North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: a record?

  • From: Rob Thomas
  • Date: Mon Nov 14 19:48:14 2005 
Hi, NANOGers.

Efficient or not, we do see scanning activity on IPv6.  We've seen
IPv6 botnets, compromised hosts on IPv6 used as IRC bounces,  and
even one EU-based warez crew that enabled IPv6 tunnels on the
hosts they compromised.  They used the IPv6 tunnels as their
management plane.

While IPv6 obviously presents a huge address space, the miscreants
don't have to scan all of it, or compromise much more than a few
devices on it, to reap a reward.  Just enough is good enough.

I'll take a pina colada anyway.  :)

Thanks,
Rob.
-- 
Rob Thomas
Team Cymru
http://www.cymru.com/
ASSERT(coffee != empty);