Análise de métodos de divulgação de endereços IPv6 e suas implicações para a cibersegurança

Abstract

The transition to IPv6 is an ongoing process, driven by the growing number of devices connected to the Internet. Since the publication of RFC 2460 which created IPv6 in the late 1990s, IPv6 offers a vastly superior addressing space compared to IPv4. However, the scar- city of efficient tools to scan the vast range of IPv6 addresses makes identifying active hosts a challenge for both attackers and researchers. Given this scenario, this work investigated five methods of IPv6 address disclosure with the aim of studying the detection of new th- reats using cloud-implemented honeypots as infrastructure from the perspective of those who want their services to be found using this protocol. The first method involved using the Censys and Shodan search engines to identify and store IPv6 addresses in their databa- ses. The second method consisted of explicitly disclosing addresses in cybersecurity forums. The third method used web trackers or webcrawlers to identify sites that use IPv6 and ac- cess them automatically. The fourth method involved querying DNS servers to disclose IPv6 addresses. Finally, the fifth method explored internal communication between the instan- ces hosting the services. The results indicated that IPv6 address disclosure is not trivial. In the two experiments conducted, 35 honeypot instances were configured in total. Of these, one in each experiment recorded at least one access attempt. One of the instances recorded attack attempts on ports 22 and 23 with access attempts, and the other instance had scans performed on 5,060 different ports out of the 65,535 ports, the first using the Censys and Sho- dan disclosure method and the other being a control instance, meaning it had no disclosure methods applied.