IP-proto-41 packets that are destined to an IPv4 node outside of the enterprise. This condition should be satisfied by having the site border routers implement IPv4 ingress filtering and ip-protocol-41 filtering as required in Section 10 of RFC5214. It is mentioned that attack C could also occur when the routers reside in the same site, where their addresses may be private. This would correspond to a case in which an attacker within the site attacks the site itself, which can easily be traced – especially when source address spoofing from a node within the site is prevented through proper ingress filtering. Fred fred.l.temp...@boeing.com ________________________________ From:Gabi Nakibly [mailto:gnaki...@yahoo.com] Sent: Monday, August 17, 2009 8:21 AM To: v6ops Cc: ipv6@ietf.org; sec...@ietf.org Subject: Routing loop attacks using IPv6 tunnels Hi all, I would like to draw the attention of the list to some research results which my colleague and I at the National EW Research & Simulation Center have recently published. The research presents a class of routing loop attacks that abuses 6to4, ISATAP and Teredo. The paper can be found at: http://www.usenix.org/events/woot09/tech/full_papers/nakibly.pdf Here is the abstract: IPv6 is the future network layer protocol for the Internet. Since it is not compatible with its predecessor, some interoperability mechanisms were designed. An important category of these mechanisms is automatic tunnels, which enable IPv6 communication over an IPv4 network without prior configuration. This category includes ISATAP, 6to4 and Teredo. We present a novel class of attacks that exploit vulnerabilities in these tunnels. These attacks take advantage of inconsistencies between a tunnel's overlay IPv6 routing state and the native IPv6 routing state. The attacks form routing loops which can be abused as a vehicle for traffic amplification to facilitate DoS attacks. We exhibit five attacks of this class. One of the presented attacks can DoS a Teredo server using a single packet. The exploited vulnerabilities are embedded in the design of the tunnels; hence any implementation of these tunnels may be vulnerable. In particular, the attacks were tested against the ISATAP, 6to4 and Teredo implementations of Windows Vista and Windows Server 2008 R2. I think the results of the research warrant some corrective action. If this indeed shall be the general sentiment of the list, I will be happy write an appropriate I-D. The mitigation measures we suggested in the paper are the best we could think of to completely eliminate the problem. However they are far from perfect since they would require tunnel implementations to be updated in case new types of automatic tunnels are introduced. Your comments are welcome. Gabi
-------------------------------------------------------------------- IETF IPv6 working group mailing list ipv6@ietf.org Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 --------------------------------------------------------------------
