4 ms·

I cant imagine how much "fun" its going to be trying to lock down a governments systems when every single device on their network is potentially reachable direc

I cant imagine how much "fun" its going to be trying to lock down a governments systems when every single device on their network is potentially reachable directly from China...

MOARDONGZPLZ 3y ago
This feels like FUD. You can still assign a block of ipv6 as internal to your network and put it behind a bastion. Forcing ipv6 isn’t the same as going zero trust or something where now everything is publicly routable.
- DarkmSparks 3y ago
  and whats stopping an intruder reassigning that block to something that can be publically accessed and how will that be monitored?
  - cyberax 3y ago
    Uhhh... Whut? You obviously need to use a ULA prefix, they are not routed (just like RFC1918 space in IPv4). Or you can just use your allocated IPv6 space, and firewall at the border. And you hopefully have BGP hijack monitoring set up anyway.
    - DarkmSparks 3y ago
      you do know single network devices can have more than one ip address? afaics, the biggest issue with ipv6 is if its active all devices on a network can easily be coaxed to never route traffic anywhere near the router/firewall the network admistrator intended, simply by handing out extra routing info for alternate networks.
      - greyface- 3y ago
        > afaics, the biggest issue with ipv6 is if its active all devices on a network can easily be coaxed to never route traffic anywhere near the router/firewall the network admistrator intended, simply by handing out extra routing info for alternate networks. This is not unique to IPv6. ARP spoofing is the v4 version of this attack. RA spoofing is the v6 version of the attack. In both cases, the solution is the same: lock down your L2 by enabling MAC / ARP / RA filtering on your switch.
        DarkmSparks 3y ago
        true, but getting even a single public ipv4 address is hard. anyone and everyone handing out public ipv6 addresses is by design.
        cyberax 3y ago
        I have 32 IPv4 addresses, how do I utilize them to hack Amazon? It doesn't matter that you can get IPv6 addresses, you still need to be able to get onto the L2 network of your victim company to be able to mount RA attacks. You also will somehow need to force them to announce your IPv6 space to their peers.
        DarkmSparks 3y ago
        with IPv4 you cant really, because getting traffic routed to those ips is a major undertaking. with IPv6, every IPv6 capable device is potentially capable of handing out something like the entire IPv4 space of public ip addresses regardless of how a single firewall or router is configured. "trying to configure connectivity and access resources using only IPv6 addresses is borderline insane"
        cyberax 3y ago
        You clearly don't understand how routing (and the Internet) works. My IPs are useless because I can't force the victim to route to them. I similarly won't be able to force the victim to route their traffic to IPv6 addresses that I control.
  - Dylan16807 3y ago
    Reassigning a block sounds a lot harder than the IPv4 version of making something accessible, sending out a single packet to hole punch the NAT.
ehPReth 3y ago
Having a public IP != publicly reachable. IOW, have the router block incoming connections just like the goreish nature of "NAT" did for you.
- DarkmSparks 3y ago
  having a private ip = definately not publicly reachable. having a public ip = possibly reachable, depending on what other devices can be compromised on the network. given the number of government machines already that participate in the various ddns botnets moving to that second one is going to be a lot of fun at the very least all the cnc servers can move local.
  - eurleif 3y ago
    If a device on the network is compromised, how is a private IP going to save you? Private IPs can be reached from within the network.
    - DarkmSparks 3y ago
      it doesnt "save you". but on a private network a compromised device can only make outgoing connections. public facing devices can be administered by incoming connections, thats a whole other level of complexity, potentially for every device.
      - ehPReth 3y ago
        set router to an allowlist configuration... and you're done. it's your "NAT" security but without terribleness. some (consumer/smb) routers even come this way out of the box to prevent exactly what you mention
        DarkmSparks 3y ago
        add a software router to the network that hands out public ips to all the devices on the network. or better, just accidentally switch a cable over from the router to the routers switch, see if anyone notices their private ips all became public ones.
deadbunny 3y ago
Firewalls exist.
- DarkmSparks 3y ago
  Better call up cloudflare and tell them no one wants their business now all the network engineers are as competent and equipped to deal with threats as they are.
  - deadbunny 3y ago
    Cloudflare's main business is being a CDN that can soak hundreds of gbps in bandwidth of DDoS traffic. Nothing to do with competence, though in your other comments you suggested that plugging things into different switch ports would give them new IPs and make things publicly routable so perhaps you're right to keep using Cloudflare.
    - DarkmSparks 3y ago
      Cloudflares main day job is blocking malicious incoming packets used for RCE exploits on unpatched servers.
      - deadbunny 3y ago
        None of which get through a firewall with a `deny` rule.
        DarkmSparks 3y ago
        and how do you enforce using that firewall rule on tens of thousands of devices, each now with several public and private ips and several thousand routes in and out of the network?
        devman0 3y ago
        A stateful firewall is prerequisite for NAT implementations commonly deployed in most office and consumer settings due to the session tracking requirement. So you just stop doing the NAT part and the firewall continues to deny untracked ingress connections just like it did when NAT was running.
porbelm 3y ago
My very publically available home server (static IPv6 address, AAAA record) is behind two firewalls. The first is the ISP-supplied router. That handles any attempted connection to any address on its /64 subnet. The second is UFW on the server itself + fail2ban. The open ports are 22 and 443. It's basically as secure as it gets apart from not having it public at all. Public IP != open for all connections on all ports...

