IPv6: Nowhere to Run, Nowhere to Hide

Abstract

Due to a large address space, Internet Protocol version 6 (IPv6) uses stateless address autoconfiguration to assign network addresses to hosts. This unmanaged technique creates a static value derived from the Media Access Control (MAC) address of a network interface as the host portion, or interface identifier (IID). Static IID assignment provides third parties (whether malicious or not) with the ability to track a node's physical location, correlate network traffic with a specific user, and collect details about a node's operating system. Using our live production IPv6 network, we demonstrate not only the feasibility of IID monitoring, but also the ease with which an attacker can accomplish it. We then highlight some possible nefarious applications where IPv6 address tracking and analysis could assist the cyber criminal. In order to prevent this privacy breach, we offer solutions that disassociate the IPv6 address from its user.