Malware Tunneling in IPv6

Searching_ _ _ · Feb 27, 2010

The protocol itself, however, can be misused to deliver malware in a way that eludes detection by
firewalls or intrusion detection systems (IDS) not configured to recognize IPv6 traffic.
This problem can be amplified in cases where malware is used to reconfigure vulnerable
hosts to allow IPv6 traffic.

IPv6 can itself be used to encapsulate malware and distribute it by taking advantage of
pre-existing network conditions and the auto-configuration feature of IPv6.

Malicious external users could send crafted IPv6 packets capable of passing undetected through perimeter
security devices not configured to recognize IPv6 traffic, then exploit the auto-
configuration capability of internal hosts supporting IPv6 to route the malicious packets.

There has been a recent increase of malicious code that enables IPv6 on a compromised
host, creating a potentially undetected channel for an attacker to exploit.

Consequently, in addition to malware tunneling, reconnaissance activity inbound (such as port scanning)
or communication traffic outbound (such as botnet activity) could be facilitated in a network
that does not control its IPv6 implementation.

You can determine if the operating systems within your environment support IPv6 the
checking the following web site, which identifies operating systems supporting IPv6:

http://www.ipv6.org/impl/index.html
Click to expand...

Malware Tunneling in IPv6 PDF

This information is dated May 2005.
Is this still being used by Botnets on compromised systems?

If I check a Wireshark log and see IPv6 traffic and transmitted data with "CMD" in it, is this proof of an infection?

Log in or Sign up

Malware Tunneling in IPv6

Searching_ _ _ Registered Member

Log in or Sign up

Malware Tunneling in IPv6

Searching_ _ _ Registered Member

Useful Searches