13 ms·

People argue against IPv6 because they claim that NAT provides some security, even if its just another layer by obscurity. The argument was already pretty shaky

People argue against IPv6 because they claim that NAT provides some security, even if its just another layer by obscurity. The argument was already pretty shaky, but with attacks like this, it's pretty evident that firewalls provides security, not NAT.

saurik 6y ago
(The competent argument is that NATs provide privacy, not security.)
- etaioinshrdlu 6y ago
  Agreed... I don't know why I get basically attacked online whenever I suggest that IPv4 with NAT offers typical internet users more privacy than IPv6, even with IPv6 privacy addresses.
  - darren_ 6y ago
    Can you explain what privacy you think it offers over IPv6+privacy addresses? As far as I can see it offers that activities behind the NAT get grouped behind one IP to the outside world, and I guess harder host discovery. Is there more?
    - etaioinshrdlu 6y ago
      No, I think that's about it. But that is quite significant. It means that an IPv6 address uniquely identifies one computer (albeit temporarily). An IPv4 with NAT does not identify one user, it might be anywhere from 1 to thousands. A possible solution I'd like to see explored is to have each new web browser tab (and every process on your PC more generally) use a unique, fresh public IPv6 address by default. One would only use a semi-static IP if running some type of server.
      - saurik 6y ago
        As those unique "fresh" addresses would have to come from some shared routable prefix (which is the core problem with the various IPv6 randomized address solutions), that would still provide strictly worse privacy than NAT: if you happened to be one machine before you are now outing to the world the connection correlations between your tabs, and if you were multiple machines before you are now separating the traffic from the multiple users; meanwhile, no one thinks you are a large number of unrelated addresses (as no one is dumb enough to be tricked by your supposedly-separate addresses that all share the same prefix). FWIW, one can totally implement NAT for IPv6, and in fact people have: everyone should always use NAT. NAT is the correct solution to this problem, whether you are mixing your traffic locally on your own network or are shifting your traffic through remote mixers (which is effectively what Orchid--the open source decentralized privacy network I work on, funded by some major VCs--does, though it frankly isn't there yet with "#privacy" despite having launched a long time ago and being usable today; btw: I haven't finished implementing this yet, but "use a separate circuit for each target host", which I think best achieves your dream of an address per tab, is one of the features I have been intending to have in Orchid for forever ;P). (It makes sense for me to attach this to this comment, but I appreciate I am likely preaching the choir with respect to responding to you ;P.) The downsides people like to whine about for NAT involving peer-to-peer connections and hole punching are either misunderstandings (people often like to claim things don't work that do), are caused by shitty NAT implementations (that ignore the RFC recommendations on NAT), or were fixed by PCP/NAT-PMP (which is the technology everyone should be implementing support for in their software stacks, not IPv6). (With respect to the attack in this article, this isn't an attack on NAT per se: it is an attack on these "application level gateways", which I frankly had always assumed were a "crazy" Linux IPMASQ feature, not something people were using in production. I appreciate why people are doing this: no one integrates PCP/NAT-PMP, and there exist older notably unencrypted and thereby already somewhat unfortunate protocols--such as FTP and SIP--that have port allocation assumptions that the router is trying to fix with heuristics. This mechanism doesn't work if the traffic is encrypted anyway--and all of these protocols support encryption as of 15 years ago, and a lot of users actually did switch--so I will claim these features should not be deployed: developers should use PCP/NAT-PMP in their clients or we should potentially integrate it into their operating systems, and not pretend that ALGs are much more than a dangerous MITM attack.)
