Listen to this Post
Introduction:
Hack Glasgow 2026 brought together over 360 security professionals at the Citizens Theatre for a single day of technical talks across two parallel tracks. The event surfaced three critical themes that define the current state of information security: the persistence of IPv6 privacy vulnerabilities in IoT infrastructure, the dangerous disconnect between penetration testing methodologies and real adversary behaviour, and the unglamorous but essential grind of responsible disclosure in aviation cybersecurity. Vivian’s opening talk on “Six Years of IPv6” set the tone—reminding the room that networking, the foundation of infosec, still harbours fundamental design flaws that blue teams can no longer afford to treat as niche concerns.
Learning Objectives:
- Understand how EUI-64 IPv6 address generation enables persistent cross-1etwork device tracking and how to detect it
- Analyse the gap between penetration tester behaviour and real adversary tactics, and learn how adversary emulation bridges this divide
- Master the technical and regulatory landscape of aviation cybersecurity disclosure, including hands-on testing techniques
You Should Know:
- IPv6 EUI-64 Address Tracking: The MAC Address That Never Stays Home
Vivian’s core insight—that many big-1ame IoT devices still shove MAC addresses straight into public IPv6 addresses—is not theoretical. Stateless Address Autoconfiguration (SLAAC) traditionally generates IPv6 Interface Identifiers (IIDs) by embedding a device’s 48-bit MAC address using the Modified EUI-64 format. The transformation is simple: split the MAC into two 24-bit halves, insert `FF:FE` in the middle, and flip the universal/local bit. The resulting IID remains constant across every network the device connects to, enabling anyone who observes that IPv6 address to correlate sessions across home, coffee shop, and office networks. Worse, the MAC address can be trivially recovered by reversing the transform.
Research has shown that while modern operating systems have largely adopted privacy extensions, Customer Premise Equipment—home routers and gateways—still makes extensive use of EUI-64 addresses. An attacker performing traceroutes to a client can determine the manufacturer and model of their home gateway, enabling targeted attacks. As Vivian argued, IPv6 belongs in the blue team toolbox, not the niche protocol pile.
Hands-On: Detecting and Mitigating IPv6 EUI-64 Tracking
Check if your Linux system uses privacy extensions:
Check current privacy extension settings sysctl net.ipv6.conf.all.use_tempaddr sysctl net.ipv6.conf.eth0.use_tempaddr Enable privacy extensions (RFC 8981) cat > /etc/sysctl.d/60-ipv6-privacy.conf << 'EOF' net.ipv6.conf.all.use_tempaddr = 2 net.ipv6.conf.default.use_tempaddr = 2 EOF sysctl --system Verify temporary addresses are being generated ip -6 addr show eth0 | grep temporary
On Windows:
Check privacy extension status
netsh interface ipv6 show privacy
Check IPv6 privacy address settings via PowerShell
Get-1etIPv6Protocol | Select-Object UseTemporaryAddresses
List all SLAAC-generated addresses with their lifetimes
Get-1etIPAddress -AddressFamily IPv6 | Where-Object { $_.PrefixOrigin -eq "RouterAdvertisement" } | Select-Object InterfaceAlias, IPAddress, SuffixOrigin, AddressState, ValidLifetime, PreferredLifetime
Detect EUI-64 addresses on your network with Nmap:
Use Nmap's address-info script to decode EUI-64 addresses nmap -6 --script address-info <target_ipv6> Generate IPv6 targets from known MAC addresses using EUI-64 nmap -6 --script targets-ipv6-eui64 --script-args newtargets <target>
RFC 8981 describes temporary addresses with randomised IIDs that change periodically, limiting the window during which eavesdroppers can perform address-based activity correlation. RFC 7217 provides an alternative: stable addresses that change when a host moves between networks. Organisations should audit their IPv6 deployments to ensure that privacy extensions are enabled on all endpoints—and that CPE devices are not inadvertently exposing MAC-derived identifiers.
- The Red-Blue Gap: Why Pen Testers Don’t Behave Like Adversaries
Andy G. and Alex Close presented the same engagement from red and blue perspectives, leaving the audience chewing on a critical question: what is the gap between how penetration testers behave and how real adversaries behave, and what is that gap quietly doing to everyone’s detection rules?
The gap is substantial. Penetration tests are typically loud—testers don’t put much effort into going undetected because they are contracted to find vulnerabilities, not to evade detection. Real adversaries, by contrast, are quiet, patient, and deliberate. They move laterally with low-and-slow techniques that generate few alerts. Detection rules built from pentest findings detect only the TTPs that testers have personally used, creating blind spots shaped exactly like the analyst’s experience gaps.
MITRE ATT&CK provides a common language to bridge this divide through adversary emulation—cybersecurity assessments that mimic advanced persistent threat tactics, techniques, and procedures based on real-world observations. Rather than testing for vulnerabilities, adversary emulation tests for detection gaps. Purple teaming—where red and blue work together—uses ATT&CK as a foundation to validate detection coverage against realistic adversary behaviour.
