Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA CSI IPv6 Security Guidance (2023) [pdf]

media.defense.gov

Post reply on HN
Print view View original

31–40 of 57 posts

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#31

Post by wjholden »

yonz wrote: post #9

Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports. I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall setti…

I'm not so concerned.

For one thing, a /64 issued to a house is a pretty daunting search space for the scanning worms of yesterday.

Another, computers today do come with firewalls that are enabled by default and tricky to disable.

Third, the industry really had to start taking memory safety and attack surface seriously after the Blaster/Sasser/MyDoom days. We see another article here on HN every week about another company categorically solving memory problems by adopting Rust.

Finally, having remote desktop shouldn't be a problem if people don't know your password, no? It's not like there is a firewall stopping baddies from guessing your Gmail password.

I realize that a NAT/PAT device does incidentally serve as a stateful firewall for many homes, but I think it is less important with modern OS's than one might think.

Now for the hospitals still using Windows XP...yeah you're right about that. I'd like to see regulators start fining companies for using obsolete hardware and software.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#32

Post by whoopdedo »

roamerz wrote: post #21
johnnyapol wrote: post #12

Earlier quoted context omitted.

IPv6 not having NAT doesn’t make it incompatible with stateful firewalls. You can still have routers doing drop inbound by default.

It goes beyond that. With IPV4 you have the further protection of private subnets not even routing across the public internet - it’s broke by default, no configuration necessary. Your attack surface is primarily your firewall which admittedly might be an easy target - but not as easy as an unprotected Windows box.

Private address ranges are a human convention and there have been instances in the past of upstream routers passing them on.[1] Relying on other people to do your filtering for you is a bad idea. I'm going to put the rules in my own router, whether those addresses are (potentially) globally routable or are designated as private.

The use of small private pools has even helped attackers who would inject browser scripts probing the well-known prefixes.[2]

[1] https://serverfault.com/questions/374126/private-ip-getting-...

[2] https://www.bleepingcomputer.com/news/security/new-behave-ex...

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#33

Post by jeroenhd »

yonz wrote: post #13
ZeroSolstice wrote: post #4

Earlier quoted context omitted.

Aren't these comments getting a bit old at this point? Running dual-stack should not be any more difficult than just running IPv4. There is a plethora of automated deployment tools and I'd hardly think people are DHCP'ng addresses to their servers. You don't have to use SLAAC and can statically assign addresses just like IPv4. Even for your dual stacked devices getting IPv6 addresses via RA can be tracked back to the…

In the context of network intrusion detection and providing secure online services, I agree with you. However, if this guidance is trying to influence government office routers and internet gateways... It's a different story. A transition from IPV4 to IPV6 creates a new per device tracking capability that leaks internal network structure. This in my opinion is worse than internal domains getting certs from Let's Encr…

> A transition from IPV4 to IPV6 creates a new per device tracking capability that leaks internal network structure.

I doubt it. Your load balancers will be the only addresses that will be addressable anyway. Your IPv4 load balancers will also be "leaking" IP addresses.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#34

Post by simoncion »

From the recommendations document:

> The assigned IPv6 address incorporates media access control (MAC) address information from the network interface and may allow for host identification via interface ID, network interface card, or host vendor.

How long has it been since NSA has looked at generally-available OSs with IPv6 support? IPv6 "Privacy Addresses" are a thing that's on-by-default everywhere (and a damn thorn in my side). SLAAC has been using a identifier that's a combination of a randomly-generated ID and the subnet that the address is being generated for rather than the MAC address of the NIC for address generation for ages. (This is yet another thing that I revert back to the old behavior.)

They go on to recommend disabling SLAAC and using only DHCPv6. Does NSA know something exploitable about common DHCPv6 implementations that we don't? ;)

> ...a dual stack DNS implementation may need to support both A and AAAA records.

It's weird to say "dual stack DNS implementation". DNS servers can store A and AAAA records, regardless of whether their host is doing "dual stack" addressing or not. (If yours cannot, then by golly, you fucked up when you wrote your DNS server.)

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#35

Post by throw0101c »

yonz wrote: post #23
throw0101c wrote: post #17

Earlier quoted context omitted.

> I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall settings. When my ISP started handing out IPv6 addresses, my Asus RT-AC68U by default blocked incoming IPv6 connections unless they were replies to previous outgoing connections. That is to say: stateful firewalls exist in th…

Thanks for sharing that, good data point for drop incoming. I had a nighthawk, I ended up setting up the ipv6 rules. The TLDR on the debate so far is if router shipped over the last 20 years have both drop IPV4 and drop IPV6 incoming. In my opinion, NAT was an added layer on top of firewall rules because inbound ports had to be mapped to a particular host and port since the router would not know which host to send to…

> In my opinion, NAT was an added layer on top of firewall rules because […]

… there were not enough IPv4 addresses to go around, and so you only got one, and if you had more than one system at home, too bad… until NAT got invented.