  - wmf 6y ago
    Plenty of people use bad-faith hair-splitting arguments to rationalize staying on IPv4 forever.
    - arminiusreturns 6y ago
      Plenty of people also ignore the legitimate good-faith concerns brought up by the ip4 clingers also.
- bawolff 6y ago
  Maybe in an office setting, but in a normal home setup, if all it does is make it so you dont know which computer in my apartment is in use, that hardly seems like a privacy win.
  - jeremyjh 6y ago
    Some ISPs are now natting their entire network as well. And then selling real IP addresses to people who need them (like some gamers).
sjwright 6y ago
It’s wrong to say NAT provides no security. NAT does provide some security, it’s just uncertain, unreliable and has no effect on outbound connections.
- kevincox 6y ago
  NAT necessitates a stateful firewall which does provide some security. You can easily have the stateful firewall without the NAT, and on IPv6. That is why this argument is silly.
  - sjwright 6y ago
    That’s exactly right. My only point is to push back on the inference that NAT has absolutely zero impact on security posture. I liken NAT to a Ha-ha wall: it sometimes makes inbound more difficult under certain circumstances. It’s not real security. But it’s also not nothing. https://en.m.wikipedia.org/wiki/Ha-ha https://en.m.wikipedia.org/wiki/Ha-ha
  - Dagger2 6y ago
    It doesn't even give that. Stateful NAT necessitates state tracking but doesn't require a stateful firewall. I've tested it -- NATing the outbound connections from your router has no impact whatsoever on inbound connections (which makes sense, but people have a really hard time wrapping their heads around the idea).
    - sjwright 6y ago
      Regardless of its appropriateness or effectiveness, however weak it may be, in the real world where normal people live, NAT is the first line of defence against inbound attacks for most personal computers and personal devices on the internet. The real criticism is that the presence of NAT has created dangerous complacency among consumers and operating system vendors, relying upon its pseudo-firewall properties for "security" that can be described as barely good enough, arguably not even that.
      - 6y ago
darren_ 6y ago
I'd argue that NAT provides negative security in the long term. Two reasons: 1) This attack is mostly built off the complexity that NAT requires. STUN, TURN, ICE, ALG all exist because of NAT. More complexity == harder to secure. 2) The actual goal of the attack is to allow sending packets to hosts on your network. The only reason this is even considered an attack is because treating NAT as a security layer leads to the neglect of other security aspects. It shouldn't be a problem for your smart doormat to get random packets, but we've been allowing vendors to get away with shipping devices/software that's only safe on a 'local' network for decades. Maybe I'm wildly optimistic but if ipv6 had been the default for years and every random IoT device was expected to be exposed to the public internet by default, maybe we'd actually have something approaching decent host-level firewalling/etc by default too?
- bigiain 6y ago
  > The actual goal of the attack is to allow sending packets to hosts on your network. As I read it, it’s a little narrower than that. This attack allows someone to open up an unexpected port on your NAT gateway back to one specific host - the machine that ran the attack code in its browser. It, on its own, doesn’t get you to all the other hosts like the Smart Doormat or the IoT oven. (Though there’s a reasonable chance this gives the attacker, say, a redis port on your box, which gives them root, which then allows them to attack your doormat from there...)
