News for hackers. Stuff that matters.
Re:AT&T updates firmware to block access to 1.1.1.1 by masklinn on Thursday May 03, 2018 @07:51AM (#16985076)
So it's not just malice but doubly so: they used an IP they didn't have the rights to and they're now blocking proper users of it.
Re:AT&T updates firmware to block access to 1.1.1.1 by simias on Thursday May 03, 2018 @11:10AM (#16986713)
Let's not act like using a "probably not in-use IPv4 but we can't really be sure" is a crime against humanity. If you're designing any kind of large scale system over the internet you end up hitting the problem sooner or later (like how some VPN solutions started using 5.x.y.z to be sure not to clash with LAN IPs for instance). The real solution of course would be to switch to IPv6 where any vendor can claim some private address anywhere without any realistic risk of collision but we all know that we're not ready for that yet.

By their own admission CF receives a ridiculous amount of garbage traffic at this IP, it was not absurd for AT&T engineers in the past to thing "well, we need an IP that we can be reasonably sure nobody is going to use and is never going to conflict with anything on any network, 1.1.1.1 seems reasonable". Seeing everybody in this thread jumping into conspiracy theories instead of the much more likely configuration issue is a bit disappointing for a community that's supposed to understand technology.

Re:AT&T updates firmware to block access to 1.1.1.1 by arbitrage on Thursday May 03, 2018 @12:34PM (#16987452)
> it was not absurd for AT&T engineers in the past to thing

That is an utterly unreasonable conclusion.

The same logic resulted in Y2K, which was generally a huge waste of time, money, and resources.

The same logic has resulted in the anemic adoption of IPv6, which is NOT a correct solution, because it doesn't work properly for large swaths of the public.

The correct answer always was, and will continue to be, to use internal routes for internal routing, and external routes for external. Clashes with your LAN? Too fucking bad.

This sort of pushing out of externalizes onto the customer results in the same exact outcome anyway: customer gets screwed.

The customer always gets screwed. Don't rationalize the incompetence of engineers who should know better, and corporate execs who don't give a fuck.

Re:AT&T updates firmware to block access to 1.1.1.1 by denkmoon on Friday May 04, 2018 @02:38AM (#16992644)
Would you feel the same way if AT&T started blasting static on "unused" frequencies they don't have the right to?

Do that and the FCC will come down on you like a tonne of bricks, and I feel that is absolutely justified.

Re:AT&T updates firmware to block access to 1.1.1.1 by eeeeeeeeeeeee on Friday May 04, 2018 @12:32PM (#16995872)
It's not reasonable. We have RFCs for a reason, which define which subnets can be used for public use, and which can be used internally. This has been written down for a long time and anyone working at ATT that can make these kind of decisions should know better.
Re:AT&T updates firmware to block access to 1.1.1.1 by jamespo on Thursday May 03, 2018 @07:53AM (#16985084)
"Never attribute to malice that which is adequately explained by stupidity"
Re:AT&T updates firmware to block access to 1.1.1.1 by jjoonathan on Thursday May 03, 2018 @10:10AM (#16986175)
Hanlon's razor is dangerous. "Playing stupid" and its adult cousin "plausible deniability" trivially exploit the razor under adversarial conditions.

That said, we agree on the probable cause of this particular issue.

Re:AT&T updates firmware to block access to 1.1.1.1 by paulie_a on Thursday May 03, 2018 @08:01AM (#16985132)
Except when it is AT&T. Then you can just assume it was more malicious than you even originally thought
Re:AT&T updates firmware to block access to 1.1.1.1 by jdironman on Thursday May 03, 2018 @08:40AM (#16985402)
Equal parts malice and stupidity.
Re:AT&T updates firmware to block access to 1.1.1.1 by Aissen on Thursday May 03, 2018 @08:14AM (#16985232)
It's stupidity, then malice as a cover-up.
Re:AT&T updates firmware to block access to 1.1.1.1 by rando444 on Thursday May 03, 2018 @08:24AM (#16985304)
No, that's not what malice means.

Unless you're actually trying to say that AT&T has a grudge against Cloudflare and are only doing this to harm their company.

This is something more like negligence or gross negligence.

Re:AT&T updates firmware to block access to 1.1.1.1 by arbitrage on Thursday May 03, 2018 @12:35PM (#16987466)
> only doing this to harm their company

That's not wholly unthinkable as far as AT&T is concerned. They're historically a bad player.

Re:AT&T updates firmware to block access to 1.1.1.1 by nickysielicki on Thursday May 03, 2018 @01:49PM (#16988112)
AT&T regularly assigns my phone an IP in 10/8, instead of using 100.64/16 as they should [1]. IIRC, they used to even have the gall to use 172.16/12, which is crazy when you consider the amount of corporate networks using those addresses.

This caused issues where my phone would try to get on wifi, but the DHCPACK would be sent along on the existing interface rather than the one coming up. So the wifi icon was continually bouncing back and forth. My only solution was to go into airplane mode and bring the cellular down before bringing the wifi up. I don't think Android ever addressed this issue, and I had to switch around the entire subnet to avoid the conflicts.

If I knew enough about how Android worked, I'd write a patch to have all android interfaces in their own linux netns, with the dhcp client exec'd in that netns, that way you'd never have to worry about this sort of conflict.

