Re: [dnsext] A security concern regarding IPv6 support in name servers

[Nicholas Weaver <[e-mail]>]

On Sep 20, 2010, at 5:28 AM, Alfred HÎnes wrote:

> I have been pointed to a paper by H. D. Moore published in 2008,
> "Exploiting Tomorrow's Internet Today - Penetration Testing with IPv6",
> available at <http://uninformed.org/?v=10&a=3&t=pdf>.
> 
> On page 3, this paper points out that Bind running on an IPv6-enabled
> system, unless its serving socket is bound to a specific IPv6 (unicast,
> interface-assigned) address of the system, also listens to multicast
> traffic (the memo apparently confuses the terms "broadcast" and
> "multicast") and will also respond to DNS queries received over IPv6
> multicast (e.g., to FF01::1).  This could be leveraged for discovering
> nodes and for various amplification / DoS attacks.

Except that if you are on the multicast domain of the victim, the victim is already screwed for reconnisance, because the other systems (eg, Macs, windows, etc) use multicast link-local and network-local IPv6 a lot for autoconfiguration.  

Just listening, let alone generating, traffic to the link local multicast will pretty much tell you everything in the network you might want to exploit.

ANd in fact the victim is just screwed because you can use ICMP6 router advertisements etc to direct the victim's internet traffic wherever you want to go.

Basically, if an attacker is within your IPv6 subnet (so link-local/site-local multicast works) you are totally lost.


And thus responding to requests on multicast is probably a Good Thing, as it enables inside-the-perimeter autoconfiguration and fallback, multicast-dns support, etc.