- theamk 6y ago
  I think you are wildly optimistic. All the services are not magically going to become secure. Even with IPv6, every router will come with stateful firewall by default, set to "deny all incoming". And that makes sense. The security scope of "my home" makes a lot of sense. I want every computer in my house to print on the printer without extra authentication. And the tiny CPU in smart doormat can probably be overwhelmed even by a tiny DOS attack.
  - jeremyjh 6y ago
    People may stop buying routers in an only IPv6 world; you'd just need a switch which are less complicated and cheaper.
p1mrx 6y ago
It's possible that this attack also works over IPv6, if the IPv6 firewall uses a similar ALG to open ports. It might even be easier, because there is no internal IP address to discover.
762236 6y ago
I still want to use NAT with IPv6 so that I can have multiple subnets that I manage without coordinating with my ISP.
- deleted 6y ago
  [deleted]
- quackquackquack 6y ago
  Are there analogies to 10.x.y.z in IPv6? Gosh I wish IPv4 -> IPv6 was just 10.x.x.x -> 10.x.x.x.x.x Instead we went to some hex-colon-double-colon BS. Like instead of "ssh 10.0.0.1" I have to now do "ssh -6 :://::2001:db8:ffff:abcd::34ff:2e6f::49af:fdef::"? Fuck that. The simple fact that I can't memorize IPv6 addresses makes me lazy to use it. Whenever I want to SSH into a machine in 5 seconds flat I just rattle off its IPv4 address and I'm in.
  - jiggawatts 6y ago
    There is a little known protocol invented in 1985 that even had a port number assigned to it by IANA. It's surprisingly well-supported by lots of systems even today! It's called "The Domain Name System". I know it sounds alien and weird, but I assure you that you'll find that it greatly eases the burden of having to memorise network addresses! Maybe your distribution has it included, just download it and give it a go.
  - ComodoHacker 6y ago
    Are you not using hashes anywhere because they are also hard to memorize?
  - redrobein 6y ago
    > Gosh I wish IPv4 -> IPv6 was just 10.x.x.x -> 10.x.x.x.x.x >10.x.x.x.x.x Looks a little short. It's more like... 10.x.x.x.x.x.x.x.x.x.x.x.x.x.x.x
- yardstick 6y ago
  Exactly this! Especially when you have multiple internet feeds into your router, but no assigned IPv6 block. Eg Router has fibre from one carrier, and LTE from another carrier, and you either want to actively use both in a load balancing fashion, or use them in a HA/failover fashion without paying through the teeth to the ISPs for the privilege. Fibre with LTE HA is an extremely common scenario in the physical retail world. And retail is notorious for tight margins. With IPv4 this is dead simple for a router to do using NAT. With IPv6 it’s a nightmare because everyone is against NAT in IPv6. It took ages to get some form of NAT, and it’s poorly supported.
yyyk 6y ago
Firewalls have bugs too. The real problem is bad incentives. For IoT manufacturer a device which fails to work due to blocking is far worse than a security flaw. The first directly leads to chargebacks and bad reputation. The second leads to.. nothing. So long as IPv4 exists, they have to at least use NAT, and their tracking is limited by IP pooling. But when we switch to IPv6 only, there's no good financial reason for devices to even have a 'deny all' stateful firewall. It's more profitable to not bother with a firewall (just blame the client if he doesn't install a firewall to shield the device), than to deal with creating the right exceptions for firewall policy - even a single policy error would have a much stronger financial effect than opening up the device for the entire world.
yardstick 6y ago
Isn’t this argument against ALG not NAT? You could have ALG with IPv6 no NAT involved, with the router enforcing deny all inbound unless ports explicitly opened (such as via this SIP ALG request).

