5 ms·

IPv6 is already a success in mobile and IoT, and in countries that matter in economical sense. The rest will follow automatically because they have no choice. M

by xvilka 8y ago

IPv6 is already a success in mobile and IoT, and in countries that matter in economical sense. The rest will follow automatically because they have no choice. More worrying issues are BGP and SS7 reliance in global networks, and there are no viable alternatives on the horizon.

pas 8y ago
Could you expand on these problems? Why is SS7 an issue? (Aren't telcos moving to IP based platforms? Device registration on towers can work on whatever protocol the device supports the base station encapsualtes/proxy-es/processes that further, and the telco can use whatever routing it wants internally - eg iBGP. Or even some fancy OpenFlow based control plane.) And of course the issues with BGP seem even more interesting, if you could detail those too ot'd be great.
- xvilka 8y ago
  The SS7 protocol stack is soaked with security problems, but also because it doesn't represent the modern nature of traffic. Of course, telecoms moving to IP cores and such, but SS7 still widely used mostly because of the interoperability and roaming. Positive Security recently made a summary report of the current status of the problem[1]. BGP main problem is the inherent trust to users and servers, thus allowing malicious actors or even some errors to do weird things with network traffic. See this[2] Black Hat talk quickly summarizing them. [1] https://www.ptsecurity.com/ww-en/analytics/ss7-vulnerability-2018/ https://www.ptsecurity.com/ww-en/analytics/ss7-vulnerability... [2] https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-co...
  - pas 8y ago
    Thanks for the reply, links, and details! Regarding BGP, it seems that the basic protocol and implementations are okay. ("No implementation allowed BGP OPENs with the wrong AS or from non-configured peer to reach BGP ESTABLISHED state—as a result, TCP spoofing is required to inject data", and when you can spoof TCP between routers ... it's probably too late anyway. In a peering scenario between ASes people either use a direct cable, a separate VLAN or other direct "transport", in a IXP the IXP operates a big switching fabric and the peers exchange traffic over that, but the BGP sessions use fixed IPs and basically they are fixed to switch ports, and even if currently not every IXP monitors the spoofing/abuse of those, it is easy and they should be doing so. Sure, the reality is always bleaker, but that's security. Maybe next-next-next gen will have crypto built in so far down the stack that without a shared secret no packets will flow. But then humans will just put the PSK on a bright sticker, or will continue to use "chang3me" for decades.) The problems I heard with it is that Tier1 providers just can't really filter the routes they get from downstreams, as they'd have to know which Tier2 handles which prefixes for which clients and so on. Though I'm not convinced they are putting much effort into it, as it's easier to just plug in big Cisco boxes and set up peering with your core and your downstream customers and call it a day. (And setting up is always messy already, so it's sort of understandable that there are no easy and custom solutions for somehow verifying announcements from whatever databases.)
    - IPv4Mall 8y ago
      Even though IPv6 quickly established itself as a robust industry there are countless users who prefer the old IPv4 protocol.Even if we compare IPv6 with IPV4 there are many such positive features which makes people still choose IPv4 Ref: https://ipv4mall.com/blogs/ipv4-vs-ipv6-pros-cons/ https://ipv4mall.com/blogs/ipv4-vs-ipv6-pros-cons/
- KMag 8y ago
  I presume they're referring to the ease of hijacking SS7 where SMS is so widely used for authentication / authorization.
  - pas 8y ago
    Ah, yes, good point. Maybe forcing phones to use 3G/4G/LTE will help a bit, but using SMS and phone number as a second factor is laughable while it's completely at the mercy of a large easily soc.eng.-able company, which very-very much does not care about your SMS-sign-in security. I don't like TOTP apps, but they are significantly better.

by xvilka 8y ago

pas 8y ago

Could you expand on these problems? Why is SS7 an issue? (Aren't telcos moving to IP based platforms? Device registration on towers can work on whatever protocol the device supports the base station encapsualtes/proxy-es/processes that further, and the telco can use whatever routing it wants internally - eg iBGP. Or even some fancy OpenFlow based control plane.) And of course the issues with BGP seem even more interesting, if you could detail those too ot'd be great.

xvilka 8y ago
The SS7 protocol stack is soaked with security problems, but also because it doesn't represent the modern nature of traffic. Of course, telecoms moving to IP cores and such, but SS7 still widely used mostly because of the interoperability and roaming. Positive Security recently made a summary report of the current status of the problem[1]. BGP main problem is the inherent trust to users and servers, thus allowing malicious actors or even some errors to do weird things with network traffic. See this[2] Black Hat talk quickly summarizing them. [1] https://www.ptsecurity.com/ww-en/analytics/ss7-vulnerability-2018/ https://www.ptsecurity.com/ww-en/analytics/ss7-vulnerability... [2] https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-co...
- pas 8y ago
  Thanks for the reply, links, and details! Regarding BGP, it seems that the basic protocol and implementations are okay. ("No implementation allowed BGP OPENs with the wrong AS or from non-configured peer to reach BGP ESTABLISHED state—as a result, TCP spoofing is required to inject data", and when you can spoof TCP between routers ... it's probably too late anyway. In a peering scenario between ASes people either use a direct cable, a separate VLAN or other direct "transport", in a IXP the IXP operates a big switching fabric and the peers exchange traffic over that, but the BGP sessions use fixed IPs and basically they are fixed to switch ports, and even if currently not every IXP monitors the spoofing/abuse of those, it is easy and they should be doing so. Sure, the reality is always bleaker, but that's security. Maybe next-next-next gen will have crypto built in so far down the stack that without a shared secret no packets will flow. But then humans will just put the PSK on a bright sticker, or will continue to use "chang3me" for decades.) The problems I heard with it is that Tier1 providers just can't really filter the routes they get from downstreams, as they'd have to know which Tier2 handles which prefixes for which clients and so on. Though I'm not convinced they are putting much effort into it, as it's easier to just plug in big Cisco boxes and set up peering with your core and your downstream customers and call it a day. (And setting up is always messy already, so it's sort of understandable that there are no easy and custom solutions for somehow verifying announcements from whatever databases.)
  - IPv4Mall 8y ago
    Even though IPv6 quickly established itself as a robust industry there are countless users who prefer the old IPv4 protocol.Even if we compare IPv6 with IPV4 there are many such positive features which makes people still choose IPv4 Ref: https://ipv4mall.com/blogs/ipv4-vs-ipv6-pros-cons/ https://ipv4mall.com/blogs/ipv4-vs-ipv6-pros-cons/
KMag 8y ago
I presume they're referring to the ease of hijacking SS7 where SMS is so widely used for authentication / authorization.
- pas 8y ago
  Ah, yes, good point. Maybe forcing phones to use 3G/4G/LTE will help a bit, but using SMS and phone number as a second factor is laughable while it's completely at the mercy of a large easily soc.eng.-able company, which very-very much does not care about your SMS-sign-in security. I don't like TOTP apps, but they are significantly better.