{"id":27763,"date":"2024-10-23T14:14:14","date_gmt":"2024-10-23T14:14:14","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=27763"},"modified":"2024-11-05T18:04:28","modified_gmt":"2024-11-05T18:04:28","slug":"the-risks-of-ignoring-ipv6-in-your-network","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/the-risks-of-ignoring-ipv6-in-your-network\/","title":{"rendered":"The Risks of Ignoring IPv6 in Your Network"},"content":{"rendered":"\n

By Carolina Badano<\/a>, Communications Coordinator at LACNIC<\/p>\n\n\n\n

During his presentation at the LACNIC 42 LACNOG 2024 event held in Asunci\u00f3n Paraguay, Henri Alves de Godoy, network analyst and professor at Campinas University, stressed the urgent need to monitor dual-stack networks and underscored the risks of ignoring the IPv6 protocol. The key aspects of his presentation are highlighted below.<\/p>\n\n\n\n

IPv6. What is the current state of connectivity?<\/strong><\/h2>\n\n\n\n

Despite living in an era where most devices support IPv6 and where adoption rates have already exceeded 50% in countries such as Mexico, Brazil, and Uruguay, Alves noted that it is common for people to approach him saying that they don’t have IPv6 in their networks. \u201cThis is a misconception and, at times, a risk because these people don’t understand why the provider does not make use of the global address,\u201d he added.<\/p>\n\n\n\n

Moreover, cybercriminals and botnets continue to evolve and are using IPv6.<\/p>\n\n\n\n

According to Alves, many honeypots (sensors that collect information about threat actor behavior on the Internet) are not yet configured to collect data over IPv6, and some threat intelligence reports continue to ignore the protocol. The image below shows the percentage of malicious behavior not identified by any security layer.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Source: Morphus Cyber \u200b\u200bThreat Resilience Report, 2022<\/p>\n\n\n\n

As a result, Alves concluded that a portion of traffic is currently not being analyzed, adding that this issue should not be ignored and must be addressed urgently.<\/strong><\/p>\n\n\n\n

What are the risks of ignoring IPv6 in our networks?<\/strong><\/strong><\/h2>\n\n\n\n

When operators ignore the presence of IPv6 in their networks, they cannot implement robust access controls or traffic filters. A simple scan of the IPv4 network could reveal the existence of an IPv6 address, which would allow hackers to move laterally within the internal systems and thus escape detection mechanisms.<\/p>\n\n\n

Additional reading:<\/div><\/div><\/div>
IPv6 and Its Importance for Research and Development (R+D)<\/a><\/div><\/div><\/section>\n\n\n

Alves presented three practical examples (tested in a controlled lab environment) that can occur if we don\u2019t monitor IPv6 traffic:<\/p>\n\n\n\n

    \n
  1. Automatic tunnels: compromise user experience and divert traffic<\/li>\n<\/ol>\n\n\n\n

    In some operating systems, these methods are automatically enabled and, if not properly monitored, can redirect traffic, exposing critical vulnerabilities. Tunnels can also create openings for data exfiltration, if employing IPv6 packets encapsulated in IPv4 in a communication that is not properly monitored and protected.<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n