September 6, 2011
Almost 300,000 Iranian IP Addresses Likely Compromised
The rogue certificate, issued on July 10 by DigiNotar, was finally revoked on Aug. 29.
"Around 300.000 unique requesting IPs to google.com have been identified," Fox-IT said in the report. On Aug. 4 the number of requests rose quickly until the certificate was revoked on Aug. 29. Of these IP (Internet Protocol) addresses, more than 99 percent originated from Iran.
The list of IP addresses will be handed over to Google who can inform users that their e-mail might have been intercepted during this period, Fox-IT said.
Not only the e-mail itself but also a login cookie could have been intercepted, it added. Using this cookie the hacker is able to log in directly to the Gmail mailbox of the user and other services from Google.
"The login cookie stays valid for a longer period," Fox-IT said. It would be wise for all users in Iran to at least logout and login, but even better change passwords, it added.
A sample of the IP addresses outside of Iran during the period were mainly Tor-exit nodes, proxies and other VPN (virtual private network) servers, and almost no direct subscribers, according to the report which analyzed OCSP (Online Certificate Status Protocol) request logs.
Current browsers perform an OCSP check as soon as the browser connects to an SSL (secure sockets layer) website protected through the https (hypertext transfer protocol secure) protocol.
Tor is a distributed anonymous network used by people to prevent being tracked by websites or to connect to instant messaging services and other services when these are blocked by their local Internet service providers.
A total of 531 digital certificates were issued for domains that included google.com, the CIA, and Israel's Mossad,
The list of domains and the fact that 99 percent of the users are in Iran suggest that the objective of the hackers was to intercept private communications in Iran, Fox-IT said.
Google said on Aug. 29 that it received reports of "attempted SSL man-in-the-middle (MITM) attacks" against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran.
The attacker used a fraudulent SSL certificate issued by DigiNotar which has since revoked it, Google said in a blog post.
Trend Micro, another security firm, said on Monday that domain validation.diginotar.nl was mostly loaded by Dutch and Iranian Internet users until Aug. 30. Domain name validation.diginotar.nl is used by Internet browsers to check the authenticity of SSL certificates that are issued by DigiNotar.
DigiNotar is a small Dutch certification authority with customers mainly in the Netherlands. "We, therefore, expect this domain name to be mostly requested by Dutch Internet users and perhaps a handful of users from other countries but certainly not by a lot of Iranians," Trend Micro's senior threat researcher, Feike Hacquebord, said in a blog post.
From analysis of Trend Micro Smart Protection Network data, the company found that a significant part of Internet users who loaded the SSL certificate verification URL (uniform resource locator) of DigiNotar were from Iran on Aug. 28, but by Aug. 30 most traffic from Iran disappeared, and on Sept. 2 about all of the Iranian traffic was gone.
It became public in the evening of Aug. 29 that a rogue *.google.com certificate was presented to a number of Internet users in Iran, according to the Fox-IT report. The false certificate had been issued by DigiNotar and was revoked that same evening.
The security firm was contacted the next day and asked to investigate the breach and report its findings before the end of the week.
Fox-IT's report indicates that the initial compromise at DigiNotar may have occurred on June 17. DigiNotar noticed the incident on June 19 in its daily audit procedure but doesn't appear to have done anything about it. The company could not be immediately reached for comment.
The first rogue certificate *.google.com, was issued on July 10. All the other rogue certificates were issued between July 10 and July 20.
The hack implies that the current network setup and procedures at DigiNotar are not sufficiently secure to prevent this kind of attack, Fox-IT said. The most critical servers, for example, contain malicious software that can normally be detected by anti-virus software. The separation of critical components was not functioning or was not in place, it added.
June 9, 2011
Google, Facebook, Yahoo Testing IPV6 Today
Google, Facebook, Yahoo and an number of other later Internet companies have started testing IPV6 from today, and the companies are giving IPV6 a 24 hour ‘test flight’, in an attempt to motivate other companies to get their services ready for IPV6.
On 8 June, 2011, Google, Facebook, Yahoo!, Akamai and Limelight Networks will be amongst some of the major organisations that will offer their content over IPv6 for a 24-hour “test flight”. The goal of the Test Flight Day is to motivate organizations across the industry – Internet service providers, hardware makers, operating system vendors and web companies – to prepare their services for IPv6 to ensure a successful transition as IPv4 addresses run out.
You can find out more details about the IPV6 Test over at World IPV6 Day.
June 6, 2011
An Introduction to IPv6
Right now, most of the world is using IPv4
(Internet Protocol version 4). The problem is that it does not allow for enough addresses. The world is just too big of a place. Enter IPv6. It provides vastly more addresses (2^128) and is the future of the web. Most users will not notice a difference, but networking personnel will (you can test your IPv6 connectivity here)
An IPv6 address has a few differences from IPv4. The first is that it is in hexadecimal instead of decimal. The second is that it is split up into larger segments and more of them. The third is that it uses colons (:) rather than periods (.) to divide these segments. In the end, one does not resemble the other. This is good because it prevents confusing the two.
