[Paper Review] Current State of IPv6 Security in IoT

Lisandro Ubiedo, Thomas J. O'Hara+2 more|arXiv (Cornell University)|May 5, 2021

Network Security and Intrusion Detection1 references4 citations

TL;DR

This study investigates the current state of IPv6 security in IoT devices, analyzing adoption trends, vulnerabilities, malware activity, and data exfiltration techniques. Despite IPv6 adoption reaching 35% globally, malware targeting IPv6 remains rare—only one known malware family exploits it—creating a window for defenders to harden IPv6 defenses before widespread attacks emerge.

ABSTRACT

This report presents the current state of security in IPv6 for IoT devices. In this research conducted from May 2020 to July 2020, we explored the global growth of IPv6 and compared it with the real growth of IPv6 in a medium size network. If IPv6 is already being used, are attackers already attacking using this protocol? To answer this question we look at the current vulnerabilities, attacks, and malware leveraging IPv6. Our research showed that while IPv6 adoption is growing, we are years away of a full adoption. The current global adoption is of 35\%, however there are countries rapidly adopting IPv6, such as India with 60\% of IPv6 enabled in the country. IPv6 brings new challenges for both attackers and defenders. With a larger address space, the activity of device discovery will force attackers to devise new techniques and tools. Defenders will also have to adapt their tools and monitoring technology to be able to work with IPv6. There are currently more than 16 million devices exposed on the internet on IPv6, however malware authors seem to be still focused mainly on IPv4. There is to date, one malware capable of attacking IPv6 networks. This may give an edge to defenders, who have now the opportunity to give the first step ahead of attackers.

Motivation & Objective

• To assess the current level of IPv6 adoption in IoT and its implications for network security.
• To identify existing vulnerabilities and attack vectors targeting IPv6 in IoT environments.
• To evaluate the extent to which malware and attackers are currently leveraging IPv6 protocols.
• To investigate data exfiltration techniques using IPv6, particularly ICMPv6 and DNS-based methods.
• To provide actionable insights for defenders to strengthen IPv6 security before widespread exploitation occurs.

Proposed method

• Collected and analyzed global IPv6 adoption metrics from sources including APNIC, Google, Akamai, and Cisco.
• Conducted real-world network measurements in a local network to compare IPv4 and IPv6 traffic and attack patterns.
• Developed and tested custom tools such as IPv6teal and IPv6DNSExfil for exfiltrating data via ICMPv6 and DNS protocols.
• Built an IPv6-only honeypot to monitor and analyze attacker behavior in IPv6 environments.
• Implemented YARA rules to detect IPv6-related malware and malicious payloads in binary files.
• Designed and executed a proof-of-concept data exfiltration method using ICMPv6 echo request sequence fields with XOR-encrypted payloads.

Experimental results

Research questions

• RQ1 What is the current global and regional adoption rate of IPv6 in IoT networks, and how does it compare to IPv4 usage?
• RQ2 To what extent are attackers currently exploiting IPv6 vulnerabilities or using IPv6 for attacks?
• RQ3 How do IPv6 scanning and device discovery techniques differ from IPv4, and what challenges do they pose for defenders?
• RQ4 What are the current capabilities of malware to operate over IPv6, and are there any known malware families targeting IPv6-only networks?
• RQ5 How effective are modern data exfiltration techniques using IPv6 protocols such as ICMPv6 and DNS?

Key findings

• Global IPv6 adoption stands at 35%, with countries like India reaching 60% adoption, indicating rapid regional growth.
• Over 16 million IPv6-enabled devices are exposed to the internet, yet only one malware family is known to target IPv6 networks.
• IPv6 scanning is significantly more complex than IPv4 due to the vast address space, requiring new tools and techniques for discovery.
• Data exfiltration via ICMPv6 sequence fields can transmit 1 KB of data in 8 minutes and 42 seconds, demonstrating practical stealthy exfiltration.
• Defensive tools relying on lower-layer network data must be updated to support IPv6, as current tools are largely IPv4-focused.
• The same IPv6 address can be represented in multiple valid string formats (e.g., fe80::1 and fe80:0000::1), complicating IoC and blacklist-based detection.