 Ik ben van de Nederlands. Ik ga op de IPv6 op een paar dingen. Ik ga niet een kors doen. Als je niet op IPv4 niet weet, dan f**k je. Oké, 4 mensen blijven al, dat is goed. 5, 6. Dit was meentje als een generelle sessie. Dus als je een hardcore sessie verwacht, dan wel, je weet het wel. De twee mensen die hier blijven, ik ga je laten zien de verschillen tussen IPv4 en IPv6. En natuurlijk kunnen we dat doen met een security point van je. Ik ga je laten zien de geweldige, fantastische security features die in IPv6 zijn. En natuurlijk zal ik je laten zien hoe onhekkend dit protocol is. Een paar nieuwe security issues, of er misschien zijn. En de status op de oude. Dat moet je doen. Ik ben Brenno de Winter, ik ben 29 jaar oud. Ik begon te programmeren, ik kan het niet zien. Ik begon te programmeren op iets als ik vijf jaar oud was, ik denk. Ik was bezig met de security, want ik was 15 jaar, denk ik wat dat kan zijn. En ik werk voor mezelf. Ik ben gehaald op Gamble. Ik doe veel Linux en Unix en vermoordelijk moet je soms windows doen. Ik rijd in Xymion, dus als iemand wil commenteren op dat, ik deed dat omdat het zo ongelooflijk was in Secure. Ik vond het heel leuk. Is iemand hier Xymion gebruik, by the way? Is dat niet cool dat je het moet installeren door het openen met links en dan senden het naar een route shell? En god knows wat er gebeurt, excellent. Ik doe veel over telefonie over de internet, telefonie over IP en volle over IP. En ik schrijf wat artikel van dat Linux journal. Oké, dat is genoeg om me te zeggen. Laten we beginnen op IP versie 4. Als je geen IP versie 4 weet, is hij de doorgeving aan te zien. Moet. Bekijk de korte, maar neem mij niet met die vragen zoals... Ik verwacht je te weten dat een beetje, of niet. Just to refresh your memory. In 1983, it was introduced as TCPIP, meant as a war protocol. So if you want to send data in a war field, like in China or so, apparently on this stage it's very popular to say things about China. You were there this morning, wasn't it great? And it was based on OC, no matter what happens, and that is the thing we should remember, data should always get from A to B, even if a connection fails there's a different route and you will get there in the end. That is the story basically of IP version 4 on the positive side. The protocol is extremely simple. There are some minor issues with IP version 4 and I should have added ICMP this afternoon actually. Sniffing, IP spoofing, lack of possibilities for authentication and denial of surface attacks. We all know them and of course, if you go to a new protocol, the main question is, is this going to change? Yes, there are things you can do about it, but it's not like a total solution and basically there is no solution. If I do telephony and you see a bunch of colleagues of mine standing in line, that is basically to show the queuing before a router, to make fun of them. Basically, you have a phone, you start to dial people and you come up to a router and your call doesn't have any quality. Because it's a war protocol, it's not meant for telephony over the network. It's meant to send data, to send a picture over or something like that. So they call that quality of surface and then you can have a seminar about it and share loads of money. Basically, it's just a poor performance of your network. But they demand more fixed connections and that is typically what IP version 4 is not. So, they found IP version 6 to address these issues. And one of the most important things was the upgrade should be easy. People don't understand the internet now and they sure are not going to understand it when more people are joining. More addresses and people always think this is the main reason why we are going for IP version 6. I mean read an article and everybody shouting over getting more addresses. But we have all types of lame hacks to make the IP version 4 work and if we really want to we could keep that alive. If you want to do it is another question. You want to add a couple of special tags for streaming data en now some people will think, yeah, but that's also available in IP version 4. Yeah, but it was not implemented in all routers and it doesn't then work. Now Cisco promised to do a better job with IP version 6. Right. But the last one is the method for mobile devices. They want to have mobile devices have an IP address and if you take it from that perspective, yes, then you need a couple of extra ones. So they want to have your cell phone to have an IP address. If they're not, if they're now secure, then they definitely not anymore. So they go to 120 bit addresses and it looks a little bit funny. I made up a funny address there as I get it at my at my own computer and it doesn't resemble anything. If you could remember IP addresses, you must be a total geek if you can remember this by heart. Basically you represent each time 16 bits and this makes it very hard to understand. And guess what? One address won't do the trick. We are getting multiple addresses. So if you could remember it, this will ensure you can't anymore. You get a unicast, an anycast, a multicast type address. That means, for instance, if you want to deliver to a single address, I'm addressing that single address. If I want to address a group, I have a special IP address to do that, which of course makes the life of a programmer easy. You just join a group in a multicast address and basically you get all the IP addresses. Now there is no security mechanism that checks if you join a multicast group. Isn't that nice? For all the hackers out here, sorry, there won't be any. For all the persons that want to