www.commtouch.com IPv6 Threats Slides from June 2011 webcast
Slides from IPv6 Threats
Jan 12, 2015
The Internet industry is undergoing a fundamental change as it transitions from IPv4 to IPv6. These slides are from the June 2011 webcast which provided an overview of IPv6 Threats, recommendations on how to stay protected during the transition to IPv6 as well as information on what Commtouch is doing to ensure its solutions are IPv6 compliant.
The webcast features Commtouch security experts Asaf Greiner and Gabriel M. Mizrahi. You can view the webcast on the Commtouch Slideshare page.
The webcast features Commtouch security experts Asaf Greiner and Gabriel M. Mizrahi. You can view the webcast on the Commtouch Slideshare page.
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
www.commtouch.com
IPv6 ThreatsSlides from June 2011 webcast
www.commtouch.com2
View the recorded webcast on SlideShare at… http://www.slideshare.net/Commtouch/commtouch-ipv6-threats
on
www.commtouch.com
Eyal OrgilMarketing DirectorCommtouch
Welcome to Part 2
IPv6 Informational Series
www.commtouch.com
IPv6 Informational Series
Eyal OrgilMarketing DirectorCommtouch
Part 1: An Introduction to IPv6
www.commtouch.com/introduction-ipv6
on
or at
http://www.slideshare.net/Commtouch
www.commtouch.com
IPv6 Informational Series
Eyal OrgilMarketing DirectorCommtouch
Part 1: An Introduction to IPv6
Part 2: IPv6 Security Threats
www.commtouch.com
Asaf GreinerVP ProductsCommtouch
Gabriel M. MizrahiVP TechnologiesCommtouch
Speakers
www.commtouch.com
Send questions to: [email protected]
Responses posted: http://blog.commtouch.com
Have a question?
www.commtouch.com
Is the Change to IPv6 aSignificant Security Event?
www.commtouch.com
Is IPv6 a Significant Event
Move to IPv6 a transition, not an event• Taking place for several years• Will continue for many more years
There will be security implications• During the transition period• After fully implemented
Many threats same as IPv4• Especially while dual-stacks are in use
www.commtouch.com
Is IPv6 a Significant Event
Many IPv4 threats not applicable to IPv6 Care must be taken when using dual-
networks• Many existing security solutions can protect against
IPv6 threats• But, must be properly configured
Many threats related to transition to IPv6, not new threats
www.commtouch.com
Is IPv6 a Significant Event
Many IPv6 users today are experts and enthusiasts
IPv6 is not yet in widespread usage• Still see minimal usage of IPv6
Wider adoption of IPv6 depends on readiness of network infrastructures• Currently no big incentive to move to IPv6
www.commtouch.com
Is IPv6 a Significant Event
Hackers will utilize IPv6 when it will bring them value• Not deployed widely enough in order to invest time• As IPv6 grows it will appear on the Hacker radar
Transition a long process, not a one day event• Advise that you learn and adjust
www.commtouch.com
The Hype About IPv6 – Is it Just Another Y2K Scare?
www.commtouch.com
Is IPv6 Another Y2K?
Don’t be scared of IPv6, but don’t take lightly IPv6 is a technology which offers:
• New opportunities• New challenges
No date for IPv6• Will take years for IPv6 to become the main protocol
www.commtouch.com
Is IPv6 Another Y2K?
Expect many mission critical infrastructures to remain IPv4• Enough IPv4 addresses for these
Unlikely websites will be moved to be IPv6 in near future
When a large move occurs, we will know:• There is a large user IPv6 base• End of transition period is near
www.commtouch.com
Top Security Issues with IPv6
www.commtouch.com
IPv6 Security Issues
Top three security related issues IPv6:• Tunneling of IPv6 over IPv4 (6 to 4)• Rogue devices• IP Reputation
www.commtouch.com
Threat: IP Tunneling
www.commtouch.com
IPv6 Tunneling Threat
IPv4 Network
IPv4 ConfiguredFirewall
InternalNetwork
Internet
IPv4 IPv4 IPv4
IPv4 Address
www.commtouch.com
IPv6 Tunneling Threat
IPv4 Network
IPv4 ConfiguredFirewall
InternalNetwork
Internet
IPv4 IPv4 IPv4
IPv6 Address
www.commtouch.com
IPv6 Tunneling Threat
IPv4 Network
IPv4 ConfiguredFirewall
InternalNetwork
Internet
GW
IPv4-to-IPv6Gateway
IPv4 IPv4 IPv4
IPv6
IPv6 Address
IPv6IPv6 over IPv4
IPv6 over IPv4 tunnel
www.commtouch.com
IPv6 Tunneling Threat
IPv4 Network
InternalNetwork
Internet
IPv4 IPv4 IPv4
IPv4website
IPv4 ConfiguredFirewall
FW Policy: No Angry Birds
www.commtouch.com
IPv6 Tunneling Threat
IPv4 Network
IPv4 ConfiguredFirewall
IPv6IPv6
InternalNetwork
Internet
GW
IPv4-to-IPv6Gateway
IPv4 IPv4 IPv4
IPv6website
IPv4website
FW Policy: No Angry Birds
IPv6 over IPv4
Bypass firewall policy
www.commtouch.com
IPv6 Tunneling Threat
Need to be aware that security devices are configured for IPv6• For example firewalls
Another example – IDS (Intrusion Detection System) • Can inspect IPv6, but you need to enable it• If not, you won’t be enforcing the policy on IPv6
www.commtouch.com
Threat: Rogue Devices
www.commtouch.com
Rogue Devices
www.commtouch.com
Rogue Devices
Rogue Device
www.commtouch.com
Rogue Devices
IPv6 Prefix IPv6 Prefix
Rogue Device
www.commtouch.com
Rogue Devices
IPv4 Network
Windows 7 Windows 7Windows 7
www.commtouch.com
Rogue Devices
IPv6 Network
IPv4 Network
Windows 7 Windows 7Windows 7
IPv6 enabledby default
www.commtouch.com
Rogue Devices
IPv6 NetworkInternet?
