3 ms·

Title should be updated to include that this system scans only via IPv4. Doing such a thing with IPv6 would be a little more surprising. (7.9228163e+28 times mo

Title should be updated to include that this system scans only via IPv4. Doing such a thing with IPv6 would be a little more surprising. (7.9228163e+28 times more difficult)

newaccountfool 12y ago
Surely not all IPv6 addresses have been allocated yet though? Most of the web is still using IPv4.
- sebcat 12y ago
  I have a /64 allocation, glhf.
dsl 12y ago
There is a false assumption that IPv6 will make mass scanning like this impossible. In reality you just need to be more clever about it. (Remember way back when people used "needle in a haystack" security for dial-up systems, because nobody would ever have the resources to call every phone number in an area code?) Link-local multicast (the replacement for ARP) allows tools like alive6 to very easily enumerate all live v6 addresses on a network. So once a spear phishing attack is sucessful, you can still scan the entire internal network. Google hacks like "site:ipv6.*" and passive DNS monitoring allow you to easily separate used vs allocated/announced subnets on remote networks. IPv6 breaks in strange ways when you firewall ICMPv6, so ping scanning a subnet has become much easier. There was also a great talk (i'll try to dig it up) that talked about predictable patterns in DHCPv6 implementations, so you can cut down v6 to a near v4 search space. The best part of all is that very few security products on the market really support IPv6 correctly, so I suspect we will see more advanced attacks being possible because of IPv6 in the coming years than things being stopped.
- pixl97 12y ago
  >There is a false assumption that IPv6 will make mass scanning like this impossible. Well, this is an IPv4 brute force search, so technically a IPv6 brute force search is still impossible. You are correct though, no one is going scan something that is 99% empty by brute force.

Title should be updated to include that this system scans only via IPv4. Doing such a thing with IPv6 would be a little more surprising. (7.9228163e+28 times more difficult)

newaccountfool 12y ago

Surely not all IPv6 addresses have been allocated yet though? Most of the web is still using IPv4.

sebcat 12y ago
I have a /64 allocation, glhf.

dsl 12y ago

There is a false assumption that IPv6 will make mass scanning like this impossible. In reality you just need to be more clever about it. (Remember way back when people used "needle in a haystack" security for dial-up systems, because nobody would ever have the resources to call every phone number in an area code?) Link-local multicast (the replacement for ARP) allows tools like alive6 to very easily enumerate all live v6 addresses on a network. So once a spear phishing attack is sucessful, you can still scan the entire internal network. Google hacks like "site:ipv6.*" and passive DNS monitoring allow you to easily separate used vs allocated/announced subnets on remote networks. IPv6 breaks in strange ways when you firewall ICMPv6, so ping scanning a subnet has become much easier. There was also a great talk (i'll try to dig it up) that talked about predictable patterns in DHCPv6 implementations, so you can cut down v6 to a near v4 search space. The best part of all is that very few security products on the market really support IPv6 correctly, so I suspect we will see more advanced attacks being possible because of IPv6 in the coming years than things being stopped.

pixl97 12y ago
>There is a false assumption that IPv6 will make mass scanning like this impossible. Well, this is an IPv4 brute force search, so technically a IPv6 brute force search is still impossible. You are correct though, no one is going scan something that is 99% empty by brute force.