Back in the dial-up days, you had only one system connected to the Internet—the one that was connected to the modem—and it got the the IP address directly. It was only later with the always-on nature of cable and DSL ISPs that sharing a connection became a thing. IIRC, you used to connect your computer directly to the {cable, DSL} modem without an intervening router, sometimes using USB, as computers having built-in (Ethernet or Wifi) networking wasn't really a thing:

* https://support.dlink.ca/ProductInfo.aspx?m=DSL-2320B

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#36

Post by zokier »

simoncion wrote: post #34

From the recommendations document: > The assigned IPv6 address incorporates media access control (MAC) address information from the network interface and may allow for host identification via interface ID, network interface card, or host vendor. How long has it been since NSA has looked at generally-available OSs with IPv6 support? IPv6 "Privacy Addresses" are a thing that's on-by-default everywhere (and a damn thorn…

> They go on to recommend disabling SLAAC and using only DHCPv6. Does NSA know something exploitable about common DHCPv6 implementations that we don't? ;)

This is what they say

> NSA recommends assigning addresses to hosts via a Dynamic Host Configuration Protocol version 6 (DHCPv6) server to mitigate the SLAAC privacy issue. Alternatively, this issue can also be mitigated by using a randomly generated interface ID (RFC 4941 – Privacy Extensions for Stateless Address Auto-configuration in IPv6) [1] that changes over time, making it difficult to correlate activity while still allowing network defenders requisite visibility

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#37

Post by wmf »

jeroenhd wrote: post #33
yonz wrote: post #13

Earlier quoted context omitted.

In the context of network intrusion detection and providing secure online services, I agree with you. However, if this guidance is trying to influence government office routers and internet gateways... It's a different story. A transition from IPV4 to IPV6 creates a new per device tracking capability that leaks internal network structure. This in my opinion is worse than internal domains getting certs from Let's Encr…

> A transition from IPV4 to IPV6 creates a new per device tracking capability that leaks internal network structure. I doubt it. Your load balancers will be the only addresses that will be addressable anyway. Your IPv4 load balancers will also be "leaking" IP addresses.

You're thinking of the server side, not clients.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#38

Post by CorrectHorseBat »

wjholden wrote: post #31
yonz wrote: post #9

Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports. I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall setti…

I'm not so concerned. For one thing, a /64 issued to a house is a pretty daunting search space for the scanning worms of yesterday. Another, computers today do come with firewalls that are enabled by default and tricky to disable. Third, the industry really had to start taking memory safety and attack surface seriously after the Blaster/Sasser/MyDoom days. We see another article here on HN every week about another co…

>For one thing, a /64 issued to a house is a pretty daunting search space for the scanning worms of yesterday.

/64? You should be getting at least a /56

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#39

Post by throw0101c »

wjholden wrote: post #31
yonz wrote: post #9

Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports. I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall setti…

I'm not so concerned. For one thing, a /64 issued to a house is a pretty daunting search space for the scanning worms of yesterday. Another, computers today do come with firewalls that are enabled by default and tricky to disable. Third, the industry really had to start taking memory safety and attack surface seriously after the Blaster/Sasser/MyDoom days. We see another article here on HN every week about another co…

> For one thing, a /64 issued to a house is a pretty daunting search space for the scanning worms of yesterday.

Some math to illustrate this:

* IPv4 has 2^32 addresses

* 2^32 ≈ 4 billion

* in mathematics, a^x = a^(y+z) = a^y * a^z

* so: 2^64 = 2^32 * 2^32

* therefore: 2^64 = four billion IPv4 Internets

One IPv6 subnet can fit many, many entire IPv4 Internets.

Re: NSA CSI IPv6 Security Guidance (2023) [pdf]

#40

Post by throw0101c »

roamerz wrote: post #21
johnnyapol wrote: post #12

Earlier quoted context omitted.

IPv6 not having NAT doesn’t make it incompatible with stateful firewalls. You can still have routers doing drop inbound by default.

It goes beyond that. With IPV4 you have the further protection of private subnets not even routing across the public internet - it’s broke by default, no configuration necessary. Your attack surface is primarily your firewall which admittedly might be an easy target - but not as easy as an unprotected Windows box.

> it’s broke by default, no configuration necessary.

Which is why all sorts of software needs to deal with bullshit like STUN, TURN, etc, to get peer-to-peer connections working. There has to be all sorts of address discovery.

* https://en.wikipedia.org/wiki/NAT_traversal

And even that won't work once you get into CG-NAT with tends to have two layers of NAT.

How much of the centralization of the Internet has occurred because people can't just talk to each other (by simply firewall hole punching via UPnP/PCP)?

Post reply on HN