5 ms·

One bad apple can spoil your IPv6 privacy (2022)

78 points by whereistimbo 2y ago

betaby 2y ago
"Our results show that IoT devices contribute the most to this privacy leakage"
- ooterness 2y ago
  It's like they say: the "S" in IoT stands for security.
  - crest 2y ago
    Good old Internet of Things that shouldn't be on the Internet.
- kstrauser 2y ago
  I didn't read the paper. For anyone who did: How would that work exactly? It looks like the general problem is that an IoT device can use SLAAC and its MAC to generate an address like `prefix1::87:65:43:21`. Then the household's prefix can change and the IoT device can create a new address with the same local portion, like `prefix2::87:65:43:21`. Then an attacker could see that `prefix1` and `prefix2` are very likely to have been used by the same person. How would an attacker get that information? If the IoT device is janky and malicious it could ping a bunch of malicious websites and wait for me to access them, I suppose. What would that give an attacker? It's not clear to me how that'd be worse than, say, the current IPv4 situation. And if the device is compromised and no firewall is blocking its outbound Internet access, there are other things I'd be more worried about. If Amazon or Google make the device, then it could just report that back directly to them whenever its Alexa or Google Home bridge reports back. Their logs would show that "bridge 0x1234 connected from `prefix1::` yesterday, and `prefix2::` today, and it's owned by user kstrauser". I don't think anything in this paper could make it less private than that, surely?
adriancr 2y ago
What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)
- szszrk 2y ago
  I'm wondering what are you referring to when you mention NAT in the context of IPv6. I thought there is no widely adopted implementation.
  - adriancr 2y ago
    You can easily enable IPv6 masquerading on openwrt and linux in general: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 This has been available for a long time. You can also do static NAT and anything that you were used to on IPv4.
  - craftkiller 2y ago
    Nothing is preventing you from doing NAT in IPv6. There is the Unique Local Address[0] range which is analogous to the RFC-1918 addresses from IPv4. That being said, there are very few reasons to do this in IPv6 (the only that comes to my mind is running virtual machines on a laptop connected via wifi). [0] https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address
- kstrauser 2y ago
  Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.
paul_funyun 2y ago
Ipv6 is a lot like a bios update - best avoided unless absolutely necessary. Potential mess with no upsides for end users.
- kstrauser 2y ago
  And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM. IPv4 is a brilliant protocol for having been published 43 years ago. There aren't a whole lot of technologies that old still widely used. I mean, I'm glad my NVMe drive doesn't have to shove bits through an ST412 interface.
  - ibcj 2y ago
    While I had an "ST412 reference" on my bingo card yesterday morning, sadly I do not have it today. Opportunity lost.
  - yjftsjthsd-h 2y ago
    > And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM. I'm not sure if it makes the analogy better or worse, but this is what happened; BIOS was born in ~1981 (I think), had severe shortcomings that were partially mitigated over time but you can only mitigate so much, UEFI is a better replacement, BIOS->UEFI was a somewhat rocky migration, that migration was made worse by extra stuff getting bundled in (secure boot), and this led to a significant chunk of the population deliberately avoiding it at least for a while. The only real difference is that UEFI has long since become standard, while IPv6 is still fighting for adoption.
    - immibis 2y ago
      Fighting for adoption? The majority of Internet traffic is now IPv6 and we're almost starting to see eyeball networks without any IPv4 at all, so I hope your boss is aware you're blocking potential customers from visiting your website.
phh 2y ago
So uh, this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? I don't think I've ever seen this implemented willingly (many have dynamic allocation, but it's changing so slowly that it looks more like a bug than a feature). Does some people have other experience? I was wondering what kind of IoT could be widespread enough to pose a significant problem or if it was rather statistical, but they mention TVs. And uh yeah, TVs during their lifetime discuss with a huge range of providers, so this indeed broadcasts to The privacy handling of the article writing isn't great imo. Only an ISP should have access to those data, not external researchers. I even fail to see how it can be GPDR compliant. That being said, operators won't spontaneously write those articles, so well, this one is usefl. Overall this is an interesting article. I think ISPs doing prefix rotations can easily detect devices and warn the user and/or isolate the bad device (through symmetric NAT for instance -- I think this is an okay compromise, it's not a horrible hack), which this article shines light on. Cool.
- cassianoleal 2y ago
  > this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? Please no. That would mean constantly having to check PD and updating DNS, wireguard endpoints, etc. accordingly.
- rescbr 2y ago
  My ISP assign changes the IPv4 /32 and IPv6 prefix every PPPoE authentication. This is so annoying and breaks routing every couple days or so that I ended up running NPT (NAT for IPv6) and using a ULA block for my LAN. I've seen reports saying you can request a specific prefix as hints to Prefix Delegation and it keeps it mostly static but it is not guaranteed.
  - yesco 2y ago
    I'm a little confused why you would need NPT to resolve this? Why not just create a separate local prefix for your local networking needs? Unless you mean something else by "breaks routing"?
    - 2y ago
winstonprivacy 2y ago
This is the main reason we did not support IPv6 at Winston.
- jeroenhd 2y ago
  You went with IPv4-only because users with IoT devices could reduce IPv6 privacy back to the trackability of IPv4? That seems rather counter productive to me.
snihalani 2y ago
[flagged]
_carbyau_ 2y ago
Everytime IPv6 comes up there's back and forth on NAT vs firewall etc etc. That's easy. IPv6 has more flexibility. You do what you want and leave everyone else to do what they want. Networking stuff will break sure, but hasn't it always... I haven't gone to IPv6 at home because working with an IPv6 string is so much harder. I can't always copy'n'paste addresses. I often shout/phone an address to someone else to type in. And talking to 3rd parties (ISP , anyone controlling outside WAN) etc IPv4 is a known quantity. It's that chicken vs egg problem. I don't want to touch IPv6 at home until other admins have figured out how to make this easy.
- tenebrisalietum 2y ago
  > I haven't gone to IPv6 at home because working with an IPv6 string is so much harder. Setup DNS, configure something mdns based like Avahi, or use the hosts file. > I can't always copy'n'paste addresses. I often shout/phone an address to someone else to type in. This is weird and not a normal need on a well-run network, or if you have the above working.

