4 ms·

Every Windows-based business LAN or industrial machine I know still has IPv6 disabled. Most other targets are too low value for people to bother.

• toast0 2y ago
  IPv6 actually disabled or meerly inactive because there's no router advertisements on the LAN? I suspect more of the second than the first. If it's just inactive, a compromised host can often broadcast a router advertisement or perhaps use local net addresses to compromise other hosts. A well prepared network would block ipv6 traffic on their switches, it they don't want it, but that's a big investment in capable switches.
  • GoblinSlayer 2y ago
    It's a registry setting. https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows https://learn.microsoft.com/en-us/troubleshoot/windows-serve...
    • dogsledsleddog 2y ago
      Which says: > You cannot completely disable IPv6 as IPv6 is used internally on the system for many TCPIP tasks. For example, you will still be able to run ping ::1 after configuring this setting. I'd be concerned their workaround is just limiting it into a local vulnerability that spyware, etc will abuse on all the systems that end up not patched because they used the workaround..
      • GoblinSlayer 2y ago
        When spyware holds your ass, it already has everything on you and doesn't need any vulnerability.
        • IcePic 2y ago
          > When spyware holds your ass, it already has everything on you and doesn't need any vulnerability. ..because it uses one of the available local escalation tricks, where sending RA to ::1 could be one of those if that is a thing.
  • yyyk 2y ago
    I mean 'disabled in network adapter connection properties'. If you're already using IPv4 there's no reason for the extra complications of leaving IPv6 enabled.
    • sgjohnson 2y ago
      > If you're already using IPv4 there's no reason for the extra complications of leaving IPv6 enabled. That’s just flat out wrong. No pure IPv6 deployments exist on endpoints in practice. Only in internal networks. You either run pure v4, or dual stacked v4+v6. IPv6 is gaining some pretty solid adoption these days, but it’s not there yet. Disabling it is holding back the deployment of it, and is a problem by itself.
      • yyyk 2y ago
        The context ('business LAN or industrial machine') referred to internal networks. What happened there doesn't really effect IPv6 adoption.
• orev 2y ago
  That’s definitely not the norm. IPv6 is enabled by default and it’s not recommended to disable it. Only really locked down places that are ignoring recommendations would have it disabled. Whether it’s exposed to the Internet is another question, but pretty much everyone has a firewall to at least stop passive scans.
  • doubleg72 2y ago
    We do it in our 10k+ environment.
  • ammo1662 2y ago
    It seems that this can be triggered before the packet reaches the firewall. https://www.bleepingcomputer.com/news/microsoft/zero-click-windows-tcp-ip-rce-impacts-all-systems-with-ipv6-enabled-patch-now/ https://www.bleepingcomputer.com/news/microsoft/zero-click-w...
    • orev 2y ago
      I meant a network level firewall at the perimeter, but this is good information to know you can’t rely on the Windows firewall.
• throw0101c 2y ago
  > Every Windows-based business LAN or industrial machine I know still has IPv6 disabled. Which is against Microsoft's recommendations: > Internet Protocol version 6 (IPv6) is a mandatory part of Windows Vista and Windows Server 2008 and newer versions. We do not recommend that you disable IPv6 or its components. If you do, some Windows components may not function. * https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows https://learn.microsoft.com/en-us/troubleshoot/windows-serve...
  • olyjohn 2y ago
    Microsoft doesn't even listen to their own recommendations. Why would anybody else?