Observing IPv6 Scanning at Public Cloud Platforms

This thesis is written as part of a master's degree in cybersecurity at the Faculty of Governance and Global Affairs (FGGA) at Leiden University in cooperation with the Cybersecurity Department of the Faculty of Electrical Engineering, Mathematics and Computer Science of Delft University of Technology. It describes the results of a study into the extent and effectiveness of IPv6 scanning on the internet. IPv6 scanning is becoming more active as the adoption of IPv6 on the Internet grows. The discovery of active IPv6 addresses is a complicating factor in effectively scanning the Internet for active services. Actors therefore use different methods of finding active systems. In this thesis, a comprehensive view is given of the methodology used by these scanners and to what extent IPv6 scanning is happening. Other studies have researched this problem using their own infrastructure. This study focuses on IPv6 scanning behavior within public cloud infrastructure. A custom-designed and...Show moreThis thesis is written as part of a master's degree in cybersecurity at the Faculty of Governance and Global Affairs (FGGA) at Leiden University in cooperation with the Cybersecurity Department of the Faculty of Electrical Engineering, Mathematics and Computer Science of Delft University of Technology. It describes the results of a study into the extent and effectiveness of IPv6 scanning on the internet. IPv6 scanning is becoming more active as the adoption of IPv6 on the Internet grows. The discovery of active IPv6 addresses is a complicating factor in effectively scanning the Internet for active services. Actors therefore use different methods of finding active systems. In this thesis, a comprehensive view is given of the methodology used by these scanners and to what extent IPv6 scanning is happening. Other studies have researched this problem using their own infrastructure. This study focuses on IPv6 scanning behavior within public cloud infrastructure. A custom-designed and developed data collection platform is used comprised of 39 collection probes, that collect data of scanning activity on the internet. Data is sent to a data processing environment that enriches the data to gather information about the actors that are scanning the probes. The probes are spread across two different cloud platforms that both have a unique method of assigning an IPv6 subnet to a probe. The results show that the method of assigning addresses that cloud providers use can make a significant difference in the discovery of new addresses by scanners. At one cloud provider addresses are discovered within an average of 2 hours, compared to the other providers of which some probes were never discovered. While previous studies have reported similar behavior that matches what is observed in the second provider, the ease of discovery that is shown at the first cloud provider has never been observed in previous research. Three experiments ran during the study in which probes, that were still undiscovered, simulated the behavior of regular systems on the internet. The results show that some scanners run legitimate services on the Internet which are used by various kinds of devices. Scanners can use this to collect active IPv6 addresses and use this information to scan these networks. This behavior is observed during this study and has identified three scanners that use this method of discovering active IPv6 addresses. Additional results of this thesis show that IPv6 scanning is becoming more active and that it is mostly performed by commercial parties. Both the results of the extent and effectiveness matched or even exceeded the results of previous research. Showing an increase in scanning activity by 55\% compared to a study in 2022. Future research is proposed based on the results of this study. These include: (1) creating a methodology for discovering legitimate services that are used to collect active IPv6 addresses; and (2) a comparison of the effectiveness of scanners in different environments, like home networks, business networks, and cloud infrastructure.Show less

Leiden University Student Repository

Documents

In Collections

Observing IPv6 Scanning at Public Cloud Platforms