11–20 of 112 posts
Earlier quoted context omitted.
Vulnerable by default? If a device is listening to UPnP on the WAN interface, the fault is not on UPnP but on whoever configured it to be open on the WAN. IMO, all of these zeroconf protocols should be limited to responding back only to the local segment and not allowed to traverse gateways.
What about not replying to unicast responses? Or rate limiting by default?
Why is IP spoofing STILL an issue? Why?
Why is IP spoofing STILL an issue? Why?
1) Hardware. ALL routers performance degrades. Sometimes up to unsuitability. 2) Software. No commonly agreed way to maintain route and route6 object. No federation for them 3) Administrative. Lack of network hygiene. Keyword: BCP38 Relevant document https://tools.ietf.org/pdf/bcp38.pdf
I suspect it might reduce out-of-network traffic a bit too..
Or ISPs could check source IPs at edge routers maybe?
Edit: for the downvoters, this isn't just my opinion, please read https://en.wikipedia.org/wiki/Responsible_disclosure
It is unfortunate that CloudFlare shared enough PoC code to weaponize this. Edit: for the downvoters, this isn't just my opinion, please read https://en.wikipedia.org/wiki/Responsible_disclosure
Earlier quoted context omitted.
1) Hardware. ALL routers performance degrades. Sometimes up to unsuitability. 2) Software. No commonly agreed way to maintain route and route6 object. No federation for them 3) Administrative. Lack of network hygiene. Keyword: BCP38 Relevant document https://tools.ietf.org/pdf/bcp38.pdf
Wouldn't it be enough to check the source IP against the ip/mask at ISP pairing sites... I suspect it might reduce out-of-network traffic a bit too.. Or ISPs could check source IPs at edge routers maybe?
Why is IP spoofing STILL an issue? Why?
Why is IP spoofing STILL an issue? Why?
Earlier quoted context omitted.
Wouldn't it be enough to check the source IP against the ip/mask at ISP pairing sites... I suspect it might reduce out-of-network traffic a bit too.. Or ISPs could check source IPs at edge routers maybe?
Incase of huge DoS attacks they do something similar. But with DDoS attacks the spoofed packets are coming from so many different locations that it is hard to identify them, and often it is just stuff like compromised toasters.
Only on HN. Haha.