Re: [v6ops] preventing denial of service in IPv6

["Metzler, Dan J" <[e-mail]>]

With regard to the notion that IPv6's large (source) address space
"...also gives attackers a potential advantage over defenders w.r.t. resource depletion attacks compared to the scarcity of source addresses in IPv4"

I mentioned this before, so don't want to dwell on it too much, but think it is important to understand the problem from a real world perspective.  An address does not deplete resources.  It takes an interface with CPU and memory to do that.

"If an attacker compromises an important server in a corporate network, and the corporation have been sloppy and only applied BCP38 egress filtering at the external boundary at /32 level (rather than individual filters at each /64 per LAN) that could form a very attractive attack platform (2^32/2^64 potential /64 prefixes = equivalent to the entire current Internet address space sourced from a single machine)."

The important point is, with regard to resource depletion, this is a still single machine, and in the context of DOS attack platforms, is usually insignificant without additional systems from which to launch the attack.  Indeed utilizing that many addresses during an attack carries with it some significant overhead that would take away from the effective throughput in this scenario.
The real concern in the stated scenario is the randomly changing source addressing that might evade detection other than the fact that it is all coming from the same subnet.  (That in itself ought to be a useful clue for the corporate network admins of the compromised system, if they are looking to detect the issue.)

When we think about this from a comparison to IPv4, the change is not in the amount of resources that can be dedicated to the attack, but in the potential identities from which they are sourced.

Certainly the massive address space could lead to significant abilities to attack other systems, but it requires more than just address space.  It requires a corresponding investment in network throughput and endpoints that can initiate the attack.
While we think about these issues, I think it is important to not lose sight of that.

Thanks,


-          Dan



From: Ray Hunter (v6ops) [mailto:[e-mail]]
Sent: Wednesday, November 25, 2015 8:12 AM
To: Nikos Mavrogiannopoulos <[e-mail]>
Cc: Metzler, Dan J <[e-mail]>; [e-mail]
Subject: Re: Re: [v6ops] preventing denial of service in IPv6



Nikos Mavrogiannopoulos wrote:




Then a single user can exhaust a server's resources by simply

attacking the server with all his available addresses.

FWIW I agree with the original premise that IPv6's large (source) address space is a blessing, but also gives attackers a potential advantage over defenders w.r.t. resource depletion attacks compared to the scarcity of source addresses in IPv4.

I think the problem here is that attackers may also have access to a /32 .. /48 /52 /56 or /60, as well as /64.

If an attacker compromises an important server in a corporate network, and the corporation have been sloppy and only applied BCP38 egress filtering at the external boundary at /32 level (rather than individual filters at each /64 per LAN) that could form a very attractive attack platform (2^32/2^64 potential /64 prefixes = equivalent to the entire current Internet address space sourced from a single machine).





--
regards,
RayH