1. Possible Attacks based on IPv6 Features and Its Detection
Zhaowen Lin
Presented by: Xiaohong Huang
Beijing University of Posts and Telecommunications
2007 APAN Meeting
Xi’an, 27/08/2007
2019/10/12

2. Outline 1 2 3 4 5 BACKGROUND TAXONOMY OF ATTACKS NDP DETECTOR
TESTING AND RESULTS 4
CONCLUSION 5

3. Background
Following the current IPv4 address assignment model and trend, the lifespan of IPv4 could still last for some years, but, the IPv6 is the future
The research, development and deployment of IPv6 is inevitable trend in the world

4. Background IPv6 in wireless environments Security problems
Wireless LANs at airports, hotels and cafes, etc.
Security problems
It is fairly easy to set up a phony WLAN base station, leading to various kinds of access stealing, Scan, DoS, and man-in-middle attacks.
More attentions are needed on this point.

5. Contribution of the paper
This paper aims to solve the possible attacks pertinent to current IPv6 Neighbor Discovery Protocol (NDP).
One NDP Detector is proposed to avoid untrustworthy nodes to launch various kinds of attacks.

6. TAXONOMY OF ATTACKS Scan Attack MitM (man-in-the-middle ) Attack
DoS (Deny of Service) Attack

7. Scan Attack

8. MitM Attack

9. DoS Attacks DoS (Deny of Service) Attack Bogus On-Link Prefix
Bogus Address Configuration Prefix
DAD Spoofing
Bogus Address DoS Attack
Parameter Spoofing
Smurf6 Attack
PMTU Attack

10. Smurf6 Attack

11. NDP DETECTOR

12. TESTING AND RESULTS
As we discussed above, there are several types of attacks based on IPv6 features. We designed and implemented an IPv6 attack tool and a detector. In this section, they are used to launch attacks and do the detection. The tests are carried on the BUPT NOC of CERNET2, including scan attacks, DoS attacks and MitM attacks. The results are showed in Table .

13. CONCLUSION
Possible attacks pertinent to current IPv6 Neighbor Discovery Protocol are introduced.
One detector is developed to detect possible attacks.
Results show that the attack methods are feasible and the detection logics are effective.
Due to the fact that Secure Neighbor Discovery (SEND) forwarded by IETF SEND Group is too complex to be applied to actual network, our detection methods will be an efficient method to low the damages to a certainty.

14. Thank You !
　　返回