Conference proceeding
Glowing in the Dark Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild
PROCEEDINGS OF THE 32ND USENIX SECURITY SYMPOSIUM, pp.6221-6237
01/01/2023
Abstract
In this work we identify scanning strategies of IPv6 scanners on the Internet. We offer a unique perspective on the behavior of IPv6 scanners by conducting controlled experiments leveraging a large and unused /56 IPv6 subnet. We selectively make parts of the subnet visible to scanners by hosting applications that make direct or indirect contact with IPv6-capable servers on the Internet. By careful experiment design, we mitigate the effects of hidden variables on scans sent to our /56 subnet and establish causal relationships between IPv6 host activity types and the scanner attention they evoke. We show that IPv6 host activities e.g., Web browsing, membership in the NTP pool and Tor network, cause scanners to send a magnitude higher number of unsolicited IP scans and reverse DNS queries to our subnet than before. DNS scanners focus their scans in narrow regions of the address space where our applications are hosted whereas IP scanners broadly scan the entire subnet. Even after the host activity from our subnet subsides, we observe persistent residual scanning to portions of the address space that previously hosted applications.
Details
- Title: Subtitle
- Glowing in the Dark Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild
- Creators
- Hammas Bin Tanveer - Univ Iowa, Iowa City, IA 52242 USARachee Singh - Microsoft, Redmond, WA USAPaul Pearce - Georgia Institute of TechnologyRishab Nithyanand - University of Iowa
- Resource Type
- Conference proceeding
- Publication Details
- PROCEEDINGS OF THE 32ND USENIX SECURITY SYMPOSIUM, pp.6221-6237
- Publisher
- Usenix Assoc
- Number of pages
- 17
- Grant note
- 1953983 / National Science Foundation; National Science Foundation (NSF)
- Language
- English
- Date published
- 01/01/2023
- Academic Unit
- Law Faculty; Computer Science; Public Policy Center (Archive); Center for Social Science Innovation
- Record Identifier
- 9984548289602771
Metrics
1 Record Views