6 ms·
I wonder who goes around thinking "I'm going to expose an oscilloscope to the WAN!". Something you have to do on purpose, taking lots of extra steps, because of
by veave 3y ago
I wonder who goes around thinking "I'm going to expose an oscilloscope to the WAN!". Something you have to do on purpose, taking lots of extra steps, because of CG-NAT. Kinda asking for it.
- mschuster91 3y agoMany universities give everyone on their network a fully routed IP address, at least this was the case ten-ish years ago for me in Germany. Was ideal if you were developing something and showing it off to someone at the other end of the campus while being on the phone or Teamspeak - just give the other person your IP address and spin up a server at 8080, that's it. Besides, if I were on a red team, I'd enumerate all devices on the LAN as well. Simply to look for all that old cruft someone set up years ago and never updated... that's where you get persistence. No one goes and checks 'scopes, network gear or printers for indicators of compromise in their firmware, because no one thinks of them if the admin isn't looking for outgoing Internet traffic.
- Aurornis 3y ago> Many universities give everyone on their network a fully routed IP address, at least this was the case ten-ish years ago for me in Germany Times have changed a lot in the past decade. No reasonable network admin would be giving public IPs to everything that connects to the network any more. IPv4 addresses are also scarce relative to a decade ago.
- don-code 3y agoSadly, to my current understanding, my alma mater still does this. At the time it was extremely convenient - we had labs full of Solaris and Linux boxes, which could be remotely accessed from home without any issue. And I also seem to remember that basically nothing on IT's part had to be done during the Xbox 360 / Xbox Live craze, unlike my peers at other schools. Even then, though, the downsides of consumer network security (mostly) relying on NAT were obvious. Common ports (80, 25, etc) were blocked inbound; the school's printers basically had to be on their own network, or get spammed all day.
- justsomehnguy 3y ago> No reasonable network admin You are speaking about academia. It's not mutually exclusive, but it's different then out there in the wild.
- natebc 3y agoMost of the staff/admins in the universities that I've worked in have relatively modern sensibilities when it comes to this stuff. However, their constituents, particularly on the academic sides of the house ... less so. I've heard a modest firewall policy argued against on the grounds of Academic Freedom, let alone private IP addresses. It is indeed a different environment.
- bee_rider 3y agoThere are so many devices on a campus network with nebulous ownership set up by clever but still-learning grad students and even undergrads, trying to secure the perimeter seems pointless. Someone internal will find a way to get hacked, or even themselves could be malicious (what are we going to do, background check every student?), so all the nodes on the network need to themselves be secured.
- sva_ 3y agoI can confirm that it is completely normal at German universities as of today. You can setup your own router at home if you so desire
- cyrnel 3y agoRoutable IPs aren't the problem here. In fact under IPv6 you generally would give devices routable IPs. NAT is not a security mechanism. Instead, you should put a default-deny rule on your firewall for all incoming traffic to user devices (which is generally the default setting anyway).
- jerzmacow 3y agoAs of a year ago, the major university I worked at still does this
- SoftTalker 3y agoYeah IPv4 addresses are not scarce at many (some?) big universities
- mr_mitm 3y agoI talked to the security person at a German university a few years ago and suggested that they put some restrictive firewall rules in place to increase security. He agreed with me in principle, but lamented the fact that the grey beards in the university's network administrator team follow a philosophy which says that networks need (or want?) to be free.
- YakBizzarro 3y agoTrust me, it's not the case. I sell electronic instruments for laboratories, and in the large majority of the cases they are simply attacched to the local network. And such network has simply internet access. I once made a blogpost to advise our customers how to create a local instruments network for higher performances and security, but I don't know how much impact it had
- luma 3y agoYou are forgetting that many universities (at least in the US) are sitting on enormous allocations of address space due to being early users of the technology from DARPA. Coupled with "NAT isn't a firewall", assigning actual IPs to your end devices isn't all that silly if you happen to have a few million to spare.
- kjs3 3y agoIPv4 exhaustion isn't nearly the issue for universities that it is elsewhere. Most unis grabbed a large allocation early on, before it was an issue. Many have multiple class B allocations; quite a few have As.
- tetris11 3y agoThis is still the case I think, though admins now restrict the access for sensitive equipment. My work laptop's ethernet has a fully public ip4, for example.
- retrac 3y agoIn the era of IPv6 you can't assume that your device is implicitly firewalled for incoming connections. My smartphone currently has a public IPv6 address from my relative's home wifi network.
- tomrod 3y agoOh I didn't realize that. How can that be identified and locked down?
- thfuran 3y agoIPv6 is intended to always use public addresses. If you have an ipv6 address, it's probably public. But that doesn't necessarily mean there's no firewall.
- mulmen 3y agoYou can go to https://whatismyipaddress.com/ https://whatismyipaddress.com/ and get your public IP then paste it at https://ipspy.net/nmap https://ipspy.net/nmap to port scan yourself.
- codetrotter 3y agoYour link does not report my public IPv6 address. Only my public IPv4 address. Here is a service that will show you both your public IPv4 and your public IPv6 address. https://whatismyipaddress.com/ https://whatismyipaddress.com/
- mulmen 3y agoAh, thanks. I don't have an IPv6 address so I couldn't check. Still, that's the only nmap-in-a-website I'm aware of. There are probably others. Does the nmap scan work on IPv6? That site might actually only be IPv4...
- codetrotter 3y ago
- 1970-01-01 3y agoExactly! I don't see anything on shodan. (I didn't look very hard, however.)
- sho_hn 3y agoProbably quite a few people who want to remote-monitor a test setup? The web interface is one of the selling points.
- dec0dedab0de 3y agoAll the people against NAT/PAT and hyping up v6 as a way to get rid of it.
- NavinF 3y agoThat's unrelated. Any firewall can block incoming connections without the massive performance penalty of NAT
- shrubble 3y agoWhat performance penalty does NAT entail? Even low end home routers have built-in NAT on the chip, no cpu is used for NATting.
- garaetjjte 3y agoVirtually all SOHO routers do routing on CPU.
- nwallin 3y agoIf you're going to do SOHO routing safely/correctly, you'll need to do some sort of connection tracking. You'll need to allow packets on new and existing outbound connections, but only allow incoming packets on existing connections. SOHO routers generally won't support this in hardware, so you have to route on the CPU anyway. NAT on IPv4 vs stateful routing on IPv6 is a wash in terms of performance.
- NavinF 3y ago> low end home routers have built-in NAT on the chip Low end home routers have tiny connection tracking tables and fall back to software routing when that table overflows. IMO if you don't notice the massive drop in performance when this happens, you have very low standards/expectations for internet latency. In had to upgrade to a prosumer router just to get acceptable perf on IPv4
- A1kmm 3y ago