Luke Judge

The tool, dubbed VoodooNet or v00d00n3t, uses the ability of most computers to encapsulate next-generation network traffic, known as Internet Protocol version 6 (IPv6), inside of today’s network communications standard, or IPv4. Because most security hardware appliances and host-based intrusion detection programs have not been programmed to inspect IPv6 packets in depth, data can bypass most network security, said independent security researcher Robert Murphy, who presented the tool at the DEFCON hacking conference last weekend.”Most network hardware only knows to pass the traffic along,” Murphy said. “For example, the Windows firewall does not handle IPv6 so these packets pass right though.”The tool takes advantage of a lack of understanding of many of the issues that the next-generation network data standard poses to organization’s network security. the U.S. federal government and many major corporations are transitioning to the standard by the end of the decade. the U.S. Department of Defense and the White House’s Office of Management and Budget have mandated that the military services and federal agencies move their backbone systems to IPv6 by June 30, 2008.While many network security applications have not been programmed to inspect IPv6 data, the standard is widely supported by routing software. Linux, Mac and Windows XP allow IPv6 networking for compatibility, while Microsoft’s next-generation operating system, Vista, uses the standard as the default networking protocol. Microsoft supports wrapping IPv6 packets inside of IPv4 data, known as 6to4 tunneling, so that networks sending data using IPv6 can communicate across the Internet, which mainly runs IPv4. Most routers also support the next-generation networking standards as well.Transitioning technologies always poses problems for security managers, said Joe Klein, a network expert with the North American IPv6 Task Force and a senior security consultant with Honeywell.”We are expecting a lot here to be discovered and disclosed,” Klein said. “But just like the early implementation of any technology, we expect to find defects and covert channels.”The tool uses Internet Control Message Protocol version 6, or ICMPv6, to send ping packets from one computer to another, hiding information in certain fields of the packets without violating any existing Internet Request for Comment (RFC)–the documents that set the technical guidelines for Internet technology. The packets have a target address for the network where the recipient PC resides and a key, which identifies which covert PC on that network is the destination. the stealthiest mode only sends a single byte per ping, but up to 32 bytes can be sent, sacrificing stealth for throughput.Klein believes that the communications would not be detected by existing IPv4 devices, and that bot nets, among other threats, could use the technology for stealthier command and control channels. However, programming devices with knowledge of IPv6 could easily detect the channel.”The solution is network devices that understand IPv6 better,” Klein said. “Intrusion detection systems that fully implement IPv6, for instance.”He also points to one feature of the system that could give away any PCs that are taking part in covert communications using the tool: the initial version of the tool sets the endpoint computers to listen in promiscuous mode to pick up data sent to their network.Dan Kaminsky, a well-known network security expert, points out that covert channels are nothing new, and while an implementation using ICMP packets may not have been created yet, sending data using 6to4 tunneling has been around for a few years.”Yes, firewalls need to be more aware that these transition technologies exist and need to handle them better,” Kaminsky said. “But ICMP tunnels have existed for, what, 10 or 15 years? Doing it using IPv6 is not difficult. you break into a box and hit IPv6 enable.”While the technique may work today, as more companies start deploying IPv6, security will quickly catch up.

Business News military services, network security applications, next generation network