Threat actor can accomplish stealth attacks that result in trust exploitation by using dual-stacked hosts, rogue Neighbor Discovery Protocol (NDP) messages, and tunneling techniques. Teredo tunneling, for example, is an IPv6 transition technology that provides automatic IPv6 address assignment when IPv4/IPv6 hosts are located behind IPv4 network address translation (NAT) devices. It accomplishes this by embedding the IPv6 packets inside IPv4 UDP packets. The threat actor gains a foothold in the IPv4 network. The compromised host sends rogue router advertisements (RAs), which triggers dual stacked hosts to obtain an IPv6 address. The threat actor can then use this foothold to move around, or pivot, inside the network. The threat actor can compromise additional hosts before sending traffic back out of the network, as shown in the figure.
-
