4 ms·

"While Shodan.io shouldn’t be counted on as a definitive source, our best queries put the number of Windows Server 2019 machines with IPv6 addresses is in the h

"While Shodan.io shouldn’t be counted on as a definitive source, our best queries put the number of Windows Server 2019 machines with IPv6 addresses is in the hundreds, not exceeding approximately 1000. This is likely because most servers are behind firewalls or hosted by Cloud Service Providers (CSPs) and not reachable directly via Shodan scans." High priority issue, but I dont think we will see some massive wave of outages.

blincoln 6y ago
Shodan (or anyone else) can't really get an authoritative count of live IPv6 devices of any kind, because the address space is too big to scan using brute force. They had (have?) a clever semi-workaround for this, by getting themselves into one or more of the public NTP pools, and then port-scanning any IPv6 address that queried their NTP service, but I wouldn't consider that count anything like definitive. Regardless, it's still a huge problem for internal networks.
- lathiat 6y ago
  I read they got kicked off the NTP pool, but it's not the only way to enumerate IPv6 sources. There are many different ways to significantly reduce the search space including looking only at announced prefixes, searching common IPv6 addresses (i.e. the first few, last few, plus common mac address ranges for EUI-64) etc.
  - Pick-A-Hill2019 6y ago
    Correct. Shodan got kicked out for the following "Hi Luca (and everyone), I removed those servers yesterday. Brad had been helping look to see if others were doing something similar. I think the behavior was falling well outside what's reasonably expected from a server operator participating in the pool." https://seclists.org/oss-sec/2016/q1/239 https://seclists.org/oss-sec/2016/q1/239 " Discussed on HN (2015) https://news.ycombinator.com/item?id=10979720 https://news.ycombinator.com/item?id=10979720 https://news.ycombinator.com/item?id=11058531 https://news.ycombinator.com/item?id=11058531 Pretty sucky behaviour from Shodan imo.

blincoln 6y ago

Shodan (or anyone else) can't really get an authoritative count of live IPv6 devices of any kind, because the address space is too big to scan using brute force. They had (have?) a clever semi-workaround for this, by getting themselves into one or more of the public NTP pools, and then port-scanning any IPv6 address that queried their NTP service, but I wouldn't consider that count anything like definitive. Regardless, it's still a huge problem for internal networks.

lathiat 6y ago
I read they got kicked off the NTP pool, but it's not the only way to enumerate IPv6 sources. There are many different ways to significantly reduce the search space including looking only at announced prefixes, searching common IPv6 addresses (i.e. the first few, last few, plus common mac address ranges for EUI-64) etc.
- Pick-A-Hill2019 6y ago
  Correct. Shodan got kicked out for the following "Hi Luca (and everyone), I removed those servers yesterday. Brad had been helping look to see if others were doing something similar. I think the behavior was falling well outside what's reasonably expected from a server operator participating in the pool." https://seclists.org/oss-sec/2016/q1/239 https://seclists.org/oss-sec/2016/q1/239 " Discussed on HN (2015) https://news.ycombinator.com/item?id=10979720 https://news.ycombinator.com/item?id=10979720 https://news.ycombinator.com/item?id=11058531 https://news.ycombinator.com/item?id=11058531 Pretty sucky behaviour from Shodan imo.