Hexadecimal is better than decimal for a few reasons. For one, it takes up less space. The number “255″ is “FF” in hex; that is %50 smaller. Hexadecimal also relates more closely to binary. The number “1111″ is “15″ in decimal but “F” in hex. So “11111111″ is “FF” in hex, which is a much cleaner conversion than “255″ is. The downside is that humans typically think in decimal, so working with hex takes some getting used to.
IPv6 has a much larger address size. It has eight sections to it. IPv4 had half of that. The sections themselves are larger too: each one has four digits. IPv4 could only have three, and that only went to 255 tops. It should be obvious why this new address can afford all the room we have come to need. Hopeful it will for a long time. Here is a sample address.
FF00:00FF:0000:0000:0000:02f3:0000:0001
At this point, you may begin to see the down side to IPv6: it is long and hard to remember. To make them more human readable, there are a few conventions to short address when you have a lot of zeros present. First of all, you can skip leading zeros, so “0001″ becomes “1″ and “02f3″ becomes “2f3″ (IPv4 did this too). Second, groups of all zeros can be abbreviated to “::” (a double colon) once; you put nothing there. That makes “:0000:0000:0000:” reduce to “::” but “:0000:” cannot as it would be ambiguous. You can apply the first rule, making it “:0:” now. Putting all these rules into place gives us the following address.
FF00:FF::2f3:0:1
This address is about as long as an IPv4 number. Notice how the “00FF” shrank to “FF” and the “FF00″ did not. That was done intentionally to show the difference between leading and trailing zeros.
There is one more thing you really need to know if you are working with IPv6. The loop-back address, which was 127.0.0.1 in IPv4, is ::1 now. It works exactly the same way. You will have to use the ping6 command in Windows or Linux, so ping6 ::1 is what you would type into the command line. This will give many XP users an error as IPv6 may not be enabled on your computer. We have guides on how to enable IPv6 in XP, and how to assign IPv6 addresses in Linux.
Some other factoids about IPv6 are that it has is easier to route, more secure, and works better with mobile technology. There are changes to the way the packets of information are sent that makes it more efficient (e.g. better headers). It is more secure because it requires the use of IPSec, which is only optional in IPv4. IPv6 has an address recovery system, so when you change locations, it tries to keep the same address. These are are some of the that US government is switching over to it.
I should note that IPv6 has been found to have vulnerabilities. Malware tunneling is described in an article (note: a .pdf file) from the us-cert.gov site. It often has to do with how firewalls are configured. Different sources may give different opinions on how secure IPv6 is.
Wondering what happend to IPv5? It did exist. It was developed in the 1970′s to be used in audio and video streaming. It was called the Internet
Stream Protocol. It did not get far past the experimental stage and was never adopted. Ideas from it helped to form IPv6.
January 14, 2011
Test Your IPv6 Connectivity
You may have seen an increasing number of articles about IPv6 in the past year. IPv6 is an Internet Protocol that has been designed as the successor of the currently used IPv4 protocol. IPv4 has been in use since the 80s and it is quickly coming to its limits. The main problem with it is that IPv4 runs out of available IP address space as its limit is around 4 billion IP addresses which servers, ISPs, Internet users, devices and websites have to share.
IPv6 offers a larger address space. The move from IPv4 to IPv6 is difficulty as it requires a coordinated effort from all parties including Internet users. Users with improperly configured computers may experience slowdowns, timeouts or other connectivity issues when the Internet moves to the IPv6 protocol.
Will you have troubles? You can find out if you run the IPv6 test. The test is an Open Source script that runs using JavaScript. Just visit the website http://test-ipv6.com and wait until the test has finished. The IPv6 test runs a series of tests including the browser’s IPv4 and IPv6 capabilities, IPv4 and IPv6 connectivity with and without DNS records and a test that checks if the ISP’s DNS server uses IPv6.
A click on test data reveals details about the tests.
Another click on Technical Info leads to a page that offers technical information about each test which may provide clues to troubleshoot the issue.
The most important test at this point in time for the majority of users is the dual stack test. There will be a transition period where websites and services can be reached via IPv4 or IPv6. The user’s computer now needs to pick one of the protocols and use it for the connection which means that devices that only support IPv4 at this time can still connect to the websites. Connectivity issues occur if this is broken.
Major services and websites will switch to IPv6 for a 24 hour period on World IPv6 day on June 8. Among them Google, Facebook and Yahoo. That’s where the dual stack DNS record support can be tested in a life environment.