{"id":5158,"date":"2012-07-17T21:42:18","date_gmt":"2012-07-18T01:42:18","guid":{"rendered":"http:\/\/rbachnet.wwwmi3-ss40.a2hosted.com\/?p=5158"},"modified":"2021-07-29T11:44:08","modified_gmt":"2021-07-29T15:44:08","slug":"ipv6-smartphones-compromise-users-privacy","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/ipv6-smartphones-compromise-users-privacy\/","title":{"rendered":"IPv6 Compromise Smartphones Users’ Privacy"},"content":{"rendered":"

\"IPv6Now that the IPv4 address<\/a> pool is depleted and the\u00a0IPocalypse is at hand, wrinkles are emerging in IPv6<\/a>.\u00a0 One of the wrinkles is with mobile devices. Most of the cool mobiles devices have been able to handle IPv6 for a while.\u00a0Apple’s<\/a> (AAPL<\/a>) iPhones<\/a>, iPads<\/a>, and iPods<\/a> have been capable of handling IPv6 Since version 4 of the iOS<\/a> operating system and most Google<\/a> (GOOG<\/a>) Android<\/a> devices have been capable since version 2.1. H\u00a0 Security<\/em><\/a> is reporting<\/a> that these mobile operating systems send information about their users to the network.<\/p>\n

\"Smartphone<\/a>A device on an IPv6 network usually determines half of their address (the “interface identifier”) themselves, but H Security<\/em> says that smartphones are sloppy with this task. According to the article, smartphones simply add the same two bytes to their globally unique MAC address<\/a> and use it as their identifier. As a result, they transfer a unique hardware ID whenever they communicate with an IPv6-enabled server.<\/p>\n

The basic problem isn’t an IPv6<\/a> issue because there are other methods for generating the address. The article says that a device can generate a random interface identifier and replace it on a regular basis. This is called the Privacy Extensions method and is the factory-set option in Windows; it can also be enabled in other operating systems. The article points out that devices running Apple’s iOS or Android offer neither the option to enable Privacy Extensions nor the option to disable IPv6, anyone who uses an affected device on an IPv6-enabled wireless network will send their ID.<\/p>\n

\"IPocalypse\"<\/a>The only thing the smartphones are lacking is a control option in the user interface, as the Privacy Extensions do come as part of their kernel. For instance, on a (jailbroken) iOS 4 device with root access, they can be enabled with the same command that enables them on a desktop device running Mac OS X<\/a>:<\/p>\n

sysctl -w net.inet6.ip6.use_tempaddr=1<\/p>\n

The blog claims the problem is only affecting a small number of users because IPv6 is not yet in widespread use. However, more ISPs<\/a> plan to offer IPv6<\/a> in addition to the old IPv4 in the future. In addition, there are routers like the\u00a0Cisco<\/a> (CSCO<\/a>) Linksys E3000<\/a>, which will automatically set up an IPv6 connection via a 6to4 conversion<\/a> when their internet access is purely IPv4.<\/p>\n

The author concludes that the issue is particularly sensitive because such devices tend to be used by one specific person. As a result, the MAC address, which is accessible to any server operator and network monitor, allows this user to be identified.<\/p>\n

rb-<\/em><\/strong><\/p>\n

If this sounds familiar, it is I wrote about mobile apps uploading\u00a0 UDID’s here<\/a><\/em>.<\/p>\n

Related articles<\/h6>\n