Re:Router Security
by throw0101a on Saturday July 30, 2022 @12:43PM
(#32288151)
It's explained in the Blackhat presentation if you bother flipping through the slide deck:
The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address.
In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc.
Then the EUIs-64 and look them up in a Wifi geolocation database:
The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address.
In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc.
Then the EUIs-64 and look them up in a Wifi geolocation database:
* https://www.wigle.net