投影片 1

Size: px

Start display at page:

Download "投影片 1"

婉皮
5 years ago
Views:

1 IPv6 安全防護中華電信研究所朱彥如

Security Risks Attacker Community 駭客開始透過 IPv6 來攻擊 IPv4/IPv6 網路 Security controls must be IPv4 and IPv6 aware 新的作業系統不僅支援 IPv6, 且預設啟動 IPv6 Unauthorized IPv6 Clients Locate and disable any IPv6 enabled

2 Security Risks Attacker Community 駭客開始透過 IPv6 來攻擊 IPv4/IPv6 網路 Security controls must be IPv4 and IPv6 aware 新的作業系統不僅支援 IPv6, 且預設啟動 IPv6 Unauthorized IPv6 Clients Locate and disable any IPv6 enabled equipment. Block IPv6 and IPv6 tunnel traffic at the perimeter. Include IPv6 policies in the organization s security plan. 傳統的 L2 攻擊 Security Risks Vulnerabilities 主要作業系統中隱藏的弱點 L3 attacks due to ICMPv6 ND and auto-configuration The deployment of IPv6 reinforces the basic security lessons learned with IPv4 將提高管理的複雜度 Dual Operations Administrators will need to maintain the same level of coverage for both protocols to mitigate risks. Vendor Support 許多 vendors 仍持觀望態度, 或僅支援部份功能 2 資料來源 : NIST

model Blocking scan at the network perimeter and limit inbound connections I Generating addresses with privacy extension Assigning addresses with

3 Addressing Security Numbering Plan Mostly operational concerns. A good numbering plan will streamline security operations Addressing Security Problems with EUI-64 addresses Potentially reveal the make and model Blocking scan at the network perimeter and limit inbound connections I Generating addresses with privacy extension Assigning addresses with DHCPv6. Address management Manually configured addresses for servers, DHCPv6 or auto-configuration for clients Privacy extension Using privacy extensions for external communications but not for internal communications. 3 資料來源 : NIST

Transition Mechanisms Dual Stack A consistent security policy is needed for both IPv4 and IPv6 Pay attention to new IPv6 functionality Unexpected tunneling between the hosts may occur and violate

4 Transition Mechanisms Dual Stack A consistent security policy is needed for both IPv4 and IPv6 Pay attention to new IPv6 functionality Unexpected tunneling between the hosts may occur and violate security policies. Organizations must upgrade IDS The performance of security systems may degrade when handling IPv6 Transition Mechanisms Tunneling Use urpf and tunnel endpoint filtering at both tunnel endpoints. Block IPv4 Protocol 41 Use an Intrusion Detection and Prevention System (IDPS) Translation Security Issues for NAT-PT IPsec may not be compatible. DNSSEC may not be compatible. DOS attack is possible with address pools or reassembling fragments New mechanisms are developed to replace NAT-PT 4 資料來源 : NIST

5 IPv6 Network Infrastructure Security Router Security Infrastructure Security 5

6 Router Security Good infrastructure security starts with good router security Like on any system: Use VTY (virtual TTY) ACLs Avoid easy-to-guess passwords and use an AAA system Avoid shared accounts and use privilege levels Turn off unneeded services Activate logging (but not too much!) Etc. Same work for both IPv4 and IPv6 6

7 Infrastructure Security Filtering routing information and filtering traffic are complementary BGP and DNS are the core protocols Infrastructure Protection ACLs Should be deployed at network ingress points For infrastructure and transit traffic For BGP routing 7

8 IPv6 ACLs for Traffic! Configure the access list. ipv6 access list iacl! Deny your space as source from entering your AS.! Deploy only at the AS edge. deny ipv6 YOUR_CIDR_BLOCK_IPV6 any! Permit multiprotocol BGP. permit tcp host bgp_peer_ipv6 host router_ipv6 eq bgp permit tcp host bgp_peer_ipv6 eq bgp host router_ipv6! Deny access to internal infrastructure addresses. deny ipv6 any INTERNAL_INFRASTRUCTURE_ADDRESSES_IPV6! Permit transit traffic. permit ipv6 any any 8

