News for hackers. Stuff that matters.

A comment on Router Security. Parent comment

Re:Router Security by yardstick on Saturday July 30, 2022 @11:26AM (#32287530)
How does the attacker get the IPv6 address from the SSID MAC? Or am I looking at the issue the wrong way?

Routers will hardly ever make connections themselves out to the internet, except maybe for things like DNS which hopefully are using major providers like Google which won’t leak the data anyway.

[ Parent | on HN ]
Re:Router Security by throw0101a on Saturday July 30, 2022 @12:43PM (#32288151)
It's explained in the Blackhat presentation if you bother flipping through the slide deck:

The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address.

In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc.

Then the EUIs-64 and look them up in a Wifi geolocation database:

* https://www.wigle.net

[ Parent | on HN ]
Re:Router Security by yardstick on Saturday July 30, 2022 @01:42PM (#32288711)
Ah ok thanks, I understand now.

So it’s both having the EUI-64 address and the router responding with an ICMP message rather than being silent. Got it.

[ Parent | on HN ]