I cant imagine how much "fun" its going to be trying to lock down a governments systems when every single device on their network is potentially reachable directly from China...

MOARDONGZPLZ 3y ago

This feels like FUD. You can still assign a block of ipv6 as internal to your network and put it behind a bastion. Forcing ipv6 isn’t the same as going zero trust or something where now everything is publicly routable.

DarkmSparks 3y ago
and whats stopping an intruder reassigning that block to something that can be publically accessed and how will that be monitored?
- cyberax 3y ago
  Uhhh... Whut? You obviously need to use a ULA prefix, they are not routed (just like RFC1918 space in IPv4). Or you can just use your allocated IPv6 space, and firewall at the border. And you hopefully have BGP hijack monitoring set up anyway.
  - DarkmSparks 3y ago
    you do know single network devices can have more than one ip address? afaics, the biggest issue with ipv6 is if its active all devices on a network can easily be coaxed to never route traffic anywhere near the router/firewall the network admistrator intended, simply by handing out extra routing info for alternate networks.
    - greyface- 3y ago
      > afaics, the biggest issue with ipv6 is if its active all devices on a network can easily be coaxed to never route traffic anywhere near the router/firewall the network admistrator intended, simply by handing out extra routing info for alternate networks. This is not unique to IPv6. ARP spoofing is the v4 version of this attack. RA spoofing is the v6 version of the attack. In both cases, the solution is the same: lock down your L2 by enabling MAC / ARP / RA filtering on your switch.
      - DarkmSparks 3y ago
        true, but getting even a single public ipv4 address is hard. anyone and everyone handing out public ipv6 addresses is by design.
        cyberax 3y ago
        I have 32 IPv4 addresses, how do I utilize them to hack Amazon? It doesn't matter that you can get IPv6 addresses, you still need to be able to get onto the L2 network of your victim company to be able to mount RA attacks. You also will somehow need to force them to announce your IPv6 space to their peers.
        DarkmSparks 3y ago
        with IPv4 you cant really, because getting traffic routed to those ips is a major undertaking. with IPv6, every IPv6 capable device is potentially capable of handing out something like the entire IPv4 space of public ip addresses regardless of how a single firewall or router is configured. "trying to configure connectivity and access resources using only IPv6 addresses is borderline insane"
        cyberax 3y ago
        You clearly don't understand how routing (and the Internet) works. My IPs are useless because I can't force the victim to route to them. I similarly won't be able to force the victim to route their traffic to IPv6 addresses that I control.
- Dylan16807 3y ago
  Reassigning a block sounds a lot harder than the IPv4 version of making something accessible, sending out a single packet to hole punch the NAT.

ehPReth 3y ago

Having a public IP != publicly reachable. IOW, have the router block incoming connections just like the goreish nature of "NAT" did for you.

DarkmSparks 3y ago
having a private ip = definately not publicly reachable. having a public ip = possibly reachable, depending on what other devices can be compromised on the network. given the number of government machines already that participate in the various ddns botnets moving to that second one is going to be a lot of fun at the very least all the cnc servers can move local.
- eurleif 3y ago
  If a device on the network is compromised, how is a private IP going to save you? Private IPs can be reached from within the network.
  - DarkmSparks 3y ago
    it doesnt "save you". but on a private network a compromised device can only make outgoing connections. public facing devices can be administered by incoming connections, thats a whole other level of complexity, potentially for every device.
    - ehPReth 3y ago
      set router to an allowlist configuration... and you're done. it's your "NAT" security but without terribleness. some (consumer/smb) routers even come this way out of the box to prevent exactly what you mention
      - DarkmSparks 3y ago
        add a software router to the network that hands out public ips to all the devices on the network. or better, just accidentally switch a cable over from the router to the routers switch, see if anyone notices their private ips all became public ones.

deadbunny 3y ago

Firewalls exist.

DarkmSparks 3y ago
Better call up cloudflare and tell them no one wants their business now all the network engineers are as competent and equipped to deal with threats as they are.
- deadbunny 3y ago
  Cloudflare's main business is being a CDN that can soak hundreds of gbps in bandwidth of DDoS traffic. Nothing to do with competence, though in your other comments you suggested that plugging things into different switch ports would give them new IPs and make things publicly routable so perhaps you're right to keep using Cloudflare.
  - DarkmSparks 3y ago
    Cloudflares main day job is blocking malicious incoming packets used for RCE exploits on unpatched servers.
    - deadbunny 3y ago
      None of which get through a firewall with a `deny` rule.
      - DarkmSparks 3y ago
        and how do you enforce using that firewall rule on tens of thousands of devices, each now with several public and private ips and several thousand routes in and out of the network?
        devman0 3y ago
        A stateful firewall is prerequisite for NAT implementations commonly deployed in most office and consumer settings due to the session tracking requirement. So you just stop doing the NAT part and the firewall continues to deny untracked ingress connections just like it did when NAT was running.

porbelm 3y ago

My very publically available home server (static IPv6 address, AAAA record) is behind two firewalls. The first is the ISP-supplied router. That handles any attempted connection to any address on its /64 subnet. The second is UFW on the server itself + fail2ban. The open ports are 22 and 443. It's basically as secure as it gets apart from not having it public at all. Public IP != open for all connections on all ports...