Explore the intricacies and potential security implications of IPv6 in this 41-minute conference talk from ShmooCon 2019. Delve into the challenges and opportunities presented by IPv6's larger address space, self-organizing addressing, and required multicast support. Learn about practical methods for enumerating hosts over IPv6, including statistical models for server discovery and novel honeypotting techniques for client identification. Examine the effectiveness of various IPv6 address discovery methods and gain insights into the global IPv6 address space. Compare the exposure levels of IPv6 hosts to their IPv4 counterparts and understand the prevalence of IPv6 hosts on different hosting platforms. Discover the open-source scanning software released by the presenters and access the collected data for further research and analysis.
Overview
Syllabus
Intro
The Future is a Scary Place...
How Common is IPv6?
IPv6 is a Great Engineering Feat!
A Tale of Gateways and Set Top Boxes
No More NAT (Kinda)
IPv6 is the Preferred Communications Protocol
Many-to-one Addresses to Interfaces
Multicast is the New Broadcast
In Summary
The Problem of Scale
PSLAAC Makes Things Harder
Breaking Down the Problem
Honey DNS Server Set up Bind server
A Quick Note on PopAds
Honey Web Server (cont'd)
Honey SMTP Server
Sweet(?) Honey Results
Structure in IPv6 Addresses
MACHINE LEARNING BAYBEEEE
The Entropy/IP Paper
Dumbing Things Down (Modeling)
Dumbing Things Down (Prediction)
Enter Aliased (ie: Jerk) Networks
Identifying Aliased Networks (Initial)
Identifying Aliased Networks (Network Size)
Identifying Aliased Networks (Network Size cont'd)
The Scanning Loop
Official v0.2 Release!
Proof in the Pudding?
Vintage OpenSSH • 54 devices with OpenSSH 3.5p1 (circa 2004)
Entropy Distribution
Future Improvements
Recap
Taught by
0xdade
