2 ms·
The lesson here, I think, is that security intuitions developed in an IPv4 world with NAT everywhere may need re-examining in an IPv6 world. If your device has
by Lazare 11y ago
The lesson here, I think, is that security intuitions developed in an IPv4 world with NAT everywhere may need re-examining in an IPv6 world.
If your device has a publicly routable IP address, it should probably be behind a firewall. If it's not behind a firewall, it's going to get scanned. Relying on security through address space size is stupid.
> What was most puzzling was the fact that the devices that were targeted had randomized IPv6 addresses and were not published in DNS or any public record. For all intents and purposes they were hidden safely within my lab network.
That is just wrong, and it's wrong in a very glaring, obvious way: The devices were not "hidden safely within [his] lab network", because he was not using NAT. They were connected to the internet with publicly routable IP addresses, which they were using to communicate with other hosts on the internet.
Edit: That being said, it's a great writeup, and some good technical work was done to figure out what was going on, and I enjoyed reading it. But the starting premise seemed to be "how could this be happening, my devices are hidden!" and I feel like it should have been "oh, it makes sense that someone would do this since my devices are no longer hidden".
- mentat 11y agoEven if they were NATed I'd assert they weren't safely hidden but that's a more obscure discussion.
- Lazare 11y agoYou're quite right; people significantly overestimate the safety of NAT in my experience. But what I was getting at is that however illusory the safety of NAT is, the author seemed to be instinctively assuming that his IPv6 devices had it, because we've spent 20 years training ourselves to assume that everything is behind NAT. It's a new world.
- ams6110 11y agoMore like an unlisted phone number. The addresses weren't published in any deliberate way, but they were still visible on the "caller ID" when they connected to another system.