MLD Considered Harmful - Breaking Another IPv6 Subprotocol
summary
Claim: Multicast Listener Discovery (MLD/MLDv2) is often unnecessary on typical IPv6 LANs and its design lets an attacker easily overload or disrupt infrastructure. Lab demos use two routers, a multicast source, an attacker and tools Kiren, scapy, THC IPv6 toolkit to: spoof querier election, suppress reports via last‑listener queries, and flood routers with large MLDv2 reports. Results show a 38× increase in reports, router CPU cores pegged at 100% and switches/routers hitting up to 90% packet loss, plus crashes and 150,000 multicast table entries in vulnerable devices.
AI-written summary · about
chapters (12)
- 0:00Introduction to MLD
- 2:01Understanding MLD basics
- 7:24MLD operation and protocols
- 11:51Protocol limitations and risks
- 15:43Experimental findings and testing
- 20:46Impact of MLD on network stability
- 25:55Live demonstration and exploitation
- 31:24Attack scenarios and techniques
- 36:27Practical testing setup
- 41:25MLD snooping and risks
- 46:56Revisiting MLD and neighbor discovery
- 56:05Conclusions and recommendations
related talks
47mPrivacy and Decentralisation with Multicast
58mEvasion of High-End IDPS Devices at the IPv6 Era
09mIoT meets IPv6: The Perfect Storm?
40mAll Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.
26mMobile Interconnect Threats: How Next-Gen Products May be Already Outdated
35mLCDPwn: Breaking Enterprise-Things with Layer 2 Discovery Protocol Vulnerabilities Again
23mBreaking Theoretical Limits: The Gap Between Virtual NICs and Physical Network Cards
27mWIFI-Important Remote Attack Surface: Threat is Expanding