Hello and welcome to the Monday, June 22nd, 2006 edition of the Sands International Stormontas

Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sandsdot edu credit certificate program in

cybersecurity engineering. Well, Xavier came across an interesting phishing email that used

IPV4 mapped IPV6 addresses. These addresses are really more an operating system construct,

so you will not see these addresses on the network.

That's something I often see people describe,

but on the network you would see an IPV4 packet in this case.

The main reason for these IPV6 addresses,

and basically they start with all zeros, then FF, FF, and the last 32 bits

are the IPV4 address that's sort of embedded in this address. The real reason for these

addresses really more to that, you know, when you're writing networking software, you can really

just write IPV6 software, and then it will automatically be able to connect with IPV4 hosts.

But the operating system then will basically create an IPV4 packet, not an IPV6 packet when

connecting to such an address.

So the main purpose of these addresses is obfuscation from scanning tools.

Your antivirus, anti-malvair, anti-spam,

will not necessarily see an IPV4 address here.

They think they sort of have an IPV6 address,

and then of course they won't find it on any block list.

So at least that's what I think is sort of happening here.

That's why attackers sometimes use these

...