9 ACLs Considerations ACLs provide security against: Operational mistakes (mis-configuration) Bugs on the router (vulnerabilities) Issues with ACLs Breaks transparency As a consequence, makes troubleshooting harder Hard to deploy if core address space is not contiguous, or not easily expressed in an ACL Hardware does not support line speed ACLs on all platforms Hard to maintain (when core address space changes) 9

10 BGP Bogon Filters The 6bone prefixes out of 3FFE::/16 are explicit denied 2001::/32 only permits the /32, no more-/less-specifics (Teredo) 2002::/16 only permits the /16, no more-specifics (6to4) 0000::/8 is denied (loopback, unspecified, v4-mapped) FE00::/9 and FF00::/8 are denied (link-local, site-local, multicast ranges, RFC3513) The IPv6 documentation prefix 2001:db8::/32 (and all more specifics of it) is explicitely denied All the rest of the IPv6 unicast address space is permitted up to reasonable sizes 10

11 BGP Bogon Filters Relaxed 6Bone Documentation Teredo 6to4 loopback, unspecified, v4-mapped More specific routes up to /48 It accepts more specific routes up to /48 from the RIR (2000::/3) ranges. Configuration Example: ipv6 prefix-list ipv6-ebgp-relaxed deny 3ffe::/16 le 128 ipv6 prefix-list ipv6-ebgp-relaxed deny 2001:db8::/32 le 128 ipv6 prefix-list ipv6-ebgp-relaxed permit 2001::/32 ipv6 prefix-list ipv6-ebgp-relaxed deny 2001::/32 le 128 ipv6 prefix-list ipv6-ebgp-relaxed permit 2002::/16 ipv6 prefix-list ipv6-ebgp-relaxed deny 2002::/16 le 128 ipv6 prefix-list ipv6-ebgp-relaxed deny 0000::/8 le 128 ipv6 prefix-list ipv6-ebgp-relaxed deny fe00::/9 le 128 ipv6 prefix-list ipv6-ebgp-relaxed deny ff00::/8 le 128 ipv6 prefix-list ipv6-ebgp-relaxed permit 0::/0 le 48 ipv6 prefix-list ipv6-ebgp-relaxed deny 0::/0 le 128 link-local, multicast 11

12 HiNet 資安產品 12

13 HiNet 防毒防駭產品諾頓防毒防駭 2011 (Internet Security 2010) 諾頓防毒 2011 (Antivirus 2010) PC-cillin 2011 防毒防駭 (TIS Pro) 13

14 HiNet 防毒防駭產品之 IPv6 支援產品最新版本 IPv6 支援版本 / 時間標誌 Norton 防毒 / 網路安全大師 2011 防毒 / 網路安全大師 2007 趨勢科技 PC-cillin 2011 PC-cillin

15 防火牆設定 (1/2) 15

16 防火牆設定 (2/2) 16

17 防火牆功能 Windows XP Hinet 防毒防駭 http 2001:CA0:1:100:: IPv6 及 IPv4 的 http 對外連線都被攔截 17

18 電子郵件防護 Outlook 2007 on Windows XP Hinet 防毒防駭 IPv4 IPv6 IPv4/IPv6 Mail Server 18

19 結論與建議 IPv6 is no more or less secure than IPv4 Similar techniques should be used for IPv4 and IPv6 要特別注意 IPv6 新功能及轉移機制防護應及早投入以取得相關維運經驗及實際佈建方案目前資安產品已陸續支援 IPv6, 但功能完整性仍無法與現有 IPv4 相比, 本公司將與合作廠商持續加強 IPv6 防護功能隨著部分系統預設啟動 IPv6,IPv6 資安已是不可避免之議題, 建議使用者或網管人及早投入 IPv6 安全防護 19

財金資訊-80期.indd

財金資訊-80期.indd IPv6 / LINE YouTube TCP/IP TCP (Transmission Control Protocol) IP (Internet Protocol) (node) (address) IPv4 168.95.1.1 IPv4 1981 RFC 791 --IP IPv4 32 2 32 42 IP (Internet Service Provider ISP) IP IP IPv4