5 ms·
https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou-exploiting-leaked-identifiers-in-ipv-for-street-level-geolocation-22889 https://www.blackhat.com/us
by Sakos 4y ago
https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou-exploiting-leaked-identifiers-in-ipv-for-street-level-geolocation-22889 https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou...
It's based on this talk apparently
> We assume a weak adversary who is remote to the target and has no privileged access. Our privacy attack lies in IPv6 addresses formed via EUI-64, which embed the interface's hardware MAC address in the IPv6 address. While EUI-64 IPv6 addresses are no longer used by most operating systems, they are commonly found in legacy and low-profit-margin customer premises equipment (CPE), e.g., commodity routers connecting residential and business subscribers. Because IPv6 CPE are routed hops (as opposed to IPv4 NATs), we can discover their MAC address via traceroute if they use EUI-64.
> These CPE are frequently all-in-one devices that also provide Wi-Fi. Crucially, the MAC address of the Wi-Fi interface is often related to the MAC address of the wide area interface, e.g., a +/-1 offset. These Wi-Fi MACs are broadcast (the 802.11 BSSID) and captured by wardriving databases that also record their physical location. By correlating the MAC addresses embedded in IPv6 home router addresses with their Wi-Fi address counterpart, we can remotely geolocate them, fusing virtual data with meatspace.
They have a tool that lets you check a given IPv6 address: https://github.com/6int/IPvSeeYou https://github.com/6int/IPvSeeYou
- ikiris 4y agoHeh, I was dubious but this is a perfectly valid explanation for why you should not embed phy addresses in IPs. That said, it's absolutely toxic to be telling people to just turn off IPv6. Completely makes me lose trust in the rest of the site's content.
- Sakos 4y agoA source link to a very thorough article at Tom's Guide (https://www.tomsguide.com/news/home-gateway-geolocation-bh21 https://www.tomsguide.com/news/home-gateway-geolocation-bh21) is provided close to the top of the page (in the short list). That guide links to the Black Hat presentation. > For years, turning off IPv6 (IP version 6) was on the long list below, but as of August 2021, I think it belongs here on the short list too. Very very few people need it and it was recently disclosed that there is a possible security issue with it. I think you're being a bit too accusative. Every suggestion has sources to back it up if you want to see why something is recommended.
- jaclaz 4y ago>These Wi-Fi MACs are broadcast (the 802.11 BSSID) and captured by wardriving databases that also record their physical location. I am not sure to understand, while this is in theory doable, do these "captured by wardriving" databases exist? And do they cover "everywhere"?
- veonik 4y agoA long while back now Google came out saying[0] they did use their Google Maps Street View cars to also collect wifi+location information. It wouldn't surprise me if they augmented this info with data they receive through Google services running on Android phones too. So my bet is, yeah, they do exist and they do pretty much cover everywhere. [0]: https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data https://www.theguardian.com/technology/2010/may/15/google-ad...
- jaclaz 4y agoI see now, thanks. Though I believe that if Google is the adversary, they have ways (only a guess, but some kind of correlation between GPS location on mobile while connected to Wi-Fi and http requests could be one) that make the "wardriving database" unneeded, I mean, there should be a constant updating of this database, or it would turn out pretty much obsolete soon.
- toast0 4y agoThe database may have originally been filled by wardriving, but it can be updated by their distributed agents (phones with location services turned on).
- Lukas_Skywalker 4y agoGoogle even has a geolocation API [1] where you can send the BSSID and signal strength of the access points in your range and it calculates your position. [1]: https://developers.google.com/maps/documentation/geolocation/overview#wifi_access_point_object https://developers.google.com/maps/documentation/geolocation...