test network security, just join a group in a multicast session and that's it. That's all you have to do. And IP version 6 will ensure it gets to your desktop just the way you want it. A couple of other things is that you can also make a scope for an address, a local address that will not be rooted at all. A site address that will only be rooted within a certain site, so you make sure it won't reach the internet. Or a global address which can be rooted over the internet. And this is basically their way of securing local traffic to remain local. I call it security by obscurity a little bit, but that is basically the way they do it. Of course you keep a lot out that the moment you have got access to a router and given the latest exploits on Cisco, they are working very hard to provide you that access. It's still very easy to sniff a local network. But at least it's a little bit more protected than it was in IP version 4. For compatibility with IP version 4, there is basically a trick of having only the 32 bits of IP version 4 address. And you thrill that with zeros and 16 ones. So very easy to recognize and you're totally compatible. That means that you can interface from an IP version 6 workstation with an IP version 4 workstation, basically because it's OSI. They also have got special addresses for compatibility with, for instance, IPX. If you want to include IPX into IP version 6 packets, no prop. Go ahead. And that brings us to the headers and they look a little bit funny. The top one is very simple. I've got the IP version 6 header, some type of an extension header, UDP or TCP and some data. Very simple, 40 octets and that is basically the trick. It's the double size of IP version 4, but because of the logic structure it's sometimes easier to route it and you can reach higher speeds, because you now can make a distinction between sites and global addresses. What is cool though is that you can add as many headers as you want. And this is the part people testing security should pay attention. If you look over here, you see an IP version 6 header which can encapsulate IP version 6 or IP version 4. Or IP version 6 can encapsulate IP version 6, can encapsulate IP version 4. Plenty of opportunities to do some nice things about it with that. Also you can have a certain authentication header. IP version 6 has the IPsec security, so-called security mechanism. If you think that secure talk to Bruce Nyer, he's around here somewhere and you'll find that it's not that easy. Sorry, not that safe. My English is sometimes, I'm sorry. A special header is added for routers, for routing, so you can learn what route a package takes. That is an excellent method to do many in the middle attacks. If you just check on a couple of those headers, thank you very much, I've got all the information I need and basically off you go. Fragment headers are the type of headers that say, okay, this is fragment number one, but some other fragments will follow. Since you can change the payload somewhat, it is easy to say, okay, there will be another package after this and basically add data you want to add and do some intelligent things and nobody ever know what happened. They also offer an encapsulation secure payload header which basically means that they securely can add a tunneling information. Again, that is based on PKI, so it's again easy to work around. It's also easy to work around because many implementations that are available currently you can just remove the header and if there's no authentication header, they think like, okay, we're not going to authenticate and that's it. A header in general consists of a version of four bits, a traffic class of eight bits, a flow label, I'll go through each and every one in a second, a payload length, next header and a hop limit. Very interesting is the first one, the version of four bits. If I have a four bit header, sorry, a four bit version field, I can indicate this is an IP version four or an IP version six packet. When it arrives, the stack will make the distinction what it is and hand it to the right stack. That is basically all it does. So you are what they then call backwards compatible. Plenty of stuff to play around with. Traffic class, I told you about this telephony and that you have this poor network quality. By setting the traffic class correctly you can get a priority in a router queue which is basically a very interesting thing but there's still the risk that they are not going to implement it. Also this traffic class is not checked in any way. That means that any application can set it which also means that happened with the quality of surface bit, sorry, the type of surface bit in IP version four already. Everybody all of a sudden is setting that bit. I need priority for my email and basically you're back to square zero. So yes, you do have a lot of more options en if everybody is nice, that's good but in general it doesn't bring the total quality of surface and still you can denial of surface in that way. You still can denial of surface in that way any voice call. In the next header you can also add and that is very interesting a couple of settings like for instance discard this package. Basically I'm sending data in and you don't want to know about it. Discard the package and send ICMP parameter problem message to source. So basically, I get emotional when I talk about ICMP. Basically I'm sending a packet in and the moment it arrives I do nothing with the data so anything can be in there and can use and exploit but I'm sending an ICMP package back. That's the only thing over your needs. And the last one I found