Hands-On: Bridging the Detection Gap
Mapping pentest findings to ATT&CK TTPs:
- After each penetration test, map every finding to the MITRE ATT&CK framework (https://attack.mitre.org)
- Identify which TTPs were used by the tester and which were not
- Run adversary emulation exercises focusing on TTPs that were not tested
- Use the ATT&CK Navigator to visualise coverage gaps
Building detection rules that catch real adversaries:
Example: Detect unusual PowerShell execution patterns (T1059.001)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104} | Where-Object { $_.Message -match "hidden|bypass|encodedcommand" }
Linux: Detect unusual command history clearing (T1070.003)
ausearch -ts today -m user_override | grep "history -c"
The key insight is that detection coverage must be validated against adversary behaviour, not just pentester behaviour. Organisations should regularly conduct adversary emulation exercises using frameworks like MITRE ATT&CK and CALDERA to test their detection rules against realistic TTPs.
- Aviation Security: The Unseen Grind of Responsible Disclosure
Ken Munro’s talk on aviation cybersecurity drew the crowd in for the scary findings but left them more interested in the disclosure grind with manufacturers, airlines, and regulators. Nobody makes a highlight reel out of that bit, but it is where the real work happens.
The regulatory landscape for aviation cybersecurity is rapidly evolving. In the US, the Cyber AIR Act of 2019 requires covered air carriers and manufacturers to disclose any attempted or successful cyberattack on aircraft systems or ground support systems to the FAA. The Act mandates that all entry points to aircraft electronic systems be equipped with reasonable measures to protect against cyberattacks, including isolation measures to separate critical software systems from non-critical ones. Periodic penetration testing is required.
In Europe, Regulation (EU) 2023/203 requires maintenance organisations to establish and maintain an information security management system. Competent authorities must collect, analyse, and disseminate information related to security incidents and vulnerabilities with potential impact on aviation safety.
Munro’s company, Pen Test Partners, has been conducting independent research into aviation cybersecurity for several years. The challenge is not just finding vulnerabilities—it is navigating the complex disclosure process with manufacturers who may be resistant, airlines who are operationally constrained, and regulators who move slowly.
Hands-On: Aviation System Security Assessment
When assessing aviation systems (in authorised environments only):
- Identify attack surfaces: In-flight entertainment systems, passenger Wi-Fi, satcom, and maintenance ports (the “seat 23A” vector)
- Test for network segmentation: Can you reach avionics systems from passenger-facing networks?
- Assess GPS dependency: GPS is not just a source of position—it is a source of time. Spoofing attacks can disrupt both navigation and timing
- Verify update mechanisms: Are software updates signed and verified?
- Review disclosure procedures: Understand the coordinated disclosure process with manufacturers, airlines, and regulators before testing
The takeaway from Munro’s talk is that responsible disclosure in aviation is a marathon, not a sprint. Findings must be communicated through proper channels, with appropriate timelines for remediation, and often involve multiple stakeholders across jurisdictions.
4. Community and Hardware: The Whose Slide Journey
Danny Akacki closed Stage 1 with the making of the Whose Slide 10-year badge—six months from fumbling a HackerBoxes kit to a real PCB around contestants’ necks at DEF CON. His point was that Google, datasheets, and AI prompts don’t get you there—a community of makers does. This echoes a broader truth in infosec: tools and knowledge are necessary but insufficient. The community—the people who share, mentor, and collaborate—is what transforms raw capability into real outcomes.
Hands-On: Building Your Own Security Hardware
For those inspired to follow Danny’s path:
- Start with a HackerBoxes kit or similar beginner electronics kit
2. Learn KiCad or Eagle for PCB design
3. Understand the ATmega328P or similar microcontroller basics
4. Join maker communities (Hackster.io, Tindie, local hackerspaces)
5. Prototype, fail, iterate—the community will help
What Undercode Say:
- IPv6 is a blue team asset, not a niche concern. Organisations must audit their IPv6 deployments for EUI-64-derived addresses on CPE and endpoints, and enforce privacy extensions across all network segments. The tracking risk is real and operational.
-
The red-blue gap is a detection gap. Penetration tests that don’t emulate real adversary behaviour create false confidence. Adversary emulation using MITRE ATT&CK is essential for validating detection coverage against realistic TTPs.
-
Aviation security is about disclosure, not just discovery. Finding vulnerabilities is only half the battle. Navigating the regulatory and organisational landscape to get them fixed is where the real impact happens.
The conference demonstrated that infosec is not just about technical skills—it is about community, collaboration, and the unglamorous work of making systems truly secure. Vivian’s call to put IPv6 in the blue team toolbox, the red-blue gap conversation, and Munro’s disclosure grind all point to the same conclusion: security is a systems problem, not a checklist problem.
Prediction:
- +1 IPv6 privacy extensions will become mandatory in IoT certification frameworks within 24 months, driven by both regulatory pressure and consumer privacy litigation
-
+1 Adversary emulation platforms (MITRE CALDERA, Atomic Red Team) will become standard components of security programs, moving beyond niche purple team exercises to continuous validation
-
-1 The aviation industry will experience a significant disclosed incident within 18 months that forces accelerated adoption of the Cyber AIR Act’s isolation requirements
-
+1 Community-driven hardware security projects like the Whose Slide badge will proliferate, lowering the barrier to entry for hardware security research and fostering a new generation of embedded security practitioners
-
-1 The gap between pentester behaviour and real adversary behaviour will continue to widen as adversaries adopt AI-assisted evasion techniques faster than detection rules can be updated
▶️ Related Video (80% Match):
https://www.youtube.com/watch?v=3IM7TGeJ6YQ
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/egzkWN73 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
