Abstract:Numerous measurement researches have been performed to discover the IPv4 network security issues by leveraging the fast Internet-wide scanning techniques. However, IPv6 brings the 128-bit address space and renders brute-force network scanning impractical. Although significant efforts have been dedicated to enumerating active IPv6 hosts, limited by technique efficiency and probing accuracy, large-scale empirical measurement studies under the increasing IPv6 networks are infeasible now. To fill this research gap, by leveraging the extensively adopted IPv6 address allocation strategy, we propose a novel IPv6 network periphery discovery approach. Specifically, XMap, a fast network scanner, is developed to find the periphery, such as a home router. We evaluate it on twelve prominent Internet service providers and harvest 52M active peripheries. Grounded on these found devices, we explore IPv6 network risks of the unintended exposed security services and the flawed traffic routing strategies. First, we demonstrate the unintended exposed security services in IPv6 networks, such as DNS, and HTTP, have become emerging security risks by analyzing 4.7M peripheries. Second, by inspecting the periphery's packet routing strategies, we present the flawed implementations of IPv6 routing protocol affecting 5.8M router devices. Attackers can exploit this common vulnerability to conduct effective routing loop attacks, inducing DoS to the ISP's and home routers with an amplification factor of \gt 200. We responsibly disclose those issues to all involved vendors and ASes and discuss mitigation solutions. Our research results indicate that the security community should revisit IPv6 network strategies immediately.

Shim6: Reference Implementation and Optimization

Name-based Shim6

A Shim6-based dynamic path-selection mechanism for multi-homing

Name-based Shim6: a name-based approach to host mobility

A Novel IPv6 Communication Framework: Mobile SHIM6 (M-SHIM6)

Site Multihoming: Practices, Mechanisms and Perspective

Prototype for Customized Multicast Services in Software Defined Networks.

Research on and Implementation of Hierarchical Mobile IPv6's Handover Within MAP Domain

A Novel Load Control and Mobility Management Scheme for Hierarchical Mobile IPv6 Networks

Swing - A Novel Mechanism Inspired by Shim6 Address-Switch Conception to Limit the Effectiveness of Dos Attacks

H6Proxy: ICMPv6 weakness analysis and implementation of IPv6 attacking test proxy

SHAWK: Platform for Secure Integration of Heterogeneous Advanced Wireless Networks

Fast IPv6 Network Periphery Discovery and Security Implications

A Multihoming Based Ipv4/Ipv6 Transition Approach

H6Proxy: Address Forging and Data-Gram Forwarding Based Attack Testing Proxy System in IPv6 Network.

An Improved Handoff Mechanism for Next Generation Wireless Network

Transplantation and Performance Optimization of User-level Protocol Stack

A NOVEL SCHEME FOR SEPARATING LOCATION IDENTITY AND IDENTIFICATION

A New Security Mechanism of Mobile IPv6 Binding Update

An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

DNS-like IPv4/IPv6 address interpreting system