Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA CSI IPv6 Security Guidance (2023) [pdf]

media.defense.gov

Post reply on HN
Print view View original

21–30 of 57 posts

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#21

Post by roamerz »

johnnyapol wrote: post #12
yonz wrote: post #9

Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports. I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall setti…

IPv6 not having NAT doesn’t make it incompatible with stateful firewalls. You can still have routers doing drop inbound by default.

It goes beyond that. With IPV4 you have the further protection of private subnets not even routing across the public internet - it’s broke by default, no configuration necessary.

Your attack surface is primarily your firewall which admittedly might be an easy target - but not as easy as an unprotected Windows box.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#22

Post by ZeroSolstice »

sn0wf1re wrote: post #10
ZeroSolstice wrote: post #6

Earlier quoted context omitted.

What would be the advantages of running 6to4 on your network edge?

My thinking was that it would be a single point of ipv4 traffic, rather than having to maintain all the components for dual stack. But thinking about it more, 6to4 probably increases the complexity of firewalls.

Ah, yes I see what you were thinking.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#23

Post by yonz »

throw0101c wrote: post #17
yonz wrote: post #9

Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports. I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall setti…

> I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall settings. When my ISP started handing out IPv6 addresses, my Asus RT-AC68U by default blocked incoming IPv6 connections unless they were replies to previous outgoing connections. That is to say: stateful firewalls exist in th…

Thanks for sharing that, good data point for drop incoming.

I had a nighthawk, I ended up setting up the ipv6 rules.

The TLDR on the debate so far is if router shipped over the last 20 years have both drop IPV4 and drop IPV6 incoming.

In my opinion, NAT was an added layer on top of firewall rules because inbound ports had to be mapped to a particular host and port since the router would not know which host to send to. This created a default opt out experience because for a port on your machine to get accessed, a packet must pass inbound rules and match a port map table entry.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#24

Post by _8j50 »

doublepg23 wrote: post #16
_8j50 wrote: post #11

Earlier quoted context omitted.

You are getting downvoted but ipv6 was ratified in 1998. The sunken cost fallacy is real here. At what point or threshold should there be a proposal for a simple address length extension of IPv4. Even in cloud providers who have an army of sysadmins and netadmins they don't support v6 in private networks. Let's be very honest here, does anyone have a good reasom to believe another 25 years would mean ipv6 would displ…

> ratified in 1998 While this is true World IPv6 Launch Day in 2012 is the date most people point to for earnest IPv6 deployments. It was also not completely ratified until 2017. > At what point or threshold should there be a proposal for a simple address length extension of IPv4. If you pass a IPv4v2 packet it will not be routed. You'll need to replace all networking equipment to support IPv4v2...which is what we've…

> If you pass a IPv4v2 packet it will not be routed. You'll need to replace all networking equipment to support IPv4v2...which is what we've done/currently doing w.r.t. IPv6

That was never the difficult part. Mosr corr routers and expensive gear supported ipv6 many years ago.

> We're at over 50% deployment in the US. Again, it's closer to 10 years.

That means almost nothing. Even if you have 100% deployment, it is more expensive to maintain v6 by server admins,developers and consumers alike, especially in the not so rich countries. It just adds more maintenance cost, it isn't economically practical to expect it to hit critical mass and the everyone stops writing v4 specific code and config. IPv42 or whatever will be a good solution will be economically viable requiring the smallest change by end users and producers. V6 was developed by a committee of network engineers that only saw things from a network operator and vendor perspective. The lesson from sunken cost fallacy is that existing investment cannot be used to justify continued investment and in this case the problem of v4 shortage has been addressed by other means in a way that will keep it alive for decades more.

In my opinion, a solutiom that requires a firmware update that can work with existing ASIC and is economically viable is possible but the discussion about that isn't even happening. Billions will be wasted on the hopes that decades from now ipv6 can stand on its own.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#25

Post by alphazard »

yonz wrote: post #9

Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports. I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall setti…

It should be possible for every device on the internet to easily communicate with ever other device. A silver lining of the poor designs of the past is that it is practically very difficult to attack services listening on private network addresses. This difficulty also makes it hard to do useful things.

IPv6 is a step in the right direction, but the resolution to security issues can't be more firewalls or more network equipment. It has to start with operating systems. It is completely ridiculous that applications have access to the network and most of the filesystem by default. Operating systems need to give limited access to the filesystem and other services so that a compromised service isn't a big deal. A successful attacker doesn't own the whole system. They owned a poorly written application and the small sandbox that it's in. This is an obvious idea to most engineers, but neither windows nor macOS get this right out of the box. The iPhone's sandboxing model and fine-grained permissions are way ahead here, but there is still more improvement to be had.

And then there's the issue of most applications not requiring network access in the first place. There is no reason for Word, Photoshop, Blender, etc. to ever need access to the network. A firewall that only administrators can manipulate is also not a solution, that has to be in the users hands as well. Reasoning about a global table of rules is the wrong UX.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#26

Post by yonz »

roamerz wrote: post #21
johnnyapol wrote: post #12

Earlier quoted context omitted.

