If I'm reading this correctly, it also seems to suggest some of the insecurities only occur on IPv6? Meaning it gives people a security reason to disable it unless they need it. Curious if anyone has more info on this:
> The rogue DNS server is introduced when an attacker injects an ICMPv6 Router Advertisement into Wi-Fi traffic. Routers typically issue these announcements so other devices on the network can locate them. The injected advertisement instructs all devices to use a DNS specified by the attacker for lookups of both IPv6 and IPv4 addresses.
Good networking devices, such as Wi-Fi Access Points and Switches can filter out rogue ICMPv6 Router Advertisements (usually called RA guard). Professional networks should filter these. This is very comparable to e.g. rogue DHCPv4 or DHCPv6 servers and DHCP spoofing (the protection is usually called DHCP snooping).
In general, IPv6 is similarly secure as IPv4 or can be configured as such. In highly secure networks, Wi-Fi or other wireless is a no-no and everybody knows this. It is usually much easier to control access to all the physical locations. It isn't as easy to also have the same level of control in the parking lot before the building.
I feel like wifi attacks like this don’t acknowledge caveated well enough. DNS poisoning should be mitigated by cryptographic trusts, HTTP ‘downgrade’ attacks by HSTs.
As soon as you start caring about transport security, you have to care not only about your local network being encrypted (I’ve never seen encrypted Ethernet), but also your upstream providers routes, and the operational security of those.
These are all well understood by some of the security community. While these memelords continue to name their little vulnerabilities to make headlines, actual security, and newsworthy vulnerabilities slip under the headlines entirely.
> The rogue DNS server is introduced when an attacker injects an ICMPv6 Router Advertisement into Wi-Fi traffic. Routers typically issue these announcements so other devices on the network can locate them. The injected advertisement instructs all devices to use a DNS specified by the attacker for lookups of both IPv6 and IPv4 addresses.