6 ms·

This should be interesting to watch unfold.

mylastattempt 2y ago
The CVE has been discovered by a security researcher/firm, rather than being found in the wild. Without technical details or a PoC being publiclya available, I doubt this will amount to more than just another starting point for someone to developer a new exploit. In a year or so it might show up in your Metasploit bundle.
- jakeogh 2y ago
  Its a odd to take any assertion that "it wasn't seen in the wild" as if in the opposing frame(s) it wasn't "our best technique for over a decade". Like any valuable secret, the incentives are in the other direction on both sides.
- sidewndr46 2y ago
  I don't think that is a realistic conclusion. If one group found it, we can assume that there exists at least one other group that is capable of finding. It therefore is not unrealistic to believe this has seen limited exploitation by sufficiently motivated actors.
- zer0c00ler 2y ago
  [dead]
- acidictadpole 2y ago
  > The CVE has been discovered by a security researcher/firm, rather than being found in the wild. The researcher/firm was the one that disclosed it, but I don't feel like you could conclusively say that the exploit isn't in the wild.
  - deleted 2y ago
    [deleted]
  - fulafel 2y ago
    Yes, it's sometimes hard to keep in mind that vulnerabilities don't just materialze into existence when they're first publicized. It's a differnt picture, everyone is vulnerable all the time.
yyyk 2y ago
Every Windows-based business LAN or industrial machine I know still has IPv6 disabled. Most other targets are too low value for people to bother.
- toast0 2y ago
  IPv6 actually disabled or meerly inactive because there's no router advertisements on the LAN? I suspect more of the second than the first. If it's just inactive, a compromised host can often broadcast a router advertisement or perhaps use local net addresses to compromise other hosts. A well prepared network would block ipv6 traffic on their switches, it they don't want it, but that's a big investment in capable switches.
  - GoblinSlayer 2y ago
    It's a registry setting. https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows https://learn.microsoft.com/en-us/troubleshoot/windows-serve...
    - dogsledsleddog 2y ago
      Which says: > You cannot completely disable IPv6 as IPv6 is used internally on the system for many TCPIP tasks. For example, you will still be able to run ping ::1 after configuring this setting. I'd be concerned their workaround is just limiting it into a local vulnerability that spyware, etc will abuse on all the systems that end up not patched because they used the workaround..
      - GoblinSlayer 2y ago
        When spyware holds your ass, it already has everything on you and doesn't need any vulnerability.
        IcePic 2y ago
        > When spyware holds your ass, it already has everything on you and doesn't need any vulnerability. ..because it uses one of the available local escalation tricks, where sending RA to ::1 could be one of those if that is a thing.

The CVE has been discovered by a security researcher/firm, rather than being found in the wild. Without technical details or a PoC being publiclya available, I doubt this will amount to more than just another starting point for someone to developer a new exploit. In a year or so it might show up in your Metasploit bundle.

jakeogh 2y ago
Its a odd to take any assertion that "it wasn't seen in the wild" as if in the opposing frame(s) it wasn't "our best technique for over a decade". Like any valuable secret, the incentives are in the other direction on both sides.
sidewndr46 2y ago
I don't think that is a realistic conclusion. If one group found it, we can assume that there exists at least one other group that is capable of finding. It therefore is not unrealistic to believe this has seen limited exploitation by sufficiently motivated actors.
zer0c00ler 2y ago
[dead]
acidictadpole 2y ago
> The CVE has been discovered by a security researcher/firm, rather than being found in the wild. The researcher/firm was the one that disclosed it, but I don't feel like you could conclusively say that the exploit isn't in the wild.
- deleted 2y ago
  [deleted]
- fulafel 2y ago
  Yes, it's sometimes hard to keep in mind that vulnerabilities don't just materialze into existence when they're first publicized. It's a differnt picture, everyone is vulnerable all the time.

yyyk 2y ago

Every Windows-based business LAN or industrial machine I know still has IPv6 disabled. Most other targets are too low value for people to bother.

toast0 2y ago
IPv6 actually disabled or meerly inactive because there's no router advertisements on the LAN? I suspect more of the second than the first. If it's just inactive, a compromised host can often broadcast a router advertisement or perhaps use local net addresses to compromise other hosts. A well prepared network would block ipv6 traffic on their switches, it they don't want it, but that's a big investment in capable switches.
- GoblinSlayer 2y ago
  It's a registry setting. https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows https://learn.microsoft.com/en-us/troubleshoot/windows-serve...
  - dogsledsleddog 2y ago
    Which says: > You cannot completely disable IPv6 as IPv6 is used internally on the system for many TCPIP tasks. For example, you will still be able to run ping ::1 after configuring this setting. I'd be concerned their workaround is just limiting it into a local vulnerability that spyware, etc will abuse on all the systems that end up not patched because they used the workaround..
    - GoblinSlayer 2y ago
      When spyware holds your ass, it already has everything on you and doesn't need any vulnerability.
      - IcePic 2y ago
        > When spyware holds your ass, it already has everything on you and doesn't need any vulnerability. ..because it uses one of the available local escalation tricks, where sending RA to ::1 could be one of those if that is a thing.