very interesting was data may change en route. Some new things and some new implementations of ICMP and I know echo request reply is not new so don't start bugging me about that. There are some new type of errors and one very interesting one is packet too big because it's all defined and it shouldn't be possible but packet too big is something that I think could be very nice exploit when you send just data over and you start sending packet too big God knows what happens. It has not been fully good defined. Packets will be smaller but also it's a very fair chance that you will try to make a different route since every router will add a part to the router header. All of other things are multi-cast listeners for the ones that want to have a multi-cast address and have a multi-cast address. Basically that means I want to join this multi-cast network and you will be added. There is no checking mechanism. You had a question. What operating systems contain a full IPv6 implementation? Very good question and that's why it's one of my next slides. New or not totally new but implemented in IP version 6 is the router solicitation. Ok, I'm new to the network but I'm nearest to routers. That, by the way, is something that has led to a lot of bugs already in the Linux implementation. You have this demon called RedFidiDemon and basically the first versions were so lame that sometimes you didn't see a router and I had to ping from another machine to my machine in order to be able to reach that router else they didn't see each other. Those versions are a lot better now but you're still depending on correct responses. That is definitely something that you can easily denial of surface. Neighbor solicitations. Ok, who is in the room? I mean, don't start shouting but can you imagine if I join this network and I start like, hi, I'm Brenno. Who's in the room? Everybody starts shouting back. What will happen to your network? Net buyers did something similar, didn't it? En de laatste is a redirect message. Don't use that door. Only use that door. Will it come? And there we are. Yes, apparently it will. Cisco delivers routers with IP version 6 since June of this year. And if Cisco does it then apparently it will. Nortel has been doing that for a couple of years now. There is a backbone in Japan currently running IP version 6 and don't forget the telcos and I include Cisco in that. They will push this ahead since it's a big step for voice over IP. Cisco is very aggressive and one of my customers is Philips in the Netherlands and we do voice over IP and apparently Cisco is our major competitor there. So they have a clear interest and we do have a clear interest in pursuing that. Only from a security point of view that's of course a question if you want to do it. Free software is more and more IP version 6 enabled. Linux has had it in all the 2.4 kernels by default already. A lot of 2.2 kernels have it already. And there is a lot of software that is already ready for IP version 6. So yes, it will come. Microsoft slowly starts to support it. They have had a research facility working on that for I believe more than 2 years but they really didn't want to work with that too much yet. They had some challenges with IP version 4 I guess. But they worked them out and now they are really ready for IP version 6. They are now officially supporting it which basically shows that it's a secure protocol because else a company like Microsoft wouldn't do this. But the really comforting thing for me is the last one. Many patches are currently filed and that means that people are using it finding bugs apparently in the lending implementations and with the new version of the kernel sometimes like 8, 9 patches follow up like 3 or 4 days later. So that indicates that at least some people are working with it and are responding to mailing lists. Now how did the designers of IP version 6 see security in general? Request for comment 24-01 defines general security architecture and it speaks of an authentication header or encryption extensions. That might be any encryption you want to add. That of course is very interesting on its own. You can make a security association between two sites. That basically means that we are going to exchange information and we are going to negotiate on a protocol. It's like building a trust in Windows NT. That's a bad example. We are just going to exchange and to negotiate the protocol. That's basically it. It's logic that if we are going to do it it's possible that I can have a bunch of people where I have a security association with. There are two modes I can work with. The tunnel mode or the transport mode. The tunnel mode basically is meant but for instance I've got the IP version 6 connection with you and some part of it is IP version 4. Then I can pack IP version 4 into IP version 6 into IP version 4 and still have my IP version 6 connection with all my features. Of course a weak link then is IP version 4. Authentication is basically 32-bit word, so 96-bit authentication with integrity checking and authentication of the data origin. There is an optional anti-replace service. I wonder who requested that. It is mostly based on IPsec, but not totally. I mean if you want to run another protocol it is possible. By the way I'm still amazed about this anti-replace service because if you make a little patch to the stack you can disable that. I mean if you run Linux and you can code a little bit if you can type the pound sign then you can change a lot already. Some new security issues in this also fantastic protocol. Privacy violations. If I can authenticate everybody that sends