Subject: Address Scanning Document comments

From: Fred Baker <[email-masked]>
Date: Wed, 22 Mar 2006 18:04:21 -0600

>    It is also worth noting that worms that spread by scanning target
>    networks for hosts to re-attack have become more common in recent
>    times.  Thus a much more sparsely address-populated IPv6 network  
> will
>    have a more innate defense to such forms of worm infection,  
> although
>    there may still be significant scanning traffic generated.

I hear this comment, taken from the draft, a lot, and I'm not as sure  
that it is true. Finding the hosts on a remote LAN will require the  
use of different techniques, but I'm not at all sure they will be  
hard to find.

For example, when you receive this email, it will have a number of  
'receive' lines. In case you have forgotten how to manage your email  
tool, they look something like this:

> Received: 	from xbh-sjc-231.amer.cisco.com
> ([128.107.191.100]) by xmb-sjc-225.amer.cisco.com with Microsoft
> SMTPSVC(6.0.3790.211); Wed, 22 Mar 2006 15:21:53 -0800
> Received: 	from sj-iport-5.cisco.com ([171.68.10.87]) by
> xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211);
> Wed, 22 Mar 2006 15:21:52 -0800
> Received: 	from sj-core-4.cisco.com ([171.68.223.138]) by
> sj-iport-5.cisco.com with ESMTP; 22 Mar 2006 15:21:54 -0800
> Received: 	from xbh-sjc-211.amer.cisco.com
> (xbh-sjc-211.cisco.com [171.70.151.144]) by sj-core-4.cisco.com
> (8.12.10/8.12.6) with ESMTP id k2MNLnYg005591 for
> <[email-masked]>; Wed, 22 Mar 2006 15:21:49 -0800 (PST)
> Received: 	from xfe-sjc-211.amer.cisco.com
> ([171.70.151.174]) by xbh-sjc-211.amer.cisco.com with Microsoft
> SMTPSVC(6.0.3790.211); Wed, 22 Mar 2006 15:21:49 -0800
> Received: 	from cisco.com ([128.107.132.219]) by
> xfe-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211);
> Wed, 22 Mar 2006 15:21:48 -0800

As you can see, it contains the numeric address of the system. Any  
system that emits email is therefore known by any system that  
receives it, which is to say that IPv6 addresses of hosts on remote  
LANs are trivially easy to obtain. And if you can manage to infect  
one, the neighbor discovery protcool results in that system knowing  
all of its peers on said LAN even if they don't send mail.

Hence, I doubt that there will be any address scans, and I also doubt  
that there will be less attacks. They will just come in a different way.

---

From: Tim Chown <[email-masked]>
Date: Thu, 23 Mar 2006 01:10:10 +0000

On Wed, Mar 22, 2006 at 04:28:23PM -0800, Roland Dobbins wrote:
> 
> On Mar 22, 2006, at 4:04 PM, Fred Baker wrote:
> 
> >>   times.  Thus a much more sparsely address-populated IPv6  
> >>network will
> >I hear this comment, taken from the draft, a lot, and I'm not as  
> >sure that it is true. Finding the hosts on a remote LAN will  
> >require the use of different techniques, but I'm not at all sure  
> >they will be hard to find.
> 
> There's already a paper out which demonstrates this supposition to be  
> incorrect:
> 
> http://www.cs.columbia.edu/~smb/papers/v6worms.pdf

Yes, nice paper (which I think was posted here recently, well after the
latest version of the scanning draft).  

Within an IPv4 site, a worm can propogate across all subnets, because
the site's address space is probably dense due to the address conservation
requirements; in contrast in IPv6 I suspect the resilience is inter-subnet, 
rather than intra-subnet.  Once an attacker is on-link, you're in trouble.

Of course while dual-stack is used, you're subjetc to the limitations of
the 'weaker' of the protocols.

-- 
Tim/::1

---

From: Tim Chown <[email-masked]>
Date: Thu, 23 Mar 2006 01:32:37 +0000

On Wed, Mar 22, 2006 at 06:04:21PM -0600, Fred Baker wrote:
> ...

I agree, and I think Section 3 (Alternatives for Attackers) could add
a list of examples of where to harvest addresses from.   While MX's
will be DNS listed anyway, mail headers are a good (or bad :) example
since internal relays and sender IPs are invariably included.  If 
RFC3041 addresses are used for senders (or for any application) at 
least that harvestable information has its value to the attacker time 
limited.

-- 
Tim/::1

---

From: Fred Baker <[email-masked]>
Date: Wed, 22 Mar 2006 19:35:49 -0600

RFC 3041 is a good thing...

On Mar 22, 2006, at 7:32 PM, Tim Chown wrote:

> If

---

From: Fred Baker <[email-masked]>
Date: Wed, 22 Mar 2006 22:35:27 -0600

If I may give you a healthy caution...

In industry, we have a saying that one should not "believe one's own  
hype", or "breathe one's exhaust". John Chambers, Cisco's CEO, once  
asked Carly Fiorina, then CEO HP, to give a keynote at a Cisco  
corporate conference for the senior management and technical staff.  
At the end, he did a little interview with her, and asked her what  
she saw as the greatest danger there was to his company. The look on  
her face suggested that she was thinking on her feet - she hadn't  
been prepped for the question. She nonetheless replied, politely but  
without hesitation: "don't believe your own hype".

It is managements' job to tell the troops and marketing's to tell the  
world "we're the greatest, and our products are the greatest". Every  
company,  regardless of where it stands in reality, finds something  
to say about itself to allow it to say "we're the greatest, and the  
world is emulating us." And when you're in Cisco's position, it's  
pretty easy to believe it is true.

Juniper exists because at a certain point Cisco believed its own  
hype. The industry is better for it - the competition keeps us both  
at the top of our game, and our customers benefit. But there have  
been some hard lessons.

IPv6 is a great thing in a number of ways. The marketing story  
greatly exceeds its wonder, though. Make no mistake, IPv6 has as many  
vulnerabilities as IPv4. One just attacks them in a different way. If  
you want to leave IPv6 exposed and vulnerable, tell the world how  
invulnerable it is, how great a security solution and QoS solution  
and whatever else it is. It gives us a lot more addresses, and we  
need them, and having the addresses there are some very interesting  
things we can do, like the mobility stuff. That doesn't mean that it  
solves world hunger.

Don't tell me how hard it will be to attack IPv6 using IPv4  
techniques, or how IPv6 is more vulnerable if IPv4 is running in the  
same machine. Tell me how attackers will attack an IPv6 network, and  
how to defend against them. Make no mistake: they will.

Don't believe your own hype.

---

From: Tim Chown <[email-masked]>
Date: Thu, 23 Mar 2006 14:11:17 +0000

> how to defend against them. Make no mistake: they will.

Good points, and I agree.  It is harder for 'worms' to propogate between 
IPv6 subnets, but still possible.  It is less likely to be by current 
typical ping sweeps.

If there's time today, lets see
a) if the WG thinks this doc should be pushed forward
b) what the tone/conclusion of the doc should be (it currently lacks
   a conclusion)

Bellovin's paper says that understanding what attackers may do is still
work in progress.   I think Section 3 can expand on these sources, and
offer some advice on what attack vectors we may see.   Thus I feel the
document can highlight practical steps an administrator can take (and 
steps they should not).   But of course the doc should not claim any
magic invulnerability.

Tim