3 ms·
It's explained in the Blackhat presentation if you bother flipping through the slide deck: The attacker sends a ping to any random address in the /64. The rout
by throw0101a 4y ago
It's explained in the Blackhat presentation if you bother flipping through the slide deck:
The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address.
In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc.
Then the EUIs-64 and look them up in a Wifi geolocation database:
* https://www.wigle.net https://www.wigle.net
- yardstick 4y agoAh ok thanks, I understand now. So it’s both having the EUI-64 address and the router responding with an ICMP message rather than being silent. Got it.