{"id":228049,"date":"2013-03-04T16:53:34","date_gmt":"2013-03-04T15:53:34","guid":{"rendered":"https:\/\/securite.intrinsec.com:443\/?p=758"},"modified":"2013-03-04T16:53:34","modified_gmt":"2013-03-04T15:53:34","slug":"ipv6-et-la-securite-nouvelles-du-front-fevrier-2","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/ipv6-et-la-securite-nouvelles-du-front-fevrier-2\/","title":{"rendered":"IPv6 and security: news from the front \u2013 February"},"content":{"rendered":"

Published articles<\/strong><\/p>\n

Arbors Networks has published its annual report Worldwide Infrastructure Security Report<\/a>. One chapter is dedicated to IPv6: "IPv6 Observations." Among the numerous graphs, we can note that the main security concern related to IPv6 is DDoS attacks, and no longer the differences between IPv4 and IPv6 as was the case last year. The second concern remains configuration errors.<\/p>\n

The report includes some figures and graphs concerning SPAM and IPv6. 2013 Cisco Annual Security Report<\/a> from Cisco. We learn that, while emails sent with IPv6 are increasing sharply (+862 % between June and December), the amount of SPAM sent with IPv6 is experiencing a much smaller increase (+171 %).<\/p>\n

Scott Hogg published an article entitled Using Dual Protocol for SIEMs Evasion<\/a>. After addressing topics such as the doubling of the attack surface with IPv6 and the compatibility of security tools with IPv6, the author raises an interesting question: is a SIEM compatible with networks dual-stack<\/em> If a hacker compromises a server by attacking its IPv4 address, and then compromises a second server by attacking its IPv6 address, will the attack be identified by the SIEM?<\/p>\n

 <\/p>\n

Videos<\/strong><\/p>\n

A video in which Eric Vyncke talks about SEND has been published: Secure Neighbor Discovery << IPv6 Security << ipSpace Webinars \u2013 demo site<\/a>. In a few minutes, he presents SEND, its complexity, deployment difficulties, possible attacks, current support, and ends by talking about an alternative, SAVI.<\/p>\n

 <\/p>\n

Tools<\/strong><\/p>\n

A new version of the tool suite IPv6 Toolkit<\/a> has been published. Significant improvements have been made, notably to the scan6 tool, which is now the "most comprehensive" IPv6 mapping tool. It offers "advanced IPv6 scanning techniques." The release of this version was also followed by various discussions and articles on the subject online: Scanning for IPv6 addresses embedding TCP\/UDP service ports<\/a>, IPv6 Toolkit 1.3 fun \u2013 scan6<\/a>.<\/p>\n

 <\/p>\n

Vulnerabilities<\/strong><\/p>\n

George Kargiotakis published an article on his blog detailing the results of his recent research: Linux kernel handling of IPv6 temporary addresses \u2013 CVE-2013-0343 | Into.the.Void.<\/a>. He identified two vulnerabilities affecting the Linux kernel:<\/p>\n