Examkin

Question

Difficulty: HardNetwork and Wireless Attack Indicators

During an incident response investigation on an enterprise network operating an IPv4 infrastructure, security analysts observe unauthorized traffic redirection affecting internal hosts. Network packet captures reveal an influx of unsolicited ICMPv6 Type 134 messages broadcast across the local subnet containing a Router Preference flag set to 'High' and pointing DNS recursive server options to an untrusted external link-local address. Which network attack indicator is demonstrated in this scenario?

  1. Rogue IPv6 Router Advertisement attack leveraging Stateless Address Autoconfiguration traffic prioritizationAnswer
  2. B
    ARP cache poisoning attack leveraging unsolicited gratuitous ARP replies to overwrite layer 2 mapping tables
  3. C
    DNS cache poisoning attack leveraging transaction ID prediction to override authorized domain resolution records
  4. D
    DHCPv6 starvation attack leveraging MAC address spoofing to deplete link-local address pools

Answer

Rogue IPv6 Router Advertisement attack leveraging Stateless Address Autoconfiguration traffic prioritization
The correct answer identifies the indicator as a Rogue IPv6 Router Advertisement attack. ICMPv6 Type 134 packets represent Router Advertisements used in SLAAC. When an attacker broadcasts forged RAs with high preference and custom DNS options, dual-stack hosts default to IPv6 over IPv4, redirecting their traffic through the attacker's rogue gateway.

Step-by-Step Solution

1
Analyze the protocol and packet type described in the incident logs
Identified ICMPv6 Type 134 as a Neighbor Discovery Protocol (NDP) Router Advertisement (RA) message.
ICMPv6 Type 134 messages are strictly defined in RFC 4861 as Router Advertisements used by IPv6 routers to inform hosts of default routes and autoconfiguration parameters.
2
Evaluate host behavior under Stateless Address Autoconfiguration (SLAAC) defaults
Dual-stack operating systems automatically prefer IPv6 routes over IPv4 routes when an RA is received.
Modern operating systems enable IPv6 by default; receiving a rogue RA with high preference causes hosts to auto-assign IPv6 addresses and send outbound traffic through the attacker's gateway.
3
Distinguish the indicator from alternative network redirection attacks
Confirmed the attack vector is a Rogue IPv6 RA attack rather than ARP, DNS, or DHCPv6 starvation.
Unsolicited ICMPv6 Type 134 messages with modified DNS options specifically indicate IPv6 RA spoofing designed for on-path interception.

Key Concept

Rogue IPv6 Router Advertisement (RA) attack indicators and SLAAC exploitation
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic