Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses

[Guest Diary: Stephen Groat] [Geolocation Using IPv6 Addresses]

Today we bring you a guest diary from Stephen Groat where he speaks about validating that IPv6 address tracking and monitoring are possible.

IPv6 designers developed a technique called stateless address autoconfiguration (SLAAC) to reduce the administrative burden of managing the immense IPv6 address space. To most operating systems’ current accepted definition of SLAAC, a node’s IPv6 address’s interface identifier (IID), or host portion, is deterministic across networks. For the last 64 bits, the node automatically configures an address on the basis of its network interface’s media access control (MAC) address. Even operating systems that obscure addresses according to Request for Comments (RFC) 4941 contain a static IID used for neighbor solicitation. These static IIDs can identify a particular node, even as the node changes networks.

Using Virginia Tech’s campuswide IPv6 production network, which supports more than 30,000 IPv6 nodes daily, we were able to validate that IPv6 address tracking and monitoring are possible. We tested an Android mobile device using MAC-based IIDs to form wireless IPv6 addresses.

[Figure 1]

The first part of our test involved tracking the mobile device as it moved around campus. Geotemporal tracking was possible because the campus network contains different subnets that cover different geographic areas. We programmed a script that continually sent echo requests to the different subnets on campus. When we received an echo reply, we stored its time and location. Figure 1 demonstrates the results of a successful tracking attempt.

The second part of our test involved traffic monitoring. Our goal was to demonstrate that we could isolate a node, regardless of subnet, and collect all of its associated network traffic. We placed a sensor at the network border to collect all IPv6 traffic leaving the network. Using a packet sniffer, we successfully filtered the traffic related to the node in question across different subnets.

 

Post suggestions or comments in the section below or send us any questions or comments in the contact form on https://isc.sans.edu/contact.html#contact-form

--
Adam Swanger, Web Developer (GWEB, GWAPT)
Internet Storm Center https://isc.sans.edu

AdamS

86 Posts
Of course this was possible before IPv6, and entirely passively, with anything that could sniff ARP traffic on those subnets, or WLAN traffic over the air. Network administrators may have the same info in DHCP or WLAN association logs. What's new here is that active probes can be made from off-site, unless the device is configured to filter/ignore them.

Thanks to IPv6 expanding the address space though, it might be viable for people to randomise their EUI-48/MAC (and maybe also use something other than 'ff:fe' in the middle of the SLAAC address) to gain some privacy with lesser risk of collisions.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!