4 ms·

The author shows a complete lack of knowledge on IPv6. Yes, you do get a SLAAC address which basically contains you MAC, but if your OS supports it, you will al

The author shows a complete lack of knowledge on IPv6. Yes, you do get a SLAAC address which basically contains you MAC, but if your OS supports it, you will also get a anonymized address which does not leak your MAC on the internet. Windows, Android, Linux, iOS all support MAC address anonymization, so as long as you are using a recent OS you should be fine. Very weird suggestion...

whyoh 4y ago
Right. But isn't it so that each device gets its own IPv6 public address? So that PC1 and PC2 connected through the same modem are identifiable by different IPs, while you can still see that they're from the same modem/household? If that's the case, it can be a privacy concern.
- tommiegannert 4y ago
  Theoretically, even non-router devices could use more than one address, just to confuse what's listening on the other side. In that scenario, DHCPv6 would be responsible for keeping the assigned subnet filled randomly, rather than being conservative and consistent with address assignments. I don't know if anyone is doing it now, but I don't think we should dismiss IPv6 for this reason.
  - megous 4y ago
    Android doesn't respect/implement DHCPv6. But there are IPv6 privacy extensions that periodically rotate the IPv6 addresses of the device. https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
    - tommiegannert 4y ago
      Thanks for the reference! Doing that directly with SLAAC is of course even nicer.
throw0101a 4y ago
> The author shows a complete lack of knowledge on IPv6.[…] you will also get a anonymized address which does not leak your MAC on the internet. No, they do not lack knowledge. See the sibling comments: the issue is not a concern of what various computer and mobile OSes do, but rather with some CPE firmware still using EUI-64-based IPv6 addresses. This allows attackers on the Internet to send out probes, find the router's Wifi interface, map it to the BSSID/SSID, and look up the SSID in geolocation database: * https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou-exploiting-leaked-identifiers-in-ipv-for-street-level-geolocation-22889 https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou... Ideally what they should be doing is contacting vendors to fix their firmware (and also creating CVEs for 'public shaming'), and not telling people to disable IPv6. Disabling IPv6 does not solve the problem: it is still lurking there for folks that haven't read this site/advice.
- yardstick 4y ago
  How does the attacker get the IPv6 address from the SSID MAC? Or am I looking at the issue the wrong way? Routers will hardly ever make connections themselves out to the internet, except maybe for things like DNS which hopefully are using major providers like Google which won’t leak the data anyway.
  - throw0101a 4y ago
    It's explained in the Blackhat presentation if you bother flipping through the slide deck: The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address. In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc. Then the EUIs-64 and look them up in a Wifi geolocation database: * https://www.wigle.net https://www.wigle.net
    - yardstick 4y ago
      Ah ok thanks, I understand now. So it’s both having the EUI-64 address and the router responding with an ICMP message rather than being silent. Got it.

whyoh 4y ago

Right. But isn't it so that each device gets its own IPv6 public address? So that PC1 and PC2 connected through the same modem are identifiable by different IPs, while you can still see that they're from the same modem/household? If that's the case, it can be a privacy concern.

tommiegannert 4y ago
Theoretically, even non-router devices could use more than one address, just to confuse what's listening on the other side. In that scenario, DHCPv6 would be responsible for keeping the assigned subnet filled randomly, rather than being conservative and consistent with address assignments. I don't know if anyone is doing it now, but I don't think we should dismiss IPv6 for this reason.
- megous 4y ago
  Android doesn't respect/implement DHCPv6. But there are IPv6 privacy extensions that periodically rotate the IPv6 addresses of the device. https://datatracker.ietf.org/doc/html/rfc4941 https://datatracker.ietf.org/doc/html/rfc4941
  - tommiegannert 4y ago
    Thanks for the reference! Doing that directly with SLAAC is of course even nicer.

throw0101a 4y ago

> The author shows a complete lack of knowledge on IPv6.[…] you will also get a anonymized address which does not leak your MAC on the internet. No, they do not lack knowledge. See the sibling comments: the issue is not a concern of what various computer and mobile OSes do, but rather with some CPE firmware still using EUI-64-based IPv6 addresses. This allows attackers on the Internet to send out probes, find the router's Wifi interface, map it to the BSSID/SSID, and look up the SSID in geolocation database: * https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou-exploiting-leaked-identifiers-in-ipv-for-street-level-geolocation-22889 https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou... Ideally what they should be doing is contacting vendors to fix their firmware (and also creating CVEs for 'public shaming'), and not telling people to disable IPv6. Disabling IPv6 does not solve the problem: it is still lurking there for folks that haven't read this site/advice.

yardstick 4y ago
How does the attacker get the IPv6 address from the SSID MAC? Or am I looking at the issue the wrong way? Routers will hardly ever make connections themselves out to the internet, except maybe for things like DNS which hopefully are using major providers like Google which won’t leak the data anyway.
- throw0101a 4y ago
  It's explained in the Blackhat presentation if you bother flipping through the slide deck: The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address. In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc. Then the EUIs-64 and look them up in a Wifi geolocation database: * https://www.wigle.net https://www.wigle.net
  - yardstick 4y ago
    Ah ok thanks, I understand now. So it’s both having the EUI-64 address and the router responding with an ICMP message rather than being silent. Got it.