4 ms·

> If you have 10k (say) users on CGNAT that are compromised, it's likely that there's at least 1 on each CGNAT IP. This means you can't just null route compromi

by bsder 1y ago

> If you have 10k (say) users on CGNAT that are compromised, it's likely that there's at least 1 on each CGNAT IP. This means you can't just null route compromised IPs as you are effectively null routing the entire ISP. How about we actually finally roll out IPv6 and bury CGNAT in the graveyard where it belongs? Suddenly, everybody (ISPs, carriers, end users) can blackhole a compromised IP and/or IP range without affecting non-compromised endpoints. And DDoS goes poof. And, as a bonus, we get the end to end nature of the internet back again.

rectang 1y ago
Is it advantageous to be someone who supports IPv6 on a day like today?
lgeek 1y ago
From having worked on DDoS mitigation, there's pretty much no difference between CGNAT and IPv6. Block or rate limit an IPv4 address and you might block some legitimate traffic if it's a NAT address. Block a single IPv6 address... And you might discover that the user controls an entire /64 or whatever prefix. So if you're in a situation where you can't filter out attack trafic by stateless signature (which is pretty bad already), you'll probably err on the side of blocking larger prefixes anyway, which potentially affect other users, the same as with CGNAT. Insofar as it makes a difference for DDoS mitigation, the scarcity of IPv4 is more of a feature than a bug.
- spongebobstoes 1y ago
  you can heuristically block ipv6 prefixes on a big enough attack by blocking a prefix once a probabilistic % of nodes under it are themselves blocked, I think it should work fairly well, as long as attacking traffic has a signature. consider simple counters "ips with non-malicious traffic" and "ips with malicious traffic" to probabilistically identify the cost/benefit of blocking a prefix. you do need to be able to support huge block lists, but there isn't the same issue as cgnat where many non-malicious users are definitely getting blocked.
- zamadatix 1y ago
  (Having also worked on DDoS mitigation services) That "entire /64" is already hell of a lot more granular than a single CG-NAT range serving everyone on an ISP though. Most often in these types of attacks it's a single subnet of a single home connection. You'll need to block more total prefixes, sure, but only because you actually know you're only blocking actively attacking source subnets, not entire ISPs. You'll probably still want something signature based for the detection of what to blackhole though, but it does scale farther in a combo on the same amount of DDoS mitigation hardware.
- bsder 1y ago
  This DDoS is claimed to be the result of <300,000 compromised routers. That would be really easy to block if we were on IPv6. And it would be pretty easy to propagate upstream. And you could probabilistically unblock in an automated way and see if a node was still compromised. etc.
  - josteink 1y ago
    > That would be really easy to block -- if we were on IPv6. Make that: If the service being attacked was on IPv6-only, and the attacker had no way to fall back to IPv4. As long as we are dual-stack and IPv6 is optional, no attacker is going to be stupid enough to select the stack which has the highest probability of being defeated. Don't be naive.
    - div72 1y ago
      It'd be far more acceptable to block the CG-NAT IPv4 addresses if you knew that the other non-compromised hosts could utilize their own IPv6 addresses to connect to your service.
- swinglock 1y ago
  You should block the whole /64, at least. It's often a single host. It's often but not always a single host, that's standardized.
  - vladvasiliu 1y ago
    Usually a /64 is a "local network", so in the case of consumer ISPs that's all the devices belonging to a given client, not a single device. Some ISPs provide multiple /64s, but in the default configuration the router only announces the first /64 to the local network.