IPv6 not having NAT doesn’t make it incompatible with stateful firewalls. You can still have routers doing drop inbound by default.

It goes beyond that. With IPV4 you have the further protection of private subnets not even routing across the public internet - it’s broke by default, no configuration necessary. Your attack surface is primarily your firewall which admittedly might be an easy target - but not as easy as an unprotected Windows box.

Exactly! Duplicating my point in a thread below to drive your point home:

NAT was an added layer on top of firewall rules because inbound ports had to be mapped to a particular host and port since the router would not know which host to send to. This created a default opt out experience because for a port on your machine to get accessed, a packet must pass inbound rules and match a port map table entry.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#27

Post by dsfghjkdfg »

yonz wrote: post #9

Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports. I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall setti…

thats EXTREMELY naive. depending on ISP provided cheap router for security.

most of those routers are very, very dumb.

do the following excercise. add your routers external address as a gateway for your net internal IP, now from the outside reach your computer. easy. fully standards compliant. pierce your NAT like it wasn't even there.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#28

Post by ekr____ »

doublepg23 wrote: post #16
_8j50 wrote: post #11

Earlier quoted context omitted.

You are getting downvoted but ipv6 was ratified in 1998. The sunken cost fallacy is real here. At what point or threshold should there be a proposal for a simple address length extension of IPv4. Even in cloud providers who have an army of sysadmins and netadmins they don't support v6 in private networks. Let's be very honest here, does anyone have a good reasom to believe another 25 years would mean ipv6 would displ…

> ratified in 1998 While this is true World IPv6 Launch Day in 2012 is the date most people point to for earnest IPv6 deployments. It was also not completely ratified until 2017. > At what point or threshold should there be a proposal for a simple address length extension of IPv4. If you pass a IPv4v2 packet it will not be routed. You'll need to replace all networking equipment to support IPv4v2...which is what we've…

A few notes on the timeline.

The IETF has a two-level standards system consisting of "Proposed Standard" and "Internet Standard". IPv6 was first published as "Proposed Standard" in 1998 and finally transitioned to Internet Standard in 2017. Although officially Proposed Standards are supposed to be treated as "immature specifications", as a practical matter, people routinely deploy on them. Whether an RFC is advanced to Internet Standard is less a question of whether it is mature than whether the editors and/or WG bother to advance it. Here are a number of examples of widely deployed protocols that never advanced beyond Proposed (1) all versions of TLS (2) HTTP/2 (3) SIP (4) QUIC.

I think choosing 2012 as your start date is pretty generous. Proponents of IPv6 were telling people to start deploying long before that. In fact, the IETF sunsetv4 WG, dedicated to sunsetting IPv4, was formed in 2012 several months before World IPv6 launch day. Arguably, World IPv6 Launch Day was a reaction to the failure of v6 to get large-scale organic deployment 12ish years in.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#29

Post by CircleSpokes »

codesniperjoe wrote: post #2

TLDR: Avoid it if you can!

That is the exact opposite off what it says. The US government has actually mandated IPV6 only networks in the next few years.

>At least 20% of IP-enabled assets on Federal networks are IPv6-only by the end of FY 2023;9 >b. At least 50% of IP-enabled assets on Federal networks are IPv6-only by the end of FY 2024; >c. At least 80% of IP-enabled assets on Federal networks are IPv6-only by the end of FY 2025

https://www.cio.gov/assets/resources/internet-protocol-versi...

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#30

Post by ZeroSolstice »

yonz wrote: post #13
ZeroSolstice wrote: post #4

Earlier quoted context omitted.

Aren't these comments getting a bit old at this point? Running dual-stack should not be any more difficult than just running IPv4. There is a plethora of automated deployment tools and I'd hardly think people are DHCP'ng addresses to their servers. You don't have to use SLAAC and can statically assign addresses just like IPv4. Even for your dual stacked devices getting IPv6 addresses via RA can be tracked back to the…

In the context of network intrusion detection and providing secure online services, I agree with you. However, if this guidance is trying to influence government office routers and internet gateways... It's a different story. A transition from IPV4 to IPV6 creates a new per device tracking capability that leaks internal network structure. This in my opinion is worse than internal domains getting certs from Let's Encr…

Realistically though what information can you glean from a hosts IPv6 address that wouldn't already be part of WHOIS? With IPv4 you already know there are only (3) rfc1918 reserved ranges. Anyone can use them as they see fit so seeing a 10/8 address in a email header doesn't automatically mean the company is huge its just what they picked. Myself, i've just never really bought into the whole "dns naming" or discovering private address ranges giving anything away. With existing NAT device tracking moved onto more unique features such as browser, screen size, etc. such that IP address tracking is probably not as accurate.
Post reply on HN