Ipv6 Issues Regarding Spam

Published Date: 02 Nov 2017

Abstract

IPv6 is central to maintaining and safeguarding the expansion and growth of the internet, but the global deployment of the protocol increases its own security challenges. The global implementation and adoption of IPv6 is one of the main challenges facing the internet today. IPv6 deployment comes with its own set of challenges. Most security occurrences are triggered by human error, either as the outcome of a programming error or through misconfiguration (Axel Pawlik, 2012). In this sense, IPv6 is no different to IPv4. The real worry is the lack of knowledge and experience and training for those IT professionals dealing with IPv6, which makes these mistakes more possible.

Introduction

One of the main purposes of Internet Protocol version 6 (IPv6) developments was to resolve the IP address exhaustion concern due to the increasing growth of the Internet users. The new Internet protocol offers address auto-configuration or plug-and-play and quicker packet processing in the routers apart from the other features such as end-to-end communication, improved and enhanced security. However, as a new technology, it is also reported that the protocol presents some security vulnerabilities and weaknesses both in the header format and in further protocols related to it. The IPv6 security vulnerabilities are classified under three categories that include the IPv6 main header field, IPv6 extension header and Neighbor Discovery Protocol (NDP). This report also summarizes the current mitigation methods proposed by researchers and practitioners to secure from these IPv6 security vulnerabilities (Supriyanto, 2012).

Transition from IPv4 to IPv6

The huge Internet transition from IPv4 to IPv6 is not without some risks to security. We know very little about IPv6 related to what we know about IPv4, and a migration of this scale, going from something we’re assured in to something that’s very new to us in many ways, is the perfect storm of application errors and misconfigurations.  This is a great deal, since deployment, implementation and misconfiguration are probably the main two reasons security goes wrong in the actual world.

First off all, to support the changeover from IPv4 to IPv6, a lot of systems can support both IPv4 and the IPv6 traffic at the same time, also known as a dual stack configuration. The important thing to understand about this configuration is that IPv6 and IPv4 apply dissimilar masses (Carter, Earl 2011). Meanwhile IPv6 supports automated neighbor detection and address formation, interfaces can automatically create both local and global IPv6 addresses without the user interaction. Additionally, even if the local network does not support IPv6 traffic, an attacker can acquire IPv6 traffic to your host with the help of other mechanisms. For example, it is likely to direct IPv6 traffic to a target/system directly over an IPv4 SSH connection that can actually support port forwarding (Serenity Consulting, 2012). Therefore, it is essential to deploy appropriate IPv6 firewall protection and rules on your inner systems.

IPv6 Issues regarding Spam

The IPv6 network supports 2128–32 times more unique IP addresses than IPv4. Generally, Internet service providers assign prefix ranges to each home or small business network. Each of these networks would therefore have straight control over at least 264 unique IP addresses within their assigned subnet. Spammers might look for and search for insecure SMTP-enabled computers in these networks. They might then start sending spam messages using different IP addresses available in that subnet. The sheer size of the addressable IPv6 address space is threating to render unusable many antispam technologies that are based on IPv4 addresses, such as IP blacklisting (Michal Bujak, 2012). In IPv6 networks, spammers have one extra powerful weapon at their disposal: the large address space available.

Extension headers

IP options in IPv4 are swapped with extension headers in IPv6. With this changeover, extension headers may be used in an effort to avoid security policy. For example, all IPv6 endpoints are required to accept IPv6 packets with a routing header (Biondi, 2007). It is likely that in addition to accepting IPv6 packets with routing headers, end hosts also process routing headers and forward the packet. With this option, routing headers can be used to avoid security policy applied on filtering devices such as firewalls. IPv6 contains a better-quality option mechanism over IPv4. IPv6 options are placed in different extension headers that are situated between the IPv6 header and the transport-layer header in a packet. The majority of IPv6 extension headers are not inspected by some router along a packet's delivery trail until the packet arrives at its last endpoint. This feature is a key and significant development in router performance for packets that contain options. In IPv4, the existence of any options involves the router to inspect all options (Oracle, 2010). Unlike the IPv4 options, IPv6 extension headers can be of random length. Furthermore, the number of options that a packet conveys is not restricted to 40 bytes. This feature, plus the style in which IPv6 options are processed allows IPv6 options to be used for purposes that are not applied in IPv4. A decent case of IPv6 options is the IPv6 verification and security encapsulation options.

Elimination of NAT

With IPv4, the majority of home firewalls implement a default configuration, which executes dynamic NAT to permit numerous internal systems to seem to be a single IP address to the exterior world. By default, this configuration typically only permits outbound connections from your inner network while rejecting any connections originated from the Internet to your inner systems. This default configuration offers security to home networks by restraining inbound traffic, while still permitting your computers to certainly access the Internet. With IPv6, however, addresses are not as restrained so NAT is no longer required (Carter, Earl 2011). The disadvantage to this is that the default setup for home IPv6 firewalls is probably to be much more open, to ensure that your inner devices can enter the Internet. From a security viewpoint, in many circumstances this may be similar to plugging your computer straight into your cable modem.

Conclusion

The migration over to IPv6 is a necessity in the long term, but IPv6 is not just about IP address space - there are some other advantages including long-term cost savings and better performance. Although transitional approaches are the short-term solution for the IP protocol evolvement, network implemented with single routing policy is more agile and flexible with response to network status. As for the IPv6 migration, currently small countries are ahead of the IPv6 deployment schedule as compared to 'larger' or more developed countries. Problems arise with hardware differences around the world, and it would be unfeasible to recommend a change in a short period of time. Companies and individuals should be cautious with any sustained investment in IPv4 networks, since older technologies such as NAT devices cannot bring long term benefits. With backing and drive from the government, specific time frames should be decided for a partial or regional switchover as a temporary trial to investigate the sustainability of IPv6 where the current IPv4 network dominates. Awareness needs to be made before the implementation. One difficulty of this approach is there is no clear understanding to how long IPv4 will last.