saurik 6y ago

(The competent argument is that NATs provide privacy, not security.)

etaioinshrdlu 6y ago
Agreed... I don't know why I get basically attacked online whenever I suggest that IPv4 with NAT offers typical internet users more privacy than IPv6, even with IPv6 privacy addresses.
- darren_ 6y ago
  Can you explain what privacy you think it offers over IPv6+privacy addresses? As far as I can see it offers that activities behind the NAT get grouped behind one IP to the outside world, and I guess harder host discovery. Is there more?
  - etaioinshrdlu 6y ago
    No, I think that's about it. But that is quite significant. It means that an IPv6 address uniquely identifies one computer (albeit temporarily). An IPv4 with NAT does not identify one user, it might be anywhere from 1 to thousands. A possible solution I'd like to see explored is to have each new web browser tab (and every process on your PC more generally) use a unique, fresh public IPv6 address by default. One would only use a semi-static IP if running some type of server.
    - saurik 6y ago
      As those unique "fresh" addresses would have to come from some shared routable prefix (which is the core problem with the various IPv6 randomized address solutions), that would still provide strictly worse privacy than NAT: if you happened to be one machine before you are now outing to the world the connection correlations between your tabs, and if you were multiple machines before you are now separating the traffic from the multiple users; meanwhile, no one thinks you are a large number of unrelated addresses (as no one is dumb enough to be tricked by your supposedly-separate addresses that all share the same prefix). FWIW, one can totally implement NAT for IPv6, and in fact people have: everyone should always use NAT. NAT is the correct solution to this problem, whether you are mixing your traffic locally on your own network or are shifting your traffic through remote mixers (which is effectively what Orchid--the open source decentralized privacy network I work on, funded by some major VCs--does, though it frankly isn't there yet with "#privacy" despite having launched a long time ago and being usable today; btw: I haven't finished implementing this yet, but "use a separate circuit for each target host", which I think best achieves your dream of an address per tab, is one of the features I have been intending to have in Orchid for forever ;P). (It makes sense for me to attach this to this comment, but I appreciate I am likely preaching the choir with respect to responding to you ;P.) The downsides people like to whine about for NAT involving peer-to-peer connections and hole punching are either misunderstandings (people often like to claim things don't work that do), are caused by shitty NAT implementations (that ignore the RFC recommendations on NAT), or were fixed by PCP/NAT-PMP (which is the technology everyone should be implementing support for in their software stacks, not IPv6). (With respect to the attack in this article, this isn't an attack on NAT per se: it is an attack on these "application level gateways", which I frankly had always assumed were a "crazy" Linux IPMASQ feature, not something people were using in production. I appreciate why people are doing this: no one integrates PCP/NAT-PMP, and there exist older notably unencrypted and thereby already somewhat unfortunate protocols--such as FTP and SIP--that have port allocation assumptions that the router is trying to fix with heuristics. This mechanism doesn't work if the traffic is encrypted anyway--and all of these protocols support encryption as of 15 years ago, and a lot of users actually did switch--so I will claim these features should not be deployed: developers should use PCP/NAT-PMP in their clients or we should potentially integrate it into their operating systems, and not pretend that ALGs are much more than a dangerous MITM attack.)
- wmf 6y ago
  Plenty of people use bad-faith hair-splitting arguments to rationalize staying on IPv4 forever.
  - arminiusreturns 6y ago
    Plenty of people also ignore the legitimate good-faith concerns brought up by the ip4 clingers also.
bawolff 6y ago
Maybe in an office setting, but in a normal home setup, if all it does is make it so you dont know which computer in my apartment is in use, that hardly seems like a privacy win.
- jeremyjh 6y ago
  Some ISPs are now natting their entire network as well. And then selling real IP addresses to people who need them (like some gamers).

sjwright 6y ago

It’s wrong to say NAT provides no security. NAT does provide some security, it’s just uncertain, unreliable and has no effect on outbound connections.

kevincox 6y ago
NAT necessitates a stateful firewall which does provide some security. You can easily have the stateful firewall without the NAT, and on IPv6. That is why this argument is silly.
- sjwright 6y ago
  That’s exactly right. My only point is to push back on the inference that NAT has absolutely zero impact on security posture. I liken NAT to a Ha-ha wall: it sometimes makes inbound more difficult under certain circumstances. It’s not real security. But it’s also not nothing. https://en.m.wikipedia.org/wiki/Ha-ha https://en.m.wikipedia.org/wiki/Ha-ha
- Dagger2 6y ago
  It doesn't even give that. Stateful NAT necessitates state tracking but doesn't require a stateful firewall. I've tested it -- NATing the outbound connections from your router has no impact whatsoever on inbound connections (which makes sense, but people have a really hard time wrapping their heads around the idea).
  - sjwright 6y ago
    Regardless of its appropriateness or effectiveness, however weak it may be, in the real world where normal people live, NAT is the first line of defence against inbound attacks for most personal computers and personal devices on the internet. The real criticism is that the presence of NAT has created dangerous complacency among consumers and operating system vendors, relying upon its pseudo-firewall properties for "security" that can be described as barely good enough, arguably not even that.
    - 6y ago

darren_ 6y ago

I'd argue that NAT provides negative security in the long term. Two reasons: 1) This attack is mostly built off the complexity that NAT requires. STUN, TURN, ICE, ALG all exist because of NAT. More complexity == harder to secure. 2) The actual goal of the attack is to allow sending packets to hosts on your network. The only reason this is even considered an attack is because treating NAT as a security layer leads to the neglect of other security aspects. It shouldn't be a problem for your smart doormat to get random packets, but we've been allowing vendors to get away with shipping devices/software that's only safe on a 'local' network for decades. Maybe I'm wildly optimistic but if ipv6 had been the default for years and every random IoT device was expected to be exposed to the public internet by default, maybe we'd actually have something approaching decent host-level firewalling/etc by default too?

bigiain 6y ago
> The actual goal of the attack is to allow sending packets to hosts on your network. As I read it, it’s a little narrower than that. This attack allows someone to open up an unexpected port on your NAT gateway back to one specific host - the machine that ran the attack code in its browser. It, on its own, doesn’t get you to all the other hosts like the Smart Doormat or the IoT oven. (Though there’s a reasonable chance this gives the attacker, say, a redis port on your box, which gives them root, which then allows them to attack your doormat from there...)
theamk 6y ago
I think you are wildly optimistic. All the services are not magically going to become secure. Even with IPv6, every router will come with stateful firewall by default, set to "deny all incoming". And that makes sense. The security scope of "my home" makes a lot of sense. I want every computer in my house to print on the printer without extra authentication. And the tiny CPU in smart doormat can probably be overwhelmed even by a tiny DOS attack.
- jeremyjh 6y ago
  People may stop buying routers in an only IPv6 world; you'd just need a switch which are less complicated and cheaper.

p1mrx 6y ago

It's possible that this attack also works over IPv6, if the IPv6 firewall uses a similar ALG to open ports. It might even be easier, because there is no internal IP address to discover.

762236 6y ago

I still want to use NAT with IPv6 so that I can have multiple subnets that I manage without coordinating with my ISP.

deleted 6y ago
[deleted]
quackquackquack 6y ago
Are there analogies to 10.x.y.z in IPv6? Gosh I wish IPv4 -> IPv6 was just 10.x.x.x -> 10.x.x.x.x.x Instead we went to some hex-colon-double-colon BS. Like instead of "ssh 10.0.0.1" I have to now do "ssh -6 :://::2001:db8:ffff:abcd::34ff:2e6f::49af:fdef::"? Fuck that. The simple fact that I can't memorize IPv6 addresses makes me lazy to use it. Whenever I want to SSH into a machine in 5 seconds flat I just rattle off its IPv4 address and I'm in.
- jiggawatts 6y ago
  There is a little known protocol invented in 1985 that even had a port number assigned to it by IANA. It's surprisingly well-supported by lots of systems even today! It's called "The Domain Name System". I know it sounds alien and weird, but I assure you that you'll find that it greatly eases the burden of having to memorise network addresses! Maybe your distribution has it included, just download it and give it a go.
- ComodoHacker 6y ago
  Are you not using hashes anywhere because they are also hard to memorize?
- redrobein 6y ago
  > Gosh I wish IPv4 -> IPv6 was just 10.x.x.x -> 10.x.x.x.x.x >10.x.x.x.x.x Looks a little short. It's more like... 10.x.x.x.x.x.x.x.x.x.x.x.x.x.x.x
yardstick 6y ago
Exactly this! Especially when you have multiple internet feeds into your router, but no assigned IPv6 block. Eg Router has fibre from one carrier, and LTE from another carrier, and you either want to actively use both in a load balancing fashion, or use them in a HA/failover fashion without paying through the teeth to the ISPs for the privilege. Fibre with LTE HA is an extremely common scenario in the physical retail world. And retail is notorious for tight margins. With IPv4 this is dead simple for a router to do using NAT. With IPv6 it’s a nightmare because everyone is against NAT in IPv6. It took ages to get some form of NAT, and it’s poorly supported.

yyyk 6y ago

Firewalls have bugs too. The real problem is bad incentives. For IoT manufacturer a device which fails to work due to blocking is far worse than a security flaw. The first directly leads to chargebacks and bad reputation. The second leads to.. nothing. So long as IPv4 exists, they have to at least use NAT, and their tracking is limited by IP pooling. But when we switch to IPv6 only, there's no good financial reason for devices to even have a 'deny all' stateful firewall. It's more profitable to not bother with a firewall (just blame the client if he doesn't install a firewall to shield the device), than to deal with creating the right exceptions for firewall policy - even a single policy error would have a much stronger financial effect than opening up the device for the entire world.

yardstick 6y ago

Isn’t this argument against ALG not NAT? You could have ALG with IPv6 no NAT involved, with the router enforcing deny all inbound unless ports explicitly opened (such as via this SIP ALG request).