Windows 7 Windows 7Windows 7
IPv4 Network
Internet? Internet?
IPv6 searchesfor access
to the Internet
www.commtouch.com
Rogue Devices
IPv6 Network
Windows 7 Windows 7Windows 7
IPv4 Network
IPv6 Prefix IPv6 Prefix
Rogue Device
Internet? Internet? Internet?
InternetIPv6
www.commtouch.com
Rogue Devices
The difference is:• IPv4 is used daily• If a different allocation is provided, there will be
noticeable effects• With IPv6, the insertion of a rogue device may go
unnoticed
www.commtouch.com
Rogue Devices
IPv6 Network
Internet
Rogue Device
IPv6
Man in the middle
www.commtouch.com
Rogue Devices
IPv6 Network
Rogue Device
InternetIPv6
Man in the middle
www.commtouch.com
Rogue Devices
IPv6 Network
Rogue Device
InternetIPv6
Man in the middle
www.commtouch.com
Rogue Devices
IPv6 Network
Rogue Device
InternetIPv6
Man in the middle
www.commtouch.com
Rogue Devices
Not only a Windows problem An issue with most operating systems
• IPv6 is defined by default• IPv6 could run in the background without anyone’s
knowledge
Security risk also in IPv4 with DHCP• Make sure unauthorized devices cannot connect to
your network
www.commtouch.com
Threat: IP Reputation
www.commtouch.com
IP Reputation
Far more IP addresses in IPv6• 232 compared to 2128
Challenges• IP allocation will be different from IPv4• Anyone can get a large IP allocation• Any person can get a 64 bit allocation (264)• The entire Internet today is 232
www.commtouch.com
IP Reputation
Last 64 bits define the device ID Complicate issue by using randomizer to
change 64 bit• Every spam message could be sent from different IP
Internet264 DifferentIP Addresses
From IP address: wwww
From IP address: xxxx
From IP address: yyyy
From IP address: zzzz
www.commtouch.com
IP Reputation
IP reputation on 128 bits very difficult Need other methods to build reputation
Such as subnets
Storing IP information in memory Vast amount of memory will be needed
No NAT in IPv6 Some believe a security issue They believe NAT provides a layer of security IPv6 provides public IPs for all devices
www.commtouch.com
Commtouch Compliancewith IPv6
www.commtouch.com
Commtouch and IPv6
Commtouch has been working on IPv6 for some time
Making changes to client side and back-end• Client side will be transparent• Focus has been on the back-end
GlobalView Mail Reputation transparently supports more IPs addresses• Still single query of an IP address but data storage
more efficient
www.commtouch.com
Commtouch and IPv6
Monitoring the Internet • Identifying IPv6 threats• Classifying threats
Currently seeing minor IPv6 spam activity• Believe spammers experimenting with IPv6• Too noticeable today to send spam via IPv6 when
there is very little email on this network
www.commtouch.com
Recommendations for MinimizingIPv6 threats
www.commtouch.com
Gabriel Mizrahi’s IPv6 Recommendations
1. Make sure you have mapped all devices on your network
2. Implement IPv6 step-by-step
3. Have a written procedure of how you will introduce IPv6
4. Plan to implement a dual stack as a first stage
www.commtouch.com
Asaf Greiner’s IPv6 Recommendations
1. Get educated about IPv6• Everyone should go back to networking fundamentals• Understand what’s implemented on our network
today, and why• Then look at what needs to remain or change
2. Learn from others• What mistakes and successes other have
experienced
www.commtouch.com
Asaf Greiner’s IPv6 Recommendations
3. Lockdown from IPv6 as a start
4. Then implement staged plan to roll out IPv6
5. Take care to avoid configuration errors
www.commtouch.com
Asaf GreinerCommtouch VP Products
Gabriel M. MizrahiCommtouch VP Technologies
Thank you to
www.commtouch.com51
View the recorded webcast on SlideShare at… http://www.slideshare.net/Commtouch/commtouch-ipv6-threats
on
www.commtouch.com
Send questions to: [email protected]
Responses posted: http://blog.commtouch.com
Have a question?
www.commtouch.com
Please check back for future informational webcasts
Related Documents