    - TZubiri 1y ago
      Presumably a compromised device can request arbitrarily new ipv6 from the dhcp so the entire block would be compromised. It would be interesting to see if standard dhcp could limit auto leasing to guard reputation of the network
      - vladvasiliu 1y ago
        Generally, IPv6 does autoconfiguration (never seen a home router with DHCPv6), so no need to ask for anything. Even for ipv4, I've never seen a home router enforce DHCP (even though it would force the public ip). But the point stands, you can't selectively punish a single device, you have to cut off the whole block, which may include well-behaved devices.
    - swinglock 1y ago
      In mobile networks it's usually a single device.
- TZubiri 1y ago
  Better to rely on ip blocks than on NAT to bundle blocks.
ralnivar 1y ago
I am a bit split this topic. There is some privacy concerns with using ipv6. https://www.rfc-editor.org/rfc/rfc7721.html#page-6 https://www.rfc-editor.org/rfc/rfc7721.html#page-6 Some time ago I decided for our site to not roll out ipv6 due to these concerns. (a couple of million visitors per month) We have meta ads reps constantly encourage us to enable it which also do not sit right with me. Although I belive fingerprinting is sofisticated enough to work without using ip's so the impact of using ipv6 might not be a meaningful difference.
- miyuru 1y ago
  its hilarious that you have privacy concerns while at the same time using meta ads.
  - Xss3 1y ago
    I am guessing they're trying to limit the privacy harm to normal channels that the slightly savvy can understand rather than completely eliminate it.
- GoblinSlayer 1y ago
  Reportedly this is often incorrectly implemented, where /64 prefix is still a stable static address.
nine_k 1y ago
Is there any money an ISP would make, or save, by sinking money and effort on switching to IPv6? If there's none, why would they act? If there is some, where? For instance, mobile phone operators, which had to turn ISPs a decade or two ago, had a natural incentive to switch to IPv6, especially as they grew. Would old ISPs make enough from selling some of their IPv4 pools?
- ROBLOX_MOMENTS 1y ago
  They already lease them out. TELUS in Canada traditional old ISP rents large portion of their space to a mostly used for Chinese GFW VPN server provider in LA „Psychz“
  - TZubiri 1y ago
    The ISPs have to submit plans on how to use their IPs for the public,especially for IPv4, Arnic shouldn't approve this kind of stuff. Unless they lied in their ip block application, in which case they should be revoked their block.
    - Braxton1980 1y ago
      I filled out one of these for Cogent to get a /24. I was being honest but all I had to put was services that requires their own IP. I even listed a few but no where near the 253. They also never responded back and were like "what about NAT" or "what about host based routing".
      - TZubiri 1y ago
        Not sure what you filled out, but blocks are handed usually not to end users, but to providers that will sublease the ips to their client. So if you are asking for a block for a couple of your HTTP servers, that's a no. If you rent HTTP servers to, say, local small businesses, then that's a yes.
        deleted 1y ago
createaccount99 1y ago
Isn't it enough that the target of the DDOS only accepts ipv6?
josteink 1y ago
> How about we actually finally roll out IPv6 and bury CGNAT in the graveyard where it belongs? That depends on the service you are DDosing actually having an IPv6 presence. And lots of sites really don't. It doesn't help if you have IPv6 if you need to fallback to IPv4 anyway. And if bot-net authors knows they can hide behind CGNAT, why would they IPv6 enable their bot-load when all sites and services are guaranteed to be reachable bia IPv4 for the next 3 decades? (Disclaimer: This comment posted on IPv6)