[1]: https://tools.ietf.org/html/rfc6598

Re:AT&T updates firmware to block access to 1.1.1.1 by isaack on Friday May 04, 2018 @02:35AM (#16992628)
A carrier deploying NAT might not be using CGNAT, and hence, in compliance with the spec, decide not to use the 100.64/16 space.

One requirement of CGNAT, for instance, requires that the carrier's router be able to handle "address crashes". [1]

[1] https://tools.ietf.org/html/rfc6598#section-4

Re:AT&T updates firmware to block access to 1.1.1.1 by nickysielicki on Friday May 04, 2018 @04:17AM (#16993000)
I think it says that you can use it even if you're not doing CGNAT, provided that you are a service provider.

> In particular, Shared Address Space can only be used in Service Provider networks OR on routing equipment that is able to do address translation across router interfaces when the addresses are identical on two different interfaces.

(edit: no, very clearly, "Devices MUST be capable of performing address translation when identical Shared Address Space ranges are used on two different interfaces." )

Also, is it wrong to assume that cellular networks are able to handle "address crashes" due to the inherent centralization that comes as a result of having clients maintain the same IP (and same connections) as the device hops from tower to tower? Maybe I don't understand the topics at play here...

Re:AT&T updates firmware to block access to 1.1.1.1 by netsec_burn on Thursday May 03, 2018 @09:58AM (#16986064)
They used an IP that was originally reserved for what reserved IP's are used for. Now that Cloudflare convinced 1.1.1.1 to be released, I'm sure AT&T wants service continuity and had to make this decision, which is well within their rights as an ISP. I dislike AT&T so if this was entirely opinion-based, I would be against them here. But this is a knee-jerk reaction to a well justified decision.
Re:AT&T updates firmware to block access to 1.1.1.1 by qmarchi on Thursday May 03, 2018 @10:13AM (#16986199)
Except that it wasn't classified as a private IP address. They should've use something like 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.

The 1.0.0.0/8 range was owned by IANA from _1981_ up until 2010, when it was transfered to APNIC. (The 2.0.0.0/8 range was also owned by IANA until 2010, thentransfered to RIPE NCC).

If you want to get technical, use of the space could be construed as theft.

As for the continuity issue, it was stated that it was an old device, so they have no responsibility to continue supporting it, and considering the age of the device in question, it may not be able to connect to the existing network.

Re:AT&T updates firmware to block access to 1.1.1.1 by nickysielicki on Thursday May 03, 2018 @02:00PM (#16988202)
They should be using 100.64/10

https://tools.ietf.org/html/rfc6598

Re:AT&T updates firmware to block access to 1.1.1.1 by unethical_ban on Thursday May 03, 2018 @10:01AM (#16986093)
It was not ever a reserved IP address in the proper sense. They should have used something from RFC1918.
Re:AT&T updates firmware to block access to 1.1.1.1 by juliangoldsmith on Thursday May 03, 2018 @10:19AM (#16986250)
Any sane gateway would block any access to anything from RFC1918, and using a private IP address for a public service is a bad idea in general.
Re:AT&T updates firmware to block access to 1.1.1.1 by unethical_ban on Thursday May 03, 2018 @10:44AM (#16986470)
Fair enough, if it was traversing public (non-ATT) networks without a tunnel.
Re:AT&T updates firmware to block access to 1.1.1.1 by juliangoldsmith on Thursday May 03, 2018 @03:13PM (#16988910)
It would be reasonable for AT&T equipment to block any private IP traffic outside a customer's private network by default. That's ignoring that AT&T's network is public, and it wouldn't make sense to use a private IP for a service they provide.

Reversing that would likely require AT&T to make a firewall change to literally every piece of equipment they operate, and that's assuming that they don't use the blocks internally. That, and I can guarantee that some customer, somewhere, would be using whatever IP they chose.

Re:AT&T updates firmware to block access to 1.1.1.1 by masklinn on Thursday May 03, 2018 @10:17AM (#16986230)
> They used an IP that was originally reserved for what reserved IP's are used for.

I'm eagerly awaiting your evidence for this statement, which to my knowledge is entirely incorrect.

So far's I know, existing uses of 1.1.1.1 have almost universally been illegitimate (e.g. captive portals, internal-ish services, …)

Re:AT&T updates firmware to block access to 1.1.1.1 by criddell on Thursday May 03, 2018 @12:14PM (#16987248)
I'd be more inclined to agree with you if AT&T were to come out and say what the problem is along with assurances that they are working on rectifying the situation and expect to have 1.1.1.1 available in X days.
Re:AT&T updates firmware to block access to 1.1.1.1 by Wheaties466 on Thursday May 03, 2018 @08:00AM (#16985123)
and theres nothing we can do about it.
Re:AT&T updates firmware to block access to 1.1.1.1 by aesh2Xa1 on Thursday May 03, 2018 @08:30AM (#16985342)
If you own a device that is supported by a custom ROM such as Lineage OS then you can flash that and not worry about this change.

Otherwise, you can purchase a different device, preferably a Nexus/Pixel, or at least one that's unlocked. If that's impossible for you then, yes, you're stuck with AT&T's "best efforts."