IPv6 is Bad for Your Privacy

Presented at DEF CON 15 (2007), Aug. 4, 2007, 11 a.m. (20 minutes).

In recent years, covert channel techniques for IPv4 and more recently for IPv6 have been published by the scientific community and also presented in DEFCON 14. However, a covert channel that contains a considerable bandwidth has been overlooked, the autoconfigured IPv6 address itself. IPv6 Stateless Address Autoconfiguration is used for autoconfiguring addresses without a server in IPv6 networks. The autoconfiguration mechanism consists of choosing an address candidate and verifying its uniqueness with Duplicate Address Detection. The autoconfiguration mechanism has privacy issues which have been identified before and mitigations have been published as RFC 3041. However, we show that the privacy protection mechanism for the autoconfiguration can be used as a covert channel, and consequently, be used to harm the privacy of the user. The covert channel can be serious threat for communication security and privacy. We present practical attacks for divulging sensitive information such as parts of secret keys of encryption protocols. The scheme can also be used for very effective Big Brother type surveillance that cannot be detected by established intrusion detection systems.


Presenters:

  • Janne Lindqvist - Helsinki University of Technology
    Janne Lindqvist, M.Sc. (Tech), is a researcher and PhD candidate in Telecommunications Software and Multimedia Laboratory at the Helsinki University of Technology and currently a visiting scholar in the International Computer Science Institute affiliated with the University of California campus in Berkeley. Before joining the academia, he worked as a network & security engineer and software engineer in the private sector. Mr. Lindqvist's research interests are in the broad sense in the field of security and privacy and he has published over 10 articles in international scientific conferences.

Links:

Similar Presentations: