Subject: v6 security: covert channel through DstOptions

From: Pekka Savola <[email-masked]>
Date: Tue, 15 Jul 2003 12:35:41 +0300 (EEST)

Hi,

FYI, FWIW, I came across this:

http://net.suug.ch/articles/2003/07/06/ip6msg.html

.. where someone has hacked a system to pass data between the endpoints 
embedded in unrecognized IPv6 destination options.  Nothing new there, but 
now it has gone operational.

However the attacks could be much more nastier too.

Similar issues have already been discussed in:

http://www.ietf.org/internet-drafts/draft-savola-v6ops-firewalling-01.txt

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: [email-masked]
Date: Tue, 15 Jul 2003 19:18:37 +0900

>However the attacks could be much more nastier too.

	another URL (i don't have one with me now) noted that it is a
	covered channel.  i'm not sure if we can really *attack* other system
	with this.

itojun

---

From: Pekka Savola <[email-masked]>
Date: Tue, 15 Jul 2003 13:23:01 +0300 (EEST)

> 	covered channel.  i'm not sure if we can really *attack* other system

Yes, indeed -- this is a method of covert channel creation only.

(Perhaps I should not have used the word "hacked [up]" to refer to coding
a mechanism from the RFC2460 specification.)