3 ms·

> The author shows a complete lack of knowledge on IPv6.[…] you will also get a anonymized address which does not leak your MAC on the internet. No, they do no

> The author shows a complete lack of knowledge on IPv6.[…] you will also get a anonymized address which does not leak your MAC on the internet. No, they do not lack knowledge. See the sibling comments: the issue is not a concern of what various computer and mobile OSes do, but rather with some CPE firmware still using EUI-64-based IPv6 addresses. This allows attackers on the Internet to send out probes, find the router's Wifi interface, map it to the BSSID/SSID, and look up the SSID in geolocation database: * https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou-exploiting-leaked-identifiers-in-ipv-for-street-level-geolocation-22889 https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou... Ideally what they should be doing is contacting vendors to fix their firmware (and also creating CVEs for 'public shaming'), and not telling people to disable IPv6. Disabling IPv6 does not solve the problem: it is still lurking there for folks that haven't read this site/advice.

yardstick 4y ago
How does the attacker get the IPv6 address from the SSID MAC? Or am I looking at the issue the wrong way? Routers will hardly ever make connections themselves out to the internet, except maybe for things like DNS which hopefully are using major providers like Google which won’t leak the data anyway.
- throw0101a 4y ago
  It's explained in the Blackhat presentation if you bother flipping through the slide deck: The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address. In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc. Then the EUIs-64 and look them up in a Wifi geolocation database: * https://www.wigle.net https://www.wigle.net
  - yardstick 4y ago
    Ah ok thanks, I understand now. So it’s both having the EUI-64 address and the router responding with an ICMP message rather than being silent. Got it.
megous 4y ago
Just don't assign a public IPv6 address to the router, then?

yardstick 4y ago

How does the attacker get the IPv6 address from the SSID MAC? Or am I looking at the issue the wrong way? Routers will hardly ever make connections themselves out to the internet, except maybe for things like DNS which hopefully are using major providers like Google which won’t leak the data anyway.

throw0101a 4y ago
It's explained in the Blackhat presentation if you bother flipping through the slide deck: The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address. In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc. Then the EUIs-64 and look them up in a Wifi geolocation database: * https://www.wigle.net https://www.wigle.net
- yardstick 4y ago
  Ah ok thanks, I understand now. So it’s both having the EUI-64 address and the router responding with an ICMP message rather than being silent. Got it.

megous 4y ago

Just don't assign a public IPv6 address to the router, then?