3 ms·

It seems like another mitigation missing from their list is "modify your DHCP client to reject over-broad subnet masks" where the cutoff is probably something l

by caf 10y ago

It seems like another mitigation missing from their list is "modify your DHCP client to reject over-broad subnet masks" where the cutoff is probably something like /20. Additionally you could reject any DHCP lease for a subnet that purports to overlap with the address range of any other directly connected network.

ams6110 10y ago
Or, don't automatically issue dhcp requests until the interface is explicitly configured to do so.
jtokoph 10y ago
Couldn't the USB device identify itself as multiple devices over the same port? Similar to a hub. It could then give a /20 to each device.
- caf 10y ago
  It could, there's a limit of 127 USB devices though so it couldn't cover a large percentage of the address space that way. It might be enough to still cover some major sites of interest.
rasz_pl 10y ago
I almost immunized my Win10 _by accident_ thanks to paranoia about blocking W10 spying. >netsh advfirewall firewall show rule name=all … Rule Name: Core Networking – Dynamic Host Configuration Protocol (DHCP-In) ———————————————————————- Enabled: Yes Direction: In Profiles: Domain,Private,Public Grouping: Core Networking LocalIP: Any RemoteIP: LocalSubnet Protocol: UDP LocalPort: 68 RemotePort: 67 Edge traversal: No Action: Allow Rule Name: Core Networking – Dynamic Host Configuration Protocol (DHCP-Out) ———————————————————————- Enabled: Yes Direction: Out Profiles: Domain,Private,Public Grouping: Core Networking LocalIP: Any RemoteIP: LocalSubnet Protocol: UDP LocalPort: 68 RemotePort: 67 Edge traversal: No Action: Allow Basically I only allow DHCP from LocalSubnet. Of course according to Microsoft LocalSubnet : “The keyword localsubnet, which includes all addresses that are on the local computer’s current subnet.” but how the hell does your computer know “local computer’s current subnet” BEFORE it receives its IP from DHCP server??? Hmm, I think Ill just hardcode this to private subnet (192.168.0.0/16).

by caf 10y ago

ams6110 10y ago

Or, don't automatically issue dhcp requests until the interface is explicitly configured to do so.

jtokoph 10y ago

Couldn't the USB device identify itself as multiple devices over the same port? Similar to a hub. It could then give a /20 to each device.

caf 10y ago
It could, there's a limit of 127 USB devices though so it couldn't cover a large percentage of the address space that way. It might be enough to still cover some major sites of interest.

rasz_pl 10y ago

I almost immunized my Win10 _by accident_ thanks to paranoia about blocking W10 spying. >netsh advfirewall firewall show rule name=all … Rule Name: Core Networking – Dynamic Host Configuration Protocol (DHCP-In) ———————————————————————- Enabled: Yes Direction: In Profiles: Domain,Private,Public Grouping: Core Networking LocalIP: Any RemoteIP: LocalSubnet Protocol: UDP LocalPort: 68 RemotePort: 67 Edge traversal: No Action: Allow Rule Name: Core Networking – Dynamic Host Configuration Protocol (DHCP-Out) ———————————————————————- Enabled: Yes Direction: Out Profiles: Domain,Private,Public Grouping: Core Networking LocalIP: Any RemoteIP: LocalSubnet Protocol: UDP LocalPort: 68 RemotePort: 67 Edge traversal: No Action: Allow Basically I only allow DHCP from LocalSubnet. Of course according to Microsoft LocalSubnet : “The keyword localsubnet, which includes all addresses that are on the local computer’s current subnet.” but how the hell does your computer know “local computer’s current subnet” BEFORE it receives its IP from DHCP server??? Hmm, I think Ill just hardcode this to private subnet (192.168.0.0/16).