My NAS exposes itself over the internet without permission • Hacker News Board

Re: My NAS exposes itself over the internet without permission

#281

Post by BlueTemplar » Sun, Apr 04, 2021, 3:10 PM UTC

BrandoElFollito wrote: post #276

BlueTemplar wrote: post #268

Earlier quoted context omitted.

RIPE : https://www.ripe.net/publications/docs/ripe-690#5-2--why-non... That's funny, because I kind of have the "lowest" fiber offering from Orange, and I don't think my IP ever changed ? (I wouldn't bet on it thought.)

The RIPE article is about IPv6. I use only v4 I monitor closely my Internet connection (since I serve stuff on it, and also because why not) and I saw my IP changing and wandering throughout the Ile-de-France. I would say that the changes are every 6 months or so (since one of my domain is with Gandi I had to write a checker and change the assignment through their API)

If you only use IPv4, then these days (with not only the Asiatic countries never having got IPv4, but Europe having ran out if IPv4 addresses), technically you don't have a "real" Internet connection any more.

Re: My NAS exposes itself over the internet without permission

#282

Post by BrandoElFollito » Sun, Apr 04, 2021, 3:13 PM UTC

BlueTemplar wrote: post #281

BrandoElFollito wrote: post #276

Earlier quoted context omitted.

The RIPE article is about IPv6. I use only v4 I monitor closely my Internet connection (since I serve stuff on it, and also because why not) and I saw my IP changing and wandering throughout the Ile-de-France. I would say that the changes are every 6 months or so (since one of my domain is with Gandi I had to write a checker and change the assignment through their API)

If you only use IPv4, then these days (with not only the Asiatic countries never having got IPv4, but Europe having ran out if IPv4 addresses), technically you don't have a "real" Internet connection any more.

I do not understand what you are saying. Do you imply thet IPv4 is non-existant in Asia??

How having ran out of IPv4 means that there is no "rea" Internet?

Honestly - it would be great if IPv6 caught up but the standard, first choice is IPv4.

Re: My NAS exposes itself over the internet without permission

#283

Post by detaro » Sun, Apr 04, 2021, 3:26 PM UTC

BlueTemplar wrote: post #280

detaro wrote: post #278

Earlier quoted context omitted.

> pretty common for IPv6 Source? Every consumer router I've ever seen that supported IPv6 also had a firewall covering IPv6. Given the crapshot routers tend to be I wouldn't be surprised if some messed that up, but "pretty common" seems unlikely.

https://lafibre.info/ipv6/ipv6-le-firewall/ For context, Free recently boasted reaching 99% IPv6 coverage. On their (now) midrange Freebox Revolution router, the IPv6 firewall is (AFAIK still today) opt-in.

Ugh. Idiots. CPEs should default to firewall on.

Re: My NAS exposes itself over the internet without permission

#284

Post by batch12 » Sun, Apr 04, 2021, 3:26 PM UTC

oriolid wrote: post #244

rubatuga wrote: post #241

Earlier quoted context omitted.

That’s not how NAT works though. It uses random ports, and there are no collisions, unless you have thousands of Xboxes behind a NAT. Also, remember that CGNAT is a thing, with hundreds of households( with dozens of game consoles) all behind a single IP address. Essentially, the people talking about game consoles not working are wrong.

That is how NAT works for connections opened from private network to the Internet. If the console needs to listen to a port, the NAT must be configured to forward the listened port to correct device. Multiple devices behind NAT can not listen to the same port, and this is where the forwarding of different ports on public IP to same port on different private IPs comes in.

The source port would be random and conmunication would ride on that established connection. An exposed port is not necessary for client initiated communication.

Re: My NAS exposes itself over the internet without permission

#285

Post by BlueTemplar » Sun, Apr 04, 2021, 3:53 PM UTC

BrandoElFollito wrote: post #282

BlueTemplar wrote: post #281

Earlier quoted context omitted.

If you only use IPv4, then these days (with not only the Asiatic countries never having got IPv4, but Europe having ran out if IPv4 addresses), technically you don't have a "real" Internet connection any more.

