Re: [Full-disclosure] Exploitation of unused IPv6-capabilities

["TJ" <trejrco@xxxxxxxxx>]

Indeed, that is one of the reasons a feature like "RA Guard" is sorely
needed ... http://tools.ietf.org/html/draft-ietf-v6ops-ra-guard-01


/TJ

>-----Original Message-----
>From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:full-disclosure-
>bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Valdis.Kletnieks@xxxxxx
>Sent: Monday, January 19, 2009 11:48 AM
>To: Lukas Th. Hey
>Cc: full-disclosure@xxxxxxxxxxxxxxxxx
>Subject: Re: [Full-disclosure] Exploitation of unused IPv6-capabilities
>
>On Sun, 18 Jan 2009 22:17:44 +0100, "Lukas Th. Hey" said:
>
>> Attack:              Have an IPv6 tunnel with appropriate prefix
delegated.
>>              Configure your machine to propagate the prefix and
>>              switch on IPv6 routing.
>
>Yes, that attack unfortunately often works quite well.  It's been known
>about for quite some time though. Read section 7 of RFC5006, which
>specifically mentions rogue RAs for redirection.  It also adds:
>
>          Also, an attacker could configure a host to send out
>   an RA with a fraudulent RDNSS address, which is presumably an easier
>   avenue of attack than becoming a rogue router and having to process
>   all traffic for the subnet.  It is necessary to disable the RA RDNSS
>   option in both routers and clients administratively to avoid this
>   problem.  All of this can be done independently of implementing ND.
>
>And having a rogue RA has been a known issue since at least 2004:
>
>http://www.atm.tut.fi/list-archive/ipng/msg13311.html
>
>(Probably further back, but I'll let somebody else chase down the first
>citation)
>


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/