Creating and Detecting IPv6 Transition Mechanism-Based Information Exfiltration Covert Channels

The Internet Protocol Version 6 (IPv6) transition opens a wide scope for potential attack vectors. Tunnel-based IPv6 transition mechanisms could allow the set-up of egress communication channels over an IPv4-only or dual-stack network while evading detection by a network intrusion detection system (NIDS). Increased usage of IPv6 in attacks results in long-term persistence, sensitive information exfiltration, or system remote control. Effective tools are required for the execution of security operations for assessment of possible attack vectors related to IPv6 security. In this paper, we review relevant transition technologies, describe two newly-developed IPv6 transition mechanism-based proof-of-concept tools for the establishment of covert information exfiltration channels, and compare their performance against common tunneling mechanisms. We evaluated commonly used exfiltration tools in an automated and virtualized environment, and assessed covert channel detection methods in the context of insider threat. An analysis of the generated test cases confirms that IPv6 and various evasion techniques pose a difficult task for network security monitoring. While detection of various transition mechanisms is relatively straightforward, other evasion methods prove more challenging. Additionally, some solutions do not yet fully support IPv6.