Download Guide

Despite these enhancements, however, the whole architecture is still missing that level of security and flexibility expected. As result of these known limitations, a new project for a new Internet Protocol has been designed by the IETF in the early 90′, having in mind “ease-of-configuration”, performance and security. In this post we will analyze the features of the new suite of internet protocols,its advantages and disadvantages, as well as the possible implications from a security point of view. 

To better understand the actual new features of IPv6, we must first know its predecessor’s. As already mentioned, IPv4 was designed with no security in mind. This means that security in communications through this suite of protocols must or should be guaranteed by “end-nodes”. If I need to send or receive highly sensitive data, and then use a secure channel (encryption?), it’s the responsibility of that application to provide that service. Currently, the Internet works this way. This, and many others characteristics that will not be covered in this post, has allowed various types of threats to take off in the digital world. The most famous of these are certainly:

This type of attack takes place thanks to the relative small size of IPv4 addressing, because a whole network can be scanned to find open and/or unpatched services. In fact, it is quite easy to perform a reconnaissance scan of a class C network in a few minutes. In this category we can add “Ping Sweep” (sweep a network with ICMP ping messages that solicit a reply), “Port Scan” (to find active and reachable services) and “Application Vulnerability Scan” (to find known vulnerabilities in discovered services).

In this type of attack, a service is rendered unavailable through a flood of large amounts of illegitimate requests. It’s possible to mention for this category the smurf attack (remember?).

The lack of its own authentication mechanism in communications allows hackers to intercept data in transit.

In IPv4, ARP (Address Resolution Protocol) is responsible for mapping a host’s IP address with its physical MAC address. This information is stored locally (ARP Table) by each host which is part of the communication. The “ARP Poisoning” attack occurs when an arbitrary ARP reply with incorrect information inside is sent to a host which is part of the communication, implying that legitimate packets will arrive at unforeseen destinations.

In the current communication protocols, one of the keys to complete cyber attacks is the ability to modify the source address of a packet. IPv4 allows this possibility since it does not provide any type of source-to-end authentication mechanism. Today these types of attacks are used to spread spam, malware and also to perform DoS/DDoS attacks. IP spoofing also allows masking the true origin of the malicious packets, making the tracking operations more complex.

Malware, today, remains one of the biggest security-related problems. Currently, with IPv4, malware can not only damage the host affected, but also saturate (or use part of) the network resources in place. It’s necessary to clarify that, with the advent of IPv6, there was no way to eradicate these threats, and the conception of the potential damage by malware infection will essentially remain the same. It’s possible to assume that, however, due to the broader spectrum of addressing, its spread could be slower.