Top websites and IPv6

Hi all!

Recently I was wondering how top websites by Alexa are doing with security. Actually I was thinking to have a look from IPv6 perspective. Usually, security engineers forget about the firewalls, when it comes to IPv6.

Frankly speaking, I was surprised. Not by the security issues, but with the "readiness" of these websites to IPv6 world. ISPs usually say, that they are not interested in IPv6, because there is no content for users. Now I understand them.

10 000 top Alexa websites was researched. Here are some numbers.

9.6%

of websites support IPv6. Not bad, you may think. No, that is bad. IPv6 is out for almost 20 years by now, so 9.6 of top websites is not so good.

39%

of IPv6-ready websites are hosted by Cloudflare. Awesome! These guys are doing really great things. 17.2% belong to Google :) Well done!

39

websites have IPv6 address, but no open ports. This means, that they are not working for users with active IPv6.

These are the stats on opened TCP ports on hosts, that have both IPv4 and IPv6 running:

IPv4 "wins" because of the following factors:

1. Not all services automatically bind to IPv6 address. I can see, that there are bunch of services running on IPv4 address, but only web is up on IPv6.
2. Cloudflare hosted websites (39% of all scanned) have 80, 443, 8080 and 8443 ports opened on IPv4 addresses, whereas 8443 is closed on IPv6.

Anyhow, there are some hosts with undesired opened ports on IPv6 address. SSH opened there, SMTP here, and so on. 

Of course, if to dig deeper and have a look at not just a website, but to research whole IPv6 infrastructure of these companies, we might find some serious security threats, but that would take a lot of time and effort. Scanning an IPv6 range is an impossible task in a foreseeable future (/64 block that is usually assigned to any logical entity has 2^64 = 18446744073709551616 addresses, so good luck with scanning). So conducting an audit of IPv6 network is extremely interesting field for a security engineers.

Traceroute and scapy

Recently I was conducting few interviews for a NOC position. One of the questions asked to candidates was quite simple: how traceroute works?

We know that each router decrements TTL of the packet by 1. When TTL=0 ICMP message with type 11 should be sent by router. Type 11 is Time Exceeded.

Traceroute works on this basic principle. For instance we would like see the path from HostA to HostB:

1) HostA sends the packet with TTL=1
2) See who sends back ICMP message with Time Exceeded
3) If it is HostB - finish
4) Otherwise - we found our first hop. Increase TTL by one and go to step #1

That's it.

It is also good to remember, that Windows uses ICMP by default for tracert, whereas Linux and Cisco use UDP for their traceroute command. Anyhow, even TCP could be used.

Here is a simple python script with scapy that shows how traceroute works:

#!/usr/bin/env python

from scapy.all import *
import sys
import socket

def usage():

    print("""
    ./traceroute.py host

    example: ./traceroute.py 8.8.8.8
    """)

    return

def print_hop(number = 0, host = ''):

    print("%s %s" % (number, host))
    return


if len(sys.argv) < 2:

    usage()
    sys.exit(0)

HOST = sys.argv[1]

DSTHOST = socket.gethostbyname(HOST)
MAXTTL = 30

print("trace to %s (%s)" % (HOST, DSTHOST))

for i in range(1, MAXTTL, 1):
    packet = IP(dst=DSTHOST, ttl=i)/ICMP()
    resp = sr(packet, timeout=2, verbose=False)

    try:
        srcip = resp[0][0][1].src
        print_hop(i, srcip)

        if srcip == DSTHOST:
            break
    except:
        print_hop(i, "***")

Try replacing ICMP() with TCP(dport=12345) or UDP(dport=12345) at line #36 an see what happens.