[ipv6hackers] Pros and Cons of Address Randomization

[Joe Klein]

Jim,

As you might remember, my presentation at gogonet6 live was about
resilience, and the use of IPv6 Address Randomization to improve
survivability. The reason I present it, was to get feedback on a IEEE
paper I am writing. At present I am validating others work, and
setting up a network to perform the testing. I still have a bunch of
research into best techniques and strategies before I had planned on
publishing.

When reviewing your notes, I noticed you are missing the big question,
"What threat are you attempting to mitigate?" As such, I only see this
technique used on all high and some moderate confidentially,
integrity, available or non-repudiation environment, as a method of
early identification of attackers during the ISR phase of the attack.

Note, the reason I have not published any work on it, was there are a
few companies (some represented on this list) which have been 'kind
enough', to create products under their name.

This paper and research are not funded by any company or university,
although I do with it were.

Joe Klein


On Sat, Dec 1, 2012 at 2:32 PM, Jim Small <jim.small at cdw.com> wrote:
> I would like to develop a list of talking points around the merits of IPv6 address randomization.  Here is what I have done to prepare:
>
> Watched a recent talk by Fernando:
> https://www.youtube.com/watch?v=MshyzRycDr0&feature=plcp
>
> Read RFC 5157:
> http://tools.ietf.org/html/rfc5157
>
> Read Fernando and Tim's Revised Internet Draft:
> http://tools.ietf.org/html/draft-gont-opsec-ipv6-host-scanning-02
> Note:  This is absolutely fantastic and should be mandatory reading for any network or security engineer.  The pros/cons of address randomization are by no means meant to take away from this publication.
>
> Followed the conversations on the IETF WG and other places such as LinkedIn.
>
> Are there other sources I should study?
>
>
> Pros/Cons of IPv6 Address Randomization:
>
> Let me start be saying that I welcome disagreement and criticism.  May I ask though, when you criticize or disagree please share your thinking on what I missed or got wrong.  That said:
>
> Address Randomization Value
> Pros:
> * Makes host scans/enumeration very difficult (assuming of course they can't use DNS or some other means to identify the host - see above I-D by Fernando/Tim)
> * Having more security options/tools is always a good thing.  The RFC and I-D provide some excellent points to think through especially if you use global multicast.
> * Definitely makes sense in some cases - e.g. Clients
>
> Cons/Doubts:
> * The biggest issue I have with this is it seems to imply that you must hide your address if you connect to the Internet.  I have a hard time with this.  What about firewalls, access control, and system hardening?  Is this really the right place to focus resources?
> * My next biggest concern is that if this is recommended best practice it's one more barrier to IPv6 adoption.  I can already hear the groans about how onerous it will be to implement and operate IPv6 because of the burdensome security requirements.
> * To some degree this appears like security through obscurity - I read the defense in depth part but I'm still having a hard time getting past this
> * How many system compromises are from random scans?  Perhaps it depends on the type of network being discussed.  In the Enterprise for example, my understanding is that most attacks are drive by download exploits, social engineering, or simple mistakes.  Perhaps a case could be made for publicly accessible systems in a DMZ, but in general?
> * Increases operational complexity
> Rather than systems using a predictable pattern that's easy to remember and administer we use totally random addresses that make addresses hard to use and remember
> The use of DNS or even full DDI is virtually forced - this is another potential cost/barrier to deploy IPv6
> In some organizations DNS and Network administration are siloes and forcing the Network team to rely on a separate team could create additional challenges or a barrier to adoption
> * Typically if you need the address of a host/system you can just ask someone (social engineering)
>
>
> So there are classes of systems and a value proposition in regards to address randomization for each of them:
> Good Value:
> * Clients - For general clients I am a fan of randomized identifiers, especially if Fernando's stable privacy address proposal gets adopted.  With clients we can also typically use DHCPv6 (Android being the exception) to provide a randomized IID.
>                 Recommend using DHCPv6 server which can supply randomized IIDs
>                 Recommend using Fernando Gont's stable privacy addressing for non-DHCPv6 nodes
>                 ** Strongly against rotating addresses for the Enterprise - too complex and limits accountability
>
> Value Depends:
> * Servers - Different schools of thought:
>   ** Questioning Value:
> Critical servers which probably need to be static (DNS, DHCP, Directory Servers) - for these I would prefer some kind of pattern versus a randomized address.  The value of an addressing scheme with a pattern is it makes server administration easier.
> Servers with static addressing - again, a pattern makes life easier.
>   ** Valuable
>                 Servers accessible to Internet or in a DMZ - here a randomized address makes sense
>                 Servers which can use DHCPv6 reservations - as long as a reliable Dynamic DNS or DDI solution is in place
>
> Bad (IMHO) Value:
> * Infrastructure Devices (Routers, Switches, Firewalls, Load Balancers, etc...) - For these I am questioning the value of address randomization.  I would much rather use an address like 2001:db8::1/64 for my router than 2001:db8::ea23:f02b:139e:ffe2.  The latter makes operations much harder and it's easy to transpose the digits if you're typing them in (CLI access).  Perhaps you could break these into categories:
>   ** Questioning Value:
>                 Loopback interfaces, management interfaces, default gateways, VIPs (routers/load balancers)
>   ** Possible Value:
>                 Where devices are transparently bridging and need an address but it's not the default gateway or used for management
>                 Where DNS can be used though I'm skeptical of this as it hasn't seemed to work very well in IPv4 - perhaps I'm saddled by IPv4 thinking here...
>
>
> I guess the question is - does the potential security value of address randomization outweigh the increased operational complexity incurred?  I would like to add though that despite my efforts to reshape my neurons into IPv6 mode and shed the legacy IPv4 mentality, perhaps I am being saddled by this?  I am interested in your thoughts on the value of address randomization.  As I described above I think there are cases where it's valuable and cases where I question the value.
>
> I don't believe there are absolutes with IPv6 security - I am just trying to understand both sides of address randomization so I can be a good guide when helping people on their IPv6 journey.
>
> All comments greatly welcomed,
>   --Jim
>
> _______________________________________________
> Ipv6hackers mailing list
> Ipv6hackers at lists.si6networks.com
> http://lists.si6networks.com/listinfo/ipv6hackers