Possible Attacks based on IPv6 Features and Its Detection Zhaowen Lin Presented by: Xiaohong Huang Beijing University of Posts and Telecommunications 2007 APAN Meeting Xi’an, 27/08/2007 2019/10/12

Outline 1 2 3 4 5 BACKGROUND TAXONOMY OF ATTACKS NDP DETECTOR TESTING AND RESULTS 4 CONCLUSION 5

Background Following the current IPv4 address assignment model and trend, the lifespan of IPv4 could still last for some years, but, the IPv6 is the future The research, development and deployment of IPv6 is inevitable trend in the world

Background IPv6 in wireless environments Security problems Wireless LANs at airports, hotels and cafes, etc. Security problems It is fairly easy to set up a phony WLAN base station, leading to various kinds of access stealing, Scan, DoS, and man-in-middle attacks. More attentions are needed on this point.

Contribution of the paper This paper aims to solve the possible attacks pertinent to current IPv6 Neighbor Discovery Protocol (NDP). One NDP Detector is proposed to avoid untrustworthy nodes to launch various kinds of attacks.

TAXONOMY OF ATTACKS Scan Attack MitM (man-in-the-middle ) Attack DoS (Deny of Service) Attack

Scan Attack

MitM Attack

DoS Attacks DoS (Deny of Service) Attack Bogus On-Link Prefix Bogus Address Configuration Prefix DAD Spoofing Bogus Address DoS Attack Parameter Spoofing Smurf6 Attack PMTU Attack

Smurf6 Attack

NDP DETECTOR

TESTING AND RESULTS As we discussed above, there are several types of attacks based on IPv6 features. We designed and implemented an IPv6 attack tool and a detector. In this section, they are used to launch attacks and do the detection. The tests are carried on the BUPT NOC of CERNET2, including scan attacks, DoS attacks and MitM attacks. The results are showed in Table .

CONCLUSION Possible attacks pertinent to current IPv6 Neighbor Discovery Protocol are introduced. One detector is developed to detect possible attacks. Results show that the attack methods are feasible and the detection logics are effective. Due to the fact that Secure Neighbor Discovery (SEND) forwarded by IETF SEND Group is too complex to be applied to actual network, our detection methods will be an efficient method to low the damages to a certainty.

Thank You ! http://ipv6.bupt.edu.cn 　　返回