Re: FW: IPv6

[xbud <xbud () g0thead com>]

On Wednesday 18 December 2002 12:42, Hornat, Charles wrote:
> Hey Mike, Its been a while, how have you been?
>
> My question is base don this thought:  In order for the attacker to
> compromise the system, they would have used IP 4 and would have been
> caught by any existing IDS.  Additionally, once they go through the
> trouble of getting IP6 to run on the compromised system, what would they
> do with it?  Attack other IP6 systems?  Perhaps there is an exploit in
> IP6 that you missed?
Maybe, but not limited to ipv6 enabled hosts only... The attacker can simply 
use another compromised box configured with ipv6 as a bounce and re-route or 
tunnel through and back out the net via a local ipv4 tunnel.  This 
essentially allows him to attack from a honeypot  Not knowing what went 
through the ipv4 tunnel allows him to curconvent the honeypots logging 
capabilities.

> Seems like it adds complication and more possibility
> for problems and detection for the attacker to implement.
Obviously he didn't mind going through the trouble of enabling ipv6, he may 
have had greater intentions.
> Charles
-x