I do not understand what you are saying. Do you imply thet IPv4 is non-existant in Asia?? How having ran out of IPv4 means that there is no "rea" Internet? Honestly - it would be great if IPv6 caught up but the standard, first choice is IPv4.

My bad, I should have said that "some" Asian countries never had enough IPv4 addresses to start with. AFAIK this explains why India is one of the world leaders in IPv6 deployment ? (I've also heard that IPv6-only networks are not uncommon in some Asiatic countries ?)

IPv6 has been slowly rolled out for more than a decade now, though AFAIK the standard has only been finalized in 2017.

Since 2017, first choice should have been IPv6.

"Internet" stands for "International network". If you're using IPv4 only, when someone else uses IPv6 only, then obviously you won't be able to connect to each other. Therefore you aren't on the same network. And only one of them can be "really" called "Internet".

(Also, IPv4 was an experimental ARPANET protocol which wasn't supposed to be used "in production" worldwide, but here we are...)

Re: My NAS exposes itself over the internet without permission

#286

Post by BlueTemplar » Sun, Apr 04, 2021, 4:01 PM UTC

detaro wrote: post #283

BlueTemplar wrote: post #280

Earlier quoted context omitted.

https://lafibre.info/ipv6/ipv6-le-firewall/ For context, Free recently boasted reaching 99% IPv6 coverage. On their (now) midrange Freebox Revolution router, the IPv6 firewall is (AFAIK still today) opt-in.

Ugh. Idiots. CPEs should default to firewall on.

Well, OTOH, the fact that tens of millions of people have now been connected through firewall-free/disabled IPv6 for years, yet the (somewhat expected) disaster of widespread hacking/compromises clearly didn't happen... which could mean that this is not that critical of a security feature as could be expected ?

Re: My NAS exposes itself over the internet without permission

#287

Post by imwillofficial » Sun, Apr 04, 2021, 4:19 PM UTC

batch12 wrote: post #229

imwillofficial wrote: post #222

Earlier quoted context omitted.

“Overly complex, therefore insecure” Has to be the most incorrect understanding I’ve ever seen in computing... And I’ve seen people talking to their mice...

Maybe they were from the future and just needed a tank for some whales...

You made my day^

Re: My NAS exposes itself over the internet without permission

#288

Post by kn100 » Sun, Apr 04, 2021, 5:36 PM UTC

kotsec wrote: post #107

You should NOT have any terramaster NAS internet facing right now. I disclosed a bug last month to Terramaster that still hasn't been fixed. Go to http://NAS_IP/module/api.php?wap/ and it will give your admin password out as an md5crypt hash. Why? I assume it's some sort of backdoor/dev code but I don't know.

Jesus, confirmed here. That is tragic.

Re: My NAS exposes itself over the internet without permission

#289

Post by ksec » Sun, Apr 04, 2021, 5:49 PM UTC

We need a new term & new hardware that is an NAS but only available to Internal Network with no option of Internet access.

I have for years wished Apple made something like that and has iPhone / iPad Backup automatically to it or Time Capsule for iOS. Instead they continue to push their iCloud for services revenue increase.

Re: My NAS exposes itself over the internet without permission

#290

Post by nullify88 » Sun, Apr 04, 2021, 6:32 PM UTC

batch12 wrote: post #284

oriolid wrote: post #244

Earlier quoted context omitted.

That is how NAT works for connections opened from private network to the Internet. If the console needs to listen to a port, the NAT must be configured to forward the listened port to correct device. Multiple devices behind NAT can not listen to the same port, and this is where the forwarding of different ports on public IP to same port on different private IPs comes in.

The source port would be random and conmunication would ride on that established connection. An exposed port is not necessary for client initiated communication.

Yes, you're talking about a device behind NAT which initiates a connection to an external service.

However, we're talking about a service listening behind NAT (in this case Call of Duty on an Xbox at home) that needs to be listening for connections initiated by other Xboxes to establish a P2P connection. This is what port forwarding enables and this is what uPnP automates.