3 ms·
How does the attacker get the IPv6 address from the SSID MAC? Or am I looking at the issue the wrong way? Routers will hardly ever make connections themselves
by yardstick 4y ago
How does the attacker get the IPv6 address from the SSID MAC? Or am I looking at the issue the wrong way?
Routers will hardly ever make connections themselves out to the internet, except maybe for things like DNS which hopefully are using major providers like Google which won’t leak the data anyway.
- throw0101a 4y agoIt's explained in the Blackhat presentation if you bother flipping through the slide deck: The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address. In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc. Then the EUIs-64 and look them up in a Wifi geolocation database: * https://www.wigle.net https://www.wigle.net
- yardstick 4y agoAh ok thanks, I understand now. So it’s both having the EUI-64 address and the router responding with an ICMP message rather than being silent. Got it.