Data exfiltration via IPv6

guest · Oct 27, 2020

Data exfiltration via IPv6
Testing the capabilities of IPv6 and how malware could take advantage of it
October 27, 2020
https://blog.avast.com/data-exfiltration-via-ipv6-avast

Within the Aposemat Team, we’ve been working on testing the capabilities of IPv6 and how malware could take advantage of it. One of the topics we explored was exfiltration of data via the IPv6 protocol. In this post, we share our study into this topic.
What is exfiltration?
Exfiltration is the unauthorized exportation of sensitive data out of the network by connecting to an external destination and/or using covert channels. The latter is commonly used to exfiltrate information while being undetected or avoid any measure in place to stop the migration of data. There have been numerous studies on this topic, and even to this day, data theft produced by breaches put exfiltration in the center of attention.
Click to expand...

Tools of the trade
Several tools exist to carry out exfiltration via IPv6 network stack. We’ll describe IPv6teal and IPv6DNSExfil, and how these tools are used to exfiltrate data via IPv6.
IPv6teal
The first one is IPv6teal and consists of a receiver and sender (exfiltrate) script.
[...] Another exfiltration technique, on a higher level of the OSI Model, is done via DNS AAAA records. [...]
IPv6DNSExfil
Tools like IPv6DNSExfil make use of this technique in order to store a secret, in a pseudo-IPv6 address format, for a short period of time on AAAA records. It will make use of the nsupdate tool to dynamically create said AAAA records and push them to an upstream DNS server thus exfiltrating the information. [...]
Click to expand...

In summary
IPv6 is growing in popularity as well as the necessity for more addressing space. Although, the percentage of IPv6 adoption worldwide is lower than 35% mostly because it still requires a big effort and investment from companies and organizations. This means that the tools and techniques demonstrated in this article will take time to be fully adopted or used while leaving space to further develop more ideas and methodologies.
Click to expand...

Log in or Sign up

Data exfiltration via IPv6

guest Guest

Log in or Sign up

Data exfiltration via IPv6

guest Guest

Useful Searches