78 points by whereistimbo 2y ago

betaby 2y ago

"Our results show that IoT devices contribute the most to this privacy leakage"

ooterness 2y ago
It's like they say: the "S" in IoT stands for security.
- crest 2y ago
  Good old Internet of Things that shouldn't be on the Internet.
kstrauser 2y ago
I didn't read the paper. For anyone who did: How would that work exactly? It looks like the general problem is that an IoT device can use SLAAC and its MAC to generate an address like `prefix1::87:65:43:21`. Then the household's prefix can change and the IoT device can create a new address with the same local portion, like `prefix2::87:65:43:21`. Then an attacker could see that `prefix1` and `prefix2` are very likely to have been used by the same person. How would an attacker get that information? If the IoT device is janky and malicious it could ping a bunch of malicious websites and wait for me to access them, I suppose. What would that give an attacker? It's not clear to me how that'd be worse than, say, the current IPv4 situation. And if the device is compromised and no firewall is blocking its outbound Internet access, there are other things I'd be more worried about. If Amazon or Google make the device, then it could just report that back directly to them whenever its Alexa or Google Home bridge reports back. Their logs would show that "bridge 0x1234 connected from `prefix1::` yesterday, and `prefix2::` today, and it's owned by user kstrauser". I don't think anything in this paper could make it less private than that, surely?

adriancr 2y ago

What this says is IOT devices leak their MAC within their IPv6 address. Quick solution would be DHCPv6 so they don't have a choice in what address they use. Going further, NAT and hide all these devices behind a single external IP. Going even further, NAT the whole network by default and only give global addresses to endpoints that need it (local servers and such)

szszrk 2y ago
I'm wondering what are you referring to when you mention NAT in the context of IPv6. I thought there is no widely adopted implementation.
- adriancr 2y ago
  You can easily enable IPv6 masquerading on openwrt and linux in general: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6 This has been available for a long time. You can also do static NAT and anything that you were used to on IPv4.
- craftkiller 2y ago
  Nothing is preventing you from doing NAT in IPv6. There is the Unique Local Address[0] range which is analogous to the RFC-1918 addresses from IPv4. That being said, there are very few reasons to do this in IPv6 (the only that comes to my mind is running virtual machines on a laptop connected via wifi). [0] https://en.wikipedia.org/wiki/Unique_local_address https://en.wikipedia.org/wiki/Unique_local_address
kstrauser 2y ago
Going further still, forget all the NAT breakage and require all devices to actually use the privacy extensions described in RFC 4941 17 years ago. A router could auto-block an IPv6 address that's been in use too long, with a whitelist for servers. There are reasons you might want your desktop to have the same address for a long time. I can't think of any reason why I'd want that for a light bulb.