by bsder 1y ago

rectang 1y ago

Is it advantageous to be someone who supports IPv6 on a day like today?

lgeek 1y ago

From having worked on DDoS mitigation, there's pretty much no difference between CGNAT and IPv6. Block or rate limit an IPv4 address and you might block some legitimate traffic if it's a NAT address. Block a single IPv6 address... And you might discover that the user controls an entire /64 or whatever prefix. So if you're in a situation where you can't filter out attack trafic by stateless signature (which is pretty bad already), you'll probably err on the side of blocking larger prefixes anyway, which potentially affect other users, the same as with CGNAT. Insofar as it makes a difference for DDoS mitigation, the scarcity of IPv4 is more of a feature than a bug.

spongebobstoes 1y ago
you can heuristically block ipv6 prefixes on a big enough attack by blocking a prefix once a probabilistic % of nodes under it are themselves blocked, I think it should work fairly well, as long as attacking traffic has a signature. consider simple counters "ips with non-malicious traffic" and "ips with malicious traffic" to probabilistically identify the cost/benefit of blocking a prefix. you do need to be able to support huge block lists, but there isn't the same issue as cgnat where many non-malicious users are definitely getting blocked.
zamadatix 1y ago
(Having also worked on DDoS mitigation services) That "entire /64" is already hell of a lot more granular than a single CG-NAT range serving everyone on an ISP though. Most often in these types of attacks it's a single subnet of a single home connection. You'll need to block more total prefixes, sure, but only because you actually know you're only blocking actively attacking source subnets, not entire ISPs. You'll probably still want something signature based for the detection of what to blackhole though, but it does scale farther in a combo on the same amount of DDoS mitigation hardware.
bsder 1y ago
This DDoS is claimed to be the result of <300,000 compromised routers. That would be really easy to block if we were on IPv6. And it would be pretty easy to propagate upstream. And you could probabilistically unblock in an automated way and see if a node was still compromised. etc.
- josteink 1y ago
  > That would be really easy to block -- if we were on IPv6. Make that: If the service being attacked was on IPv6-only, and the attacker had no way to fall back to IPv4. As long as we are dual-stack and IPv6 is optional, no attacker is going to be stupid enough to select the stack which has the highest probability of being defeated. Don't be naive.
  - div72 1y ago
    It'd be far more acceptable to block the CG-NAT IPv4 addresses if you knew that the other non-compromised hosts could utilize their own IPv6 addresses to connect to your service.
swinglock 1y ago
You should block the whole /64, at least. It's often a single host. It's often but not always a single host, that's standardized.
- vladvasiliu 1y ago
  Usually a /64 is a "local network", so in the case of consumer ISPs that's all the devices belonging to a given client, not a single device. Some ISPs provide multiple /64s, but in the default configuration the router only announces the first /64 to the local network.
  - TZubiri 1y ago
    Presumably a compromised device can request arbitrarily new ipv6 from the dhcp so the entire block would be compromised. It would be interesting to see if standard dhcp could limit auto leasing to guard reputation of the network
    - vladvasiliu 1y ago
      Generally, IPv6 does autoconfiguration (never seen a home router with DHCPv6), so no need to ask for anything. Even for ipv4, I've never seen a home router enforce DHCP (even though it would force the public ip). But the point stands, you can't selectively punish a single device, you have to cut off the whole block, which may include well-behaved devices.
  - swinglock 1y ago
    In mobile networks it's usually a single device.
TZubiri 1y ago
Better to rely on ip blocks than on NAT to bundle blocks.

ralnivar 1y ago

I am a bit split this topic. There is some privacy concerns with using ipv6. https://www.rfc-editor.org/rfc/rfc7721.html#page-6 https://www.rfc-editor.org/rfc/rfc7721.html#page-6 Some time ago I decided for our site to not roll out ipv6 due to these concerns. (a couple of million visitors per month) We have meta ads reps constantly encourage us to enable it which also do not sit right with me. Although I belive fingerprinting is sofisticated enough to work without using ip's so the impact of using ipv6 might not be a meaningful difference.

miyuru 1y ago
its hilarious that you have privacy concerns while at the same time using meta ads.
- Xss3 1y ago
  I am guessing they're trying to limit the privacy harm to normal channels that the slightly savvy can understand rather than completely eliminate it.
GoblinSlayer 1y ago
Reportedly this is often incorrectly implemented, where /64 prefix is still a stable static address.

nine_k 1y ago

Is there any money an ISP would make, or save, by sinking money and effort on switching to IPv6? If there's none, why would they act? If there is some, where? For instance, mobile phone operators, which had to turn ISPs a decade or two ago, had a natural incentive to switch to IPv6, especially as they grew. Would old ISPs make enough from selling some of their IPv4 pools?

ROBLOX_MOMENTS 1y ago
They already lease them out. TELUS in Canada traditional old ISP rents large portion of their space to a mostly used for Chinese GFW VPN server provider in LA „Psychz“
- TZubiri 1y ago
  The ISPs have to submit plans on how to use their IPs for the public,especially for IPv4, Arnic shouldn't approve this kind of stuff. Unless they lied in their ip block application, in which case they should be revoked their block.
  - Braxton1980 1y ago
    I filled out one of these for Cogent to get a /24. I was being honest but all I had to put was services that requires their own IP. I even listed a few but no where near the 253. They also never responded back and were like "what about NAT" or "what about host based routing".
    - TZubiri 1y ago
      Not sure what you filled out, but blocks are handed usually not to end users, but to providers that will sublease the ips to their client. So if you are asking for a block for a couple of your HTTP servers, that's a no. If you rent HTTP servers to, say, local small businesses, then that's a yes.
      - deleted 1y ago

createaccount99 1y ago

Isn't it enough that the target of the DDOS only accepts ipv6?

josteink 1y ago

> How about we actually finally roll out IPv6 and bury CGNAT in the graveyard where it belongs? That depends on the service you are DDosing actually having an IPv6 presence. And lots of sites really don't. It doesn't help if you have IPv6 if you need to fallback to IPv4 anyway. And if bot-net authors knows they can hide behind CGNAT, why would they IPv6 enable their bot-load when all sites and services are guaranteed to be reachable bia IPv4 for the next 3 decades? (Disclaimer: This comment posted on IPv6)