4 ms·

the future is bleak: Attackers can just rent a /48 ipv6 block for a few dollars and have a billion IPs at their disposal.

• vetrom 2y ago
  It's certainly an annoying future. I fully expect some sort of ASN-reputation map and service to become de rigeur in the next decade. Pretty sure heavier-duty SIEM/IPS systems already do that.
• kemitche 2y ago
  You can control the block size for this, though: https://man.openbsd.org/sshd_config.5#PerSourceNetBlockSize https://man.openbsd.org/sshd_config.5#PerSourceNetBlockSize
• tsimionescu 2y ago
  I'm sure people will quickly start blocking /48s or even larger blocks once that becomes common.
  • gnfargbl 2y ago
    They already do. The IPv6 public routable prefix is the first 48 bits, so a /48 is what ~everyone uses as the analogy of the v4 /32, for rate limiting purposes.
    • lxgr 2y ago
      Everyone? I’ve had ISPs provide me with anything from an /48 to a /64. For the latter, you’d be vastly over counting with /48-based limiting.
      • Sesse__ 2y ago
        But the /64 would not be publicly routable (i.e., be visible in the global BGP table). I guess in practice, it's more like IPv4 /24 = IPv6 /48, though. The closest analog to an IPv4 /32 would probably be an IPv6 /64.
        • lxgr 2y ago
          How do routeability and BGP matter for the purpose of traffic source identification and rate limiting?
          • Sesse__ 2y ago
            If you have two addresses in the same /64, you know almost certainly they are on the same LAN. If you have two addresses in neighboring /64s (same initial 63 bits), or in general within the same /48 (same initial 48 bits), you know almost certainly that they are somehow within the same organization. They could be within the same building, or in the same company, or using the same ISP or cloud provider; you don't know, but they are somehow related. How do you know? Well, since a /49 isn't individually routable in BGP, they have to _somehow_ originate at the same upstream network. There has to be some sort of cooperation between them (possibly through an ISP as a middleman). But if they are in _neighboring_ /48s, you don't have this kind of guarantee. They could be from completely different organizations. Most likely, they are on the same continent (since they were given out by the same regional internet registry; RIR), but even that is not really guaranteed. So when you are bucketing addresses for rate limiting purposes, a /48 is a reasonable place to start doing that, just like /24 is for IPv4. Of course, you may need to get smarter than that (e.g. an attacker could have access to a /32), but it's a reasonable starting spot.
            • lxgr 2y ago
              > So when you are bucketing addresses for rate limiting purposes, a /48 is a reasonable place to start doing that, just like /24 is for IPv4. I've encountered assumptions such as this one as a user, and they're really frustrating. More than once I've found myself banned from being able to log in, view a site etc. because of somebody else's bad behavior I temporarily share a CG-NAT or large public Wi-Fi with, or more likely because somebody topologically close to me got hacked. Meanwhile, actual attackers are using pretty much the entire IPv4 space worth of compromised embedded devices spread across the globe...
        • ikiris 2y ago
          How exactly is a non routable ipv6 address going to try to log in to your ssh server?
      • gnfargbl 2y ago
        We have two perspectives, the normal user and the scraper. The normal user either acquires a /64, /56 or /48, depending on the whim of their ISP. There is typically no cost difference between these options, which means that the scraper (or their upstream proxy) always chooses a provider which offers a /48. Thus, the default unit of IPv6 blocking must be a /48. This situation will persist for as long as /48s are readily available at the same price as /64s. Perversely, the reason we don't have this issue in IPv4 space is because the address space is of the same order of magnitude as the number of potential users. That artificial scarcity means that a routable /24 is x256 the cost of a end-user /32, so the unit of blocking can be a /32.
        • lxgr 2y ago
          > Perversely, the reason we don't have this issue in IPv4 space is because the address space is of the same order of magnitude as the number of potential users. Do we not? And is it really? There are some /32 IPv4 addresses hosting many users, e.g. with CG-NAT, and it's already an issue with regards to blocking/rate-limiting. Just like there are single-user /48s and multi-user /64s, there can be single-user /32s and /32s hosting tons of users behind a CG-NAT.
          • gnfargbl 2y ago
            Sure, but that's the same argument I'm making: the unit of blocking will be the largest unit that is routinely allocated to a single user. In IPv4 space that's a /32, so people block by /32. In IPv6 space that's a /48, so people block by /48. Check out Let's Encrypt's rate limit policy, for example. The difference I'm pointing out between IPv4 and IPv6 is that nobody is giving single IPv4 users /24s for their own use. But IPv6 /48s (which are theoretically somewhat equivalent to IPv4 /24s) are freely available. This is a problem because it makes over-blocking even more likely than it already is. And as you point out elsewhere, over-blocking is already an issue in IPv4 space.
    • mmsc 2y ago
      Good to know my single ipv6 address that my ISP gives my home router can be used to get the whole /48 ratelimited by ~everyone
• gorgoiler 2y ago
  Most ISP customers get either a /48 or a /56. The IPv6 equivalent of a random 1.2.3.4/32 consumer IP address would be something like 2001:abcd:1234::/48 or 2001:abcd:1234:ff::/56 in IPv6.
• 0x457 2y ago
  Such blocking was always not about protection, but not having 100500 error messages in your logs every hour. Attackers that are blocked are the kind of attackers that cast a wide net and see what get caught.