Examkin

Question

Difficulty: HardNetwork and Wireless Attack Indicators

An enterprise security operations team investigates anomalous traffic patterns within a corporate dual-stack subnetwork. Network monitoring alerts indicate that multiple workstations have dynamically updated their default gateway settings to route external traffic through an unapproved link-local address. Packet captures reveal continuous, unsolicited ICMPv6 Type 134 messages being broadcast across the segment with a high router preference flag enabled. Which of the following attack types is indicated by these findings?

  1. Rogue IPv6 Router Advertisement (RA) attackAnswer
  2. B
    Address Resolution Protocol (ARP) poisoning attack
  3. C
    Domain Name System (DNS) amplification attack
  4. D
    Virtual Local Area Network (VLAN) hopping attack

Answer

Rogue IPv6 Router Advertisement (RA) attack
The scenario describes unsolicited ICMPv6 Type 134 messages (Router Advertisements) with high preference flags, which alter host routing tables on dual-stack subnetworks to direct traffic to an attacker's rogue gateway. This is the classic signature of a Rogue IPv6 Router Advertisement attack.

Step-by-Step Solution

1
Analyze protocol indicators in the packet capture.
Identified ICMPv6 Type 134 messages, which correspond specifically to IPv6 Router Advertisement (RA) packets used in Neighbor Discovery Protocol (NDP).
Router Advertisements inform local network hosts of default gateway IP addresses and subnetwork prefixes.
2
Evaluate the behavior and impact described in the scenario.
Unsolicited high-preference ICMPv6 Type 134 broadcasts forced dual-stack endpoints to reconfigure their default IPv6 routing table towards an unauthorized link-local address.
This behavior indicates an attacker deploying a rogue IPv6 router to perform an on-path traffic interception attack.
3
Differentiate from alternative network attacks.
Confirmed that IPv4 ARP poisoning, DNS amplification, and 802.1Q VLAN hopping operate on distinct mechanisms and protocols.
Only a Rogue IPv6 Router Advertisement attack produces ICMPv6 Type 134 flooding and spontaneous gateway reconfiguration on IPv6 endpoints.

Key Concept

IPv6 Neighbor Discovery Protocol (NDP) Vulnerabilities and Rogue Router Advertisements
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic