DeepSec 2014 Talk: Safer Six – IPv6 Security in a Nutshell

René Pfeiffer/ October 20, 2014/ Conference, Internet, Interview

The Internet Protocol Version 6 (IPv6) is the successor to the currently main IP Version 4 (IPv4). IPv6 was designed to address the need for more addresses and for a better routing of packets in a world filled with billions of networks and addresses alike. Once you decide to develop a new protocol, you have the chance to avoid all the mistakes of the past. You can even design security features from the start. That’s the theory. In practice IPv6 has had its fair share of security problems. There has been a lot of research, several vulnerabilities have been discussed at various security conferences. DeepSec 2014 features a presentation called Safer Six – IPv6 Security in a Nutshell held by Johanna Ullrich of SBA Research, a research centre for information security based in Vienna. She answers questions about the content of the talk and the ongoing research in IPv6 security.

• Please tell us the top 5 facts about your talk!
  IPv6 is the successor of nowadays IPv4 protocol and overcomes address depletion due to offering 2^128 distinct addresses. However, the protocol lacks security and privacy and vulnerabilities are found in the novel extension headers, neighbour and multicast listener discovery or tunnelling. Analysing them, I infer three major challenges with respect to IPv6: First, all of today’s address formats have at least one serious shortcoming and effort is required for the development of a secure while maintainable addressing system. Second, security on the local network practically does not go beyond IPv4’s although a number of approaches have been presented. Last but not least, reconnaissance is still an advantageous aspect in networking and appropriate techniques have to be developed.
• How did you come up with it? Was there something like an initial spark that set your mind on IPv6?
  Writing my master thesis on the compression of secure communication in powerline systems, I encountered IPv6 for the first time. Starting at SBA Research afterwards, I was able to devote my first six months to intensive IPv6 studies including standards, scientific publications and community boards. I realized that an in-depth knowledge of the protocol requires a lot of time and people could benefit by providing this knowledge in a nutshell.
• Why do you think this is an important topic?
  IP is THE Internet Protocol and the Internet a vital part of almost everybody’s life. So, I doubt that anybody will be able to go round IP’s new version 6. Is this single reason enough to convince you?
• Is there something you want everybody to know – some good advice for our readers maybe? Except for “come to my talk”. 🙂
  Don’t condemn IPv6, but neither praise it to the skies. It is just another protocol having its advantages and disadvantages.
• A prediction for the future – what’s next? What do you think will be the next innovations or future downfalls – for IT-Security in general and / or particularly in your field of expertise?
  I am worried of today’s “Yes-we-can”-mentality of bringing everything online — your coffee machine, your car or automation systems or the smart grid. These systems have been developed being stand-alone, connecting them to the Internet in some way does violate their primary specification and may induce serious security risks. Even worse, are the threats induced by a vulnerability: While in traditional IT this might result in non-availability and economic loss, this may expand to life-threatening situations, e.g., in an automation system or your car.

Despite the fact that most of the Internet still uses IPv4, don’t forget that IPv6 is widely available by packet tunnels. Modern operating systems have built-in IPv6 connectivity by these tunnels, so the problems discussed in this presentation are not something you have to deal with in the far away future. Therefore we recommend Johanna’s talk for everyone using the Internet.

In addition we wish to point out that DeepSec 2014 also features an in-depth IPv6 security workshop titled IPv6 Attacks and Defenses – A Hands-on Workshop held by Enno Rey of ERNW GmbH.