(click image for larger view)
In particular, someone with malicious intent could "impose a parasitic IPv6 overlay network on top of an IPv4-only network, so that an attacker can carry out man-in-the-middle attacks on IPv4 traffic," said Alec Waters, a security researcher for InfoSec Institute, in a blog post. While his proof-of-concept attack scenario targets Windows 7, it should also work against Windows Vista, Windows 2008 Server, or "any operating system that ships with IPv6 installed and operational by default," he said.
The attack works by introducing an IPv6 router into an IPv4 network, but only connecting the router to the IPv4 Internet. Using router advertising (RA) to create addresses--via a process known as Stateless Address Auto Configuration (SLAAC)--the attacker can control where traffic travels. Next, an attacker can use NAT-PT, "an experimental protocol used to connect IPv6 only networks to the legacy IPv4 network," said Johannes Ullrich, chief research officer for the SANS Institute, in a blog post that analyzes this so-called SLAAC attack.
"By combining the fake RA advertisements with NAT-PT, the attacker has the ability to intercept traffic that would normally use IPv4," he said. "To make things more interesting, if a host has IPv6 and IPv4 connectivity, the IPv6 connection is preferred, causing this attack to work even better."
One mitigating factor, however, is that an attacker would have to physically place a router in the targeted environment--although that could also be a public Wi-Fi hotspot.
This vulnerability was filed with MITRE on April 6, though a Windows fix was absent from this month's mega-Patch Tuesday.
But is this a vulnerability or a feature? In fact, there's a dispute over whether this is a bug at all. According to the MITRE vulnerability listing, "it can be argued that preferring IPv6 complies with [the IPv6 protocol], and that attempting to determine the legitimacy of an RA is currently outside the scope of recommended behavior of host operating systems."
"The severity of the attack is disputed, because this is the default configuration of Windows Vista/7/2008 OSes, and it also follows the RFC recommended implementation of a 'dual stack' (IPv4 and IPv6) network stack," said Jack Koziol, a senior instructor and security program manager at InfoSec Institute, and co-author of The Shellcoder's Handbook: Discovering and Exploiting Security Holes, in an email interview. Regardless of how it's labeled, he said, IPv4 is still "vulnerable to the traffic interception and the SLAAC attack."
The IPv6 story has been a tale of slow adoption. But as IPv4 addresses dwindle, organizations have been urged to increase their adoption of IPv6, for which a standard was developed by the Internet Engineering Task Force (IETF) in 2003. Even the White House has put its muscle behind such a message, releasing a transition tool to emphasize the importance of adopting the newer protocol.
So, how can IPv4-using organizations protect themselves against a SLAAC attack? "IPv6 is a wonderful protocol. But if you don't need it: Turn it off. If you need it, then monitor and defend it like IPv4," said Ullrich.
Interestingly, there's a defense against the SLAAC attack, known as the Secure Neighbor Discovery (SEND) protocol, said Koziol. Except that Microsoft doesn't use SEND in its current products. "It seems after the engineers from Microsoft and Ericsson finished writing the IETF document, they also wrote and filed a patent on the process. So Microsoft has concerns implementing SEND, due to legal concerns with Ericsson," he said.