paul_funyun 2y ago

Ipv6 is a lot like a bios update - best avoided unless absolutely necessary. Potential mess with no upsides for end users.

kstrauser 2y ago
And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM. IPv4 is a brilliant protocol for having been published 43 years ago. There aren't a whole lot of technologies that old still widely used. I mean, I'm glad my NVMe drive doesn't have to shove bits through an ST412 interface.
- ibcj 2y ago
  While I had an "ST412 reference" on my bingo card yesterday morning, sadly I do not have it today. Opportunity lost.
- yjftsjthsd-h 2y ago
  > And by that analogy, the previous BIOS version was released in 1981, and modern networking is hamstrung by its design which assumed "4 billion addresses ought to be enough for anybody" and that it needed to be manageable by an 8-bit OS with 64KB of RAM. I'm not sure if it makes the analogy better or worse, but this is what happened; BIOS was born in ~1981 (I think), had severe shortcomings that were partially mitigated over time but you can only mitigate so much, UEFI is a better replacement, BIOS->UEFI was a somewhat rocky migration, that migration was made worse by extra stuff getting bundled in (secure boot), and this led to a significant chunk of the population deliberately avoiding it at least for a while. The only real difference is that UEFI has long since become standard, while IPv6 is still fighting for adoption.
  - immibis 2y ago
    Fighting for adoption? The majority of Internet traffic is now IPv6 and we're almost starting to see eyeball networks without any IPv4 at all, so I hope your boss is aware you're blocking potential customers from visiting your website.

phh 2y ago

So uh, this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? I don't think I've ever seen this implemented willingly (many have dynamic allocation, but it's changing so slowly that it looks more like a bug than a feature). Does some people have other experience? I was wondering what kind of IoT could be widespread enough to pose a significant problem or if it was rather statistical, but they mention TVs. And uh yeah, TVs during their lifetime discuss with a huge range of providers, so this indeed broadcasts to The privacy handling of the article writing isn't great imo. Only an ISP should have access to those data, not external researchers. I even fail to see how it can be GPDR compliant. That being said, operators won't spontaneously write those articles, so well, this one is usefl. Overall this is an interesting article. I think ISPs doing prefix rotations can easily detect devices and warn the user and/or isolate the bad device (through symmetric NAT for instance -- I think this is an okay compromise, it's not a horrible hack), which this article shines light on. Cool.

cassianoleal 2y ago
> this seems to imply that ISP rotating ipv6 prefix is "obvious", but uh. Really? Please no. That would mean constantly having to check PD and updating DNS, wireguard endpoints, etc. accordingly.
rescbr 2y ago
My ISP assign changes the IPv4 /32 and IPv6 prefix every PPPoE authentication. This is so annoying and breaks routing every couple days or so that I ended up running NPT (NAT for IPv6) and using a ULA block for my LAN. I've seen reports saying you can request a specific prefix as hints to Prefix Delegation and it keeps it mostly static but it is not guaranteed.
- yesco 2y ago
  I'm a little confused why you would need NPT to resolve this? Why not just create a separate local prefix for your local networking needs? Unless you mean something else by "breaks routing"?
  - 2y ago

winstonprivacy 2y ago

This is the main reason we did not support IPv6 at Winston.

jeroenhd 2y ago
You went with IPv4-only because users with IoT devices could reduce IPv6 privacy back to the trackability of IPv4? That seems rather counter productive to me.

snihalani 2y ago

[flagged]

_carbyau_ 2y ago

Everytime IPv6 comes up there's back and forth on NAT vs firewall etc etc. That's easy. IPv6 has more flexibility. You do what you want and leave everyone else to do what they want. Networking stuff will break sure, but hasn't it always... I haven't gone to IPv6 at home because working with an IPv6 string is so much harder. I can't always copy'n'paste addresses. I often shout/phone an address to someone else to type in. And talking to 3rd parties (ISP , anyone controlling outside WAN) etc IPv4 is a known quantity. It's that chicken vs egg problem. I don't want to touch IPv6 at home until other admins have figured out how to make this easy.

tenebrisalietum 2y ago
> I haven't gone to IPv6 at home because working with an IPv6 string is so much harder. Setup DNS, configure something mdns based like Avahi, or use the hosts file. > I can't always copy'n'paste addresses. I often shout/phone an address to someone else to type in. This is weird and not a normal need on a well-run network, or if you have the above working.