Zero-click Windows TCP/IP RCE impacts all systems with IPv6 enabled, patch now

Re:Zero-click Windows TCP/IP RCE impacts all systems with IP... by exabrial on Friday August 16, 2024 @10:27AM (#41266756)

I would recommend just disabling ipv6 completely. There is zero need for every machine on the internet to be able to know your computer exists. 15 years ago I had a different opinion, I thought the technology was superior and really well thought out. Today, when Silicon Valley wholesale selling your personal life away for advertisers, I recommend doing the exact opposite of whatever they tell you to do. In this case, those pushing ipv6 the hardest are the Googles/Facebooks/etc.

[ Parent | on HN ]

Re:Zero-click Windows TCP/IP RCE impacts all systems with IP... by ndriscoll on Friday August 16, 2024 @01:07PM (#41268242)

Every computer on the Internet is not able to know my computer exists. My router allows established (i.e. originally outgoing) connections/flows and drops anything else without even an ICMP reply, same as ipv4. If I want to run a service though, then I just add a rule to allow traffic on that port to my computer's stable address.

ipv6 and global addressability allows p2p services to work, which is necessary to get away from centralized service providers like google/facebook/etc.

[ Parent | on HN ]

Re:Zero-click Windows TCP/IP RCE impacts all systems with IP... by patrakov on Friday August 16, 2024 @01:23PM (#41268385)

> If I want to run a service though, then I just add a rule to allow traffic on that port to my computer's stable address.

Problem: in most consumer firewalls, and even in OpenWrt, there are simply no words to express this. I don't know what my IPv6 prefix would be next time my modem reconnects, therefore, I don't know which IPv6 address my computer would then get. However, firewall configuration tools are built under the assumption that static IPs are the only existing ones. I just cannot write "the delegated prefix from the WAN plus :d63d:7eff:fed9:0a39".

[ Parent | on HN ]

Re:Zero-click Windows TCP/IP RCE impacts all systems with IP... by ndriscoll on Friday August 16, 2024 @01:27PM (#41268415)

I agree that is an obvious missing functionality. It's never affected me because anywhere I've lived I've always ended up with stable prefixes/addresses (both ipv4 and v6) for years, but it's obviously something consumer firewalls need. Fortunately that's a much easier problem to fix (replace or update the one device) than trying to get everyone to use ipv6 in the first place.

[ Parent | on HN ]

Re:Zero-click Windows TCP/IP RCE impacts all systems with IP... by tcfhgj on Friday August 16, 2024 @08:45PM (#41271564)

The most widespread consumer routers in Germany handle this without any issues.

[ Parent | on HN ]

Re:Zero-click Windows TCP/IP RCE impacts all systems with IP... by patrakov on Saturday August 17, 2024 @02:15AM (#41272408)

Can you share a screenshot of the relevant firewall rule that allows access to one port on one IPv6 address behind the router and doesn't break when the ISP assigns a different delegated prefix?

[ Parent | on HN ]

Re:Zero-click Windows TCP/IP RCE impacts all systems with IP... by tcfhgj on Thursday August 22, 2024 @04:43AM (#41318078)

a bit late:

https://ibb.co/XFtZg8T

Have been using this for years

[ Parent | on HN ]

Re:Zero-click Windows TCP/IP RCE impacts all systems with IP... by patrakov on Friday August 23, 2024 @10:53AM (#41329532)

Better late than never. Thanks! And indeed, this looks like a well-thought-out (with an explicit field for the IPv6 interface ID, as opposed to the full address) approach to IPv6 forwarding and firewalling.

[ Parent | on HN ]