News for hackers. Stuff that matters.

A comment on I spent a week without IPv4 to understand IPv6 transition mechanisms. Parent comment

Re:I spent a week without IPv4 to understand IPv6 transition... by jbverschoor on Monday March 06, 2023 @08:14PM (#35050220)
Let’s say the firewall isn’t yours. Or the firewall needs to be replaced and is more open by default until you secure it. It’s also easier to map which kind of devices and how many you have..
[ Parent | on HN ]
Re:I spent a week without IPv4 to understand IPv6 transition... by stephen_g on Monday March 06, 2023 @10:22PM (#35051151)
In any case, your endpoints really do need to be reasonably secure in themselves - especially if the firewall isn’t yours as then you are probably sharing the network with other devices on the inside of the network that can attack you directly, and even if not, it just takes one device being compromised and somebody has full inside access to the network, with the firewall not being able to do much…
[ Parent | on HN ]
Re:I spent a week without IPv4 to understand IPv6 transition... by jbverschoor on Tuesday March 07, 2023 @02:38AM (#35052643)
Good luck with your home automation, printer, and tv
[ Parent | on HN ]
Re:I spent a week without IPv4 to understand IPv6 transition... by BenjiWiebe on Tuesday March 07, 2023 @09:04PM (#35064267)
NAT doesn't protect you from things inside your LAN either. Where you have NAT+firewall with IPv4 now, you'll need a firewall with IPv6.
[ Parent | on HN ]
Re:I spent a week without IPv4 to understand IPv6 transition... by viraptor on Monday March 06, 2023 @10:51PM (#35051329)
The same comment applies to ipv4. Port bindings accessible from outside by accident, misconfigured upnp, SIP-ALG with vulnerabilities, various other router issues. "What if my firewall is broken" is not a new ipv6 consideration.
[ Parent | on HN ]
Re:I spent a week without IPv4 to understand IPv6 transition... by jbverschoor on Tuesday March 07, 2023 @02:42AM (#35052664)
It’s not, but the “beauty” of NAT is that you have an extra line of defense because of its limitations. Port bindings and upnp are far less impactful and less common.
[ Parent | on HN ]
Re:I spent a week without IPv4 to understand IPv6 transition... by viraptor on Tuesday March 07, 2023 @03:07AM (#35052843)
I'm not talking about preconfigured port mapping. I'm taking about bindings as in entries in NAT. That happens on every outbound connection and has stateful processing. We're still finding issues with it, like the relatively recent NAT Slipstream vulnerability.
[ Parent | on HN ]