data to me how are we looking on privacy? Sorry privacy you say in America, don't you? How am I looking at privacy then? That is currently a big issue and of course the industry is saying not to worry about that we are trustworthy. Microsoft as number one. But without joking that is a serious issue. If you can't buy something online anymore because they do want to check your source address because they've got a lame credit card system that basically you have to do it. I mean all you have you can't buy anymore but it does affect you and it makes it so much more proprietary. Apparently there is a bug in the mobile version of IP version 6 and I wrote this so vaguely because I really tried to find more information on that but nobody wants to tell me or talk about it it's not basically a problem IEEE doesn't know really what it's all about et cetera but they are working on the new standard again. IPSec in general despite the objections from BlueSniper it doesn't really work because there isn't the authority that handouts keys. Ja of course or Hillstorm in general there isn't an authority and who should that be? Interdick? I don't think so. The processing demand on the devices are very heavy which doesn't really matter for PC but if you want to have it on mobile devices and that is one of their aims it is a big issue by the way I'm also wondering how they are going to solve.net then because they want to run that on mobile devices as well. With this new protocol you run into double exploits if I'm tunneling on IP version 4 what does that mean? Am I now all of a sudden more vulnerable? Or can I make the other site an IP version 4 site and don't I have to do any authentication anymore because it's not in IP version 4 and don't forget ICMP has been extended so all the people that now turned off ICMP are most likely if you're going to use IP version 6 turn it on again over here we'll thank people for that. Some cards on the table on the old issues the man in the middle attack well I have to admit IP version 6 is really optimized for man in the middle attack now. You can do so many nice things within the header to make it to flow your way and if you think authentication is going to solve the problem no it's definitely not because it's just a header sending a signature but it's not over it's the signatures over all the data they think but that's definitely not true it's just like hello it's me I'm Brenno and I'm sending you data after that I can do with the data whatever I want and that's always the worst position to be in you think you're secure but you're not sniffing etherrule is already IP version 6 enabled so that's no problem spoofing addresses I don't see a reason sincerely why I shouldn't be able to spoof addresses ok if you do authentication it's a little bit harder but since there's no key authority I think that wouldn't be too much of an issue even if they use authentication I really wonder if they are going to use authentication at all and of course we have the professional end to end screw ups how about .net I do want to talk about it for a couple of seconds don't you just love that forget about the firewall why do we need it we have an HTTP tunnel and that will run our program our program will compile on your computer and it will run twice as fast as all of our other official basic applications and no matter what security you took with IP version 6 it doesn't matter a single bit anymore because it will go through the other side and it will run there and you don't even have to worry about the firewall mails with scripts those type of things, web scripts they are all still there so it's just a new transport mechanism which does have a lot of advantages but from a security point of view it doesn't even solve it as by the way Bruce Schneier said earlier this week every version of Windows that's released things are worse I think every version of IP that is released you could say the same DevCon will definitely go on if IP version 6 comes there so I would like to thank you for your attention thanks that you joined me so right in time and I hope to see you next year again are there any questions by the way ja de sequencing has been changed in IP version 6 so it is now if I'm not mistaken because I haven't researched that myself too much if I'm not mistaken IP version 6 now just sequentially adds numbers so it's like a straight numbering scheme in general TCP itself that remains the same yeah I don't think everybody can hear it I'm saying it's right now generally with packet sequencing in TCP is considered pretty safe at this point and I think it'll just continue to be safe even with IPv6 as long as people make educated decisions when they're writing applications so I don't think that the network layer really has much to do with that sort of yeah being safe by the way state of mind so yeah yeah yeah that's absolutely true yeah they make tell them now it's kind of amusing I was at a Defcon thing 2 years ago they saw IPv6 maximum packet size is 1 gigabyte so have fun I would love to see the CRC of that by the way when is it going to be widely deployed I think it will be played soon yes Microsoft is now formally supporting it Cisco is rolling it out in its routers I think in a year or two it will be like seriously seriously deployed currently of course you have got networks and go to an IT manager and say hey let's go to IPv6 you have to have a damn good reason at this point you don't but I think that's just a matter of time Japan is really fond of IPv6 and their government is spending a lot of money on it any other questions ok thank you all for being here