IPv6 keeps getting hacked on Windows

About this video

Chuck explains a critical Windows IPv6 flaw that lets an attacker achieve remote code execution by sending specially crafted IPv6 packets, with no clicks or other action required from the victim. He puts it in context with IPv4 exhaustion: there were only 4.3 billion IPv4 addresses, so homes relied on NAT, where devices use private addresses behind one public address and are not directly reachable. IPv6 solves exhaustion with a vastly larger pool, but global unicast addresses that start with a 2 or 3 can be publicly routable, unlike link-local addresses starting with FE80. He shows how to check with ipconfig and test-ipv6.com, then walks through the exploit in plain terms: an integer underflow tricks the system into calculating a buffer that is far too small, the oversized payload overflows it and spills into other memory, potentially redirecting execution to malicious code. He notes the attack is low complexity and potentially wormable, comparing its spread potential to how WannaCry used SMB. Mitigation is to install Microsoft’s Patch Tuesday security update, or, with caution about breaking things, disable IPv6 per network adapter in Windows.

Key takeaways

• The flaw uses an integer underflow to create a too-small buffer, causing a buffer overflow and possible remote code execution from crafted IPv6 packets
• No user interaction is needed: the Windows TCP/IP stack is exploited simply by processing IPv6 packets as designed
• NAT gave typical IPv4 home networks a default barrier, while publicly routable IPv6 global unicast addresses can be reachable directly
• Link-local IPv6 addresses start with FE80 and are not publicly routable; global unicast addresses start with a 2 or a 3
• The primary fix is Microsoft’s security update; disabling IPv6 on each adapter is an alternative, but Chuck advises checking with IT at work first

Episode details: published August 30, 2024 · 14:40 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: What is DNS? (and how it makes the Internet work) · Next: never leave the terminal →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube