4 ms·

If you want to see something truly scary, from the point of view of an ISP, the number of building management people installing access control system who want a

If you want to see something truly scary, from the point of view of an ISP, the number of building management people installing access control system who want a static public IP for them and intend to plug them directly into the internet without any form of firewall or router in between. Same with camera systems! And keyfob systems! And "smart" management devices of all types. They have no clue whatsoever.

dv_dt 4y ago
Modernity is making entertainment show hacker over watch tropes true. Hero approaches locked door - over comms, net runner : I’ve almost got it hacked - door pops open. It’s so amazing.
- nibbleshifter 4y ago
  Literally this. I've worked on some audits that included pretty featureful BMS, and no joke, some of those systems could have given real "mission impossible" capabilities to an intruder. Disable alarms? Disable cameras? Unlock doors? All possible through a web control panel that looked like it belonged in the early 2000's with hard coded, undocumented accounts.
BlueTemplar 4y ago
Hmm, but this has been the norm for customer IPv6 for years now, and the sky has not fallen yet somehow ? Or is it not so much because IPv6 is inherently more secure, but rather because its support is still pretty bad outside of the main computers ? Or because random house appliances are not a particularly interesting target ?
- selcuka 4y ago
  Well, I agree that NAT is not proper security, but at least it provided a second layer on top of the incompetence of your average IoT developer. The so-called smart devices doesn't follow the standard security protocols anywhere close to computers and mobile devices.
- kalleboo 4y ago
  > but this has been the norm for customer IPv6 for years now Is it? Don't most consumer routers come with a firewall configured to block incoming IPv6 connections?
  - BlueTemplar 4y ago
    Maybe brand new ones do (?), but the ones I've used in the past few years don't seem to (they have no way to configure it). This is in the context that those ISPs are boasting 90%+ IPv6 coverage, which makes up for tens of millions of residential customers !
    - error503 4y ago
      Are you sure? Because these boxes typically don't provide any (good) tools for configuring their IPv4 NATs/firewalls, why would you expect them to provide tools for managing the newfangled IPv6? IPv6 support in a lot of routers is pretty lacklustre, but I've never seen one so incompetent that it doesn't at least block inbound traffic by default.
      - BlueTemplar 4y ago
        Because the ISPs at the same time do provide tools to configure them for IPv4, and they're the ones boasting about connecting « everyone » to IPv6..? Otherwise, this is more hearsay from discussions about this on technical ISP forums, I wanted to look more into this, but I'm waiting until my ISP gives me more than a single /64, and with proper router support (so I can easily do things like host my server separate from my home network).
        error503 4y ago
        > Because the ISPs at the same time do provide tools to configure them for IPv4, and they're the ones boasting about connecting « everyone » to IPv6..? My point was more "The tools they provide for IPv4 are crap, so wouldn't you expect the tools for IPv6 to be crap too?" with a side helping of "Just because they don't show you any (good) UI doesn't mean it doesn't exist". I agree that ISP-provided routers suck for both IPv4 and IPv6 configurability, maybe a bit worse for IPv6, but in my experience I've never seen one that both enables IPv6 by default and allows inbound traffic.
- tssva 4y ago
  The consumer routers I have experience with still apply a stateful firewall to IPv6 traffic.
- nibbleshifter 4y ago
  Host discovery in IPv6 is a harder problem due to the huge address space, whereas with IPv4 I can sweep the entire v4 address space in maybe 30-60 minutes for a port of interest.
  - nannal 4y ago
    Scanning the whole address range is difficult but due to the methods used to generate and acquire ipv6 addresses, there are methods to find assets. https://github.com/lavalamp-/ipv666 https://github.com/lavalamp-/ipv666
deleted 4y ago
[deleted]

dv_dt 4y ago

Modernity is making entertainment show hacker over watch tropes true. Hero approaches locked door - over comms, net runner : I’ve almost got it hacked - door pops open. It’s so amazing.

nibbleshifter 4y ago
Literally this. I've worked on some audits that included pretty featureful BMS, and no joke, some of those systems could have given real "mission impossible" capabilities to an intruder. Disable alarms? Disable cameras? Unlock doors? All possible through a web control panel that looked like it belonged in the early 2000's with hard coded, undocumented accounts.

BlueTemplar 4y ago

Hmm, but this has been the norm for customer IPv6 for years now, and the sky has not fallen yet somehow ? Or is it not so much because IPv6 is inherently more secure, but rather because its support is still pretty bad outside of the main computers ? Or because random house appliances are not a particularly interesting target ?

selcuka 4y ago
Well, I agree that NAT is not proper security, but at least it provided a second layer on top of the incompetence of your average IoT developer. The so-called smart devices doesn't follow the standard security protocols anywhere close to computers and mobile devices.
kalleboo 4y ago
> but this has been the norm for customer IPv6 for years now Is it? Don't most consumer routers come with a firewall configured to block incoming IPv6 connections?
- BlueTemplar 4y ago
  Maybe brand new ones do (?), but the ones I've used in the past few years don't seem to (they have no way to configure it). This is in the context that those ISPs are boasting 90%+ IPv6 coverage, which makes up for tens of millions of residential customers !
  - error503 4y ago
    Are you sure? Because these boxes typically don't provide any (good) tools for configuring their IPv4 NATs/firewalls, why would you expect them to provide tools for managing the newfangled IPv6? IPv6 support in a lot of routers is pretty lacklustre, but I've never seen one so incompetent that it doesn't at least block inbound traffic by default.
    - BlueTemplar 4y ago
      Because the ISPs at the same time do provide tools to configure them for IPv4, and they're the ones boasting about connecting « everyone » to IPv6..? Otherwise, this is more hearsay from discussions about this on technical ISP forums, I wanted to look more into this, but I'm waiting until my ISP gives me more than a single /64, and with proper router support (so I can easily do things like host my server separate from my home network).
      - error503 4y ago
        > Because the ISPs at the same time do provide tools to configure them for IPv4, and they're the ones boasting about connecting « everyone » to IPv6..? My point was more "The tools they provide for IPv4 are crap, so wouldn't you expect the tools for IPv6 to be crap too?" with a side helping of "Just because they don't show you any (good) UI doesn't mean it doesn't exist". I agree that ISP-provided routers suck for both IPv4 and IPv6 configurability, maybe a bit worse for IPv6, but in my experience I've never seen one that both enables IPv6 by default and allows inbound traffic.
tssva 4y ago
The consumer routers I have experience with still apply a stateful firewall to IPv6 traffic.
nibbleshifter 4y ago
Host discovery in IPv6 is a harder problem due to the huge address space, whereas with IPv4 I can sweep the entire v4 address space in maybe 30-60 minutes for a port of interest.
- nannal 4y ago
  Scanning the whole address range is difficult but due to the methods used to generate and acquire ipv6 addresses, there are methods to find assets. https://github.com/lavalamp-/ipv666 https://github.com/lavalamp-/ipv666

deleted 4y ago

[deleted]