Abstract:Numerous measurement researches have been performed to discover the IPv4 network security issues by leveraging the fast Internet-wide scanning techniques. However, IPv6 brings the 128-bit address space and renders brute-force network scanning impractical. Although significant efforts have been dedicated to enumerating active IPv6 hosts, limited by technique efficiency and probing accuracy, large-scale empirical measurement studies under the increasing IPv6 networks are infeasible now. To fill this research gap, by leveraging the extensively adopted IPv6 address allocation strategy, we propose a novel IPv6 network periphery discovery approach. Specifically, XMap, a fast network scanner, is developed to find the periphery, such as a home router. We evaluate it on twelve prominent Internet service providers and harvest 52M active peripheries. Grounded on these found devices, we explore IPv6 network risks of the unintended exposed security services and the flawed traffic routing strategies. First, we demonstrate the unintended exposed security services in IPv6 networks, such as DNS, and HTTP, have become emerging security risks by analyzing 4.7M peripheries. Second, by inspecting the periphery's packet routing strategies, we present the flawed implementations of IPv6 routing protocol affecting 5.8M router devices. Attackers can exploit this common vulnerability to conduct effective routing loop attacks, inducing DoS to the ISP's and home routers with an amplification factor of \gt 200. We responsibly disclose those issues to all involved vendors and ASes and discuss mitigation solutions. Our research results indicate that the security community should revisit IPv6 network strategies immediately.

H6Proxy: ICMPv6 weakness analysis and implementation of IPv6 attacking test proxy

H6Proxy: Address Forging and Data-Gram Forwarding Based Attack Testing Proxy System in IPv6 Network.

DESIGN OF IPv6 RELAY SYSTEM CONFORMANCE TEST SYSTEM

Study on Attacking and Defending Techniques in IPv6 Networks

IPv6 Traffic Hijack Test System and Defense Tools Using DNSSEC

IPMT, an IPv6 Packet Manipulation Tool: Design Considerations and Applications

Study on Man-in-the-Middle Attack and Defending Techniques in IPv6 Network

Brief of Intrusion Detection Systems in Detecting ICMPv6 Attacks

Protocol Analysis and Online Forensics in IPv6 Network Environment

P4-NSAF: Defending IPv6 Networks Against ICMPv6 DoS and DDoS Attacks with P4

I6-FPS: Automating the ICMPv6 Filtering Rules

Fast IPv6 Network Periphery Discovery and Security Implications

Research on DDoS Attacks in IPv6.

Experience with SPM in IPv6

An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

Secure DHCPv6 Mechanism for DHCPv6 Security and Privacy Protection

An IPv6 Source Address Validation Testbed and Prototype Implementation

Exploiting Cross-Layer Vulnerabilities: Off-Path Attacks on the TCP/IP Protocol Suite

SDN-Ti: A General Solution Based on SDN to Attacker Traceback and Identification in IPv6 Networks

Your Router is My Prober: Measuring IPv6 Networks Via ICMP Rate Limiting Side Channels

A New Worm Exploiting IPv6 and IPv4-IPv6 Dual-Stack Networks: Experiment, Modeling, Simulation, and Defense