IPv6 networks do apparently get probed
utcc.utoronto.ca
utcc.utoronto.ca
So they introduced AZ IDs https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-re... which create a per-account randomized mapping of region to actual availability zone.
And it's logical that we do so. We clean up, we put things in corners, we sort things. So I suppose many people set static IPv6 addresses at the bottom of their /64?
ISP gives me /64 and I configure my router at ::1: in WarCraft I orcs voice We are under attack!
There is really no difference between setting anything on "::3, ::5, ::7, ::a, ::b, ::c, ::f" for IPv6 and for .1, .2, .3, .10, .11 on IPv4. Using these addresses do not lower you security in any way compared to IPv4.
The real difference is what with IPv4 you can just scan the whole /24 in seconds, while with IPv6... it's not seconds at least.
I'm paying out of my nose for a /17
And my takeaway here is that "Security through Obscurity" isn't actually that secure is it?
> Certainly one should have firewalls and so on
Just because every device has a public IP doesn't mean every device is available publicly. Your public little IPv6 network still goes through a router and that device can control the flow of traffic, through routing and firewalling.
This whole read really just feels like someone discovering IPv6 for the first time and fundamentally not understanding basic networking.
If you have an IPv4-only network, you still have firewall and routing. This is what protects your router, allows ports to be forwarded, etc.
Literally nothing changes. You still need routing, just not the NAT/PAT part of it. You still need a firewall.
Now if you pin a ::1/64 to a machine or lets say some low addresses that you did because you remember them easily (or even if you pin any address lets say thats /64) you are now no longer using the obscurity part. This means your IPv6 /64 is basically just IPv4 now for that one machine.
The whole problem here is that you got a public IP (because now thats hard for home networks with ipv4). It's going to behave like any public IP, get targeted by attackers to see if some port is open or if there are any issues with security. IPv6 doesn't bring any advantage here unless you actually use its features like SLAAC and rotating IPs.
By any stretch of the imagination.
Very purposeful
This is fundamentally not a part of IPv6. It was an extension added later for privacy, but doesn't really accomplish too much in that regard except for the simplest of detection. My home address space is a /48. And when do some really simple subnet math on my IPs, you can easily identify my addresses.
And again, the point is, just because you live out in the country, doesn't mean you shouldn't lock your doors.
Even though right now it's impossible to feasibly to even really scan a /64, that may not be true in a week.
Not quite true. The original braindead design embedded your MAC address into your public IPv6. So that all those nice companies can uniquely identify you _everywhere_.
What you are talking about is RFC 4862. The SLAAC part of ipv6, which is auto-configuration.
What I am talking about is RFC 4941:
Privacy Extensions for Stateless Address Autoconfiguration in IPv6
Which is pretty close to:
"extension added later for privacy"
4862 < 4941
Nobody is tracking 48 bits out of 128 bits and tying that to a specific user.
Pretty simple browser fingerprinting will get you much closer.
Not to mention that you know MAC addresses aren’t unique right. They only have to be unique on the same L2. And with some shipping logistics, you can make sure this is usually true.
I say this as a person who received a case of Intel NICs back in the day and every MAC was the same.
Of course they would, if it was how everyone still did addresses! It's a super easy to access permanent ID.
> aren’t unique
Rarely. That's hardly enough trouble to make trackers not use it.
Erm... Whut? Nobody is tracking it right now because privacy extensions make it useless. You can bet that advertisers would have used it otherwise. Imagine being able to track where people move simply by using the freaking IP address.
> Not to mention that you know MAC addresses aren’t unique right.
For intents and purposes of advertisers they are unique. Duplicate MACs are probably not even a 0.0001% of all MACs.
I love it when people just make up numbers with zero backing.
You know MACs only HAVE to be unique on the same L2 segment right?
So with every device that has MAC addresses (including every Bluetooth or WiFi device), ESP32s, home assistant type stuff, all which have usually 2 or more MACs, do you really think it makes sense for a manufacturer to use a MAC once and never again?
No. It’s called manufacturing and shipping logistics. It’s far easier than what you suggest.
As far as your made up stat here, I should play the lottery because it’s happened at least two times over the course of a 30 year career.
In 2006, I was part of a team building up a data center, and each server needed 4 NICs for iscsi speed and redundancy.
Two cases out of 10, something like 40 or 50 NICs were identical to each other. The only reason we noticed is because this job required meticulous asset tracking. My guess is because we had ordered so many NICs, the supplier had needed to hunt a little to fill the order.
The second time was when I ordered a lot of ProBooks off eBay for hackintoshing back around 2012. Again, at least two of them had the same physical MAC burned into the motherboard. And I’m guessing it’s because about half of them came from Florida and the other half came from Vancouver.
I’m just telling you, MAC addresses aren’t as unique as you are trying to suggest because they don’t need to be.
Well, can YOU provide references to duplicate MACs?
I worked all my career with probably tens of thousands of devices, often in large broadcast domains, and I have never seen a duplicate MAC. Ever.
You'd be surprised.
I allow cookies from Youtube for better preference recommendations, but am not logged in. You'd think that that would give me useful ads.
However, I am with an ISP that services both the provinces of Ontario (English) and Quebec (French), and when my IP cycles if I reboot I sometimes I get an IP that is geo-located to Quebec and so I suddenly I get French-only ads until the new router reboot.
On the labels too, or just in the EEPROMs?
And both labels and burned in
Whether IPv4 or IPv6, it's trivially easy to grab a new one. And unless you are willing to start blocking huge swathes of the world and ultimately legitimate traffic, you do other things.
Just like people advertising not broadcasting SSID, or changing the SSH port, this is just a false sense of security.
Obscurity isn't security, but hiding still makes you harder to find. In other words the lock is just as good or bad as it always was but a lot less people are going to jiggle the handle.
Changing default service ports is a good thing and is one of the reasons everyone should be in favor of software supporting SRV/SVCB records so services can be hosted on arbitrary ports while still being accessible with a plain DNS name everyone's used to using.
That shouldn't be lumped in with pure idiocy like disabling SSID broadcast or believing that IPv6 inherently exposes your network to the world.
Ironically disabling SSID beaconing on wireless APs actually results in clients configured to use those networks broadcasting looking for them wherever they go, for those who want to hide a network it's the literal opposite of their desired result.
As you said, only the low effort bots scan the standard ports.
But venture anywhere off the beaten path, and a place like shodan is the most benevolent of those kind of places, and it still takes about an hour for your IP and newly opened SSH port to be indexed.
The point is it takes a script kiddy about 5 minutes to scan the whole 4 billion IPs for your port 22 server.
It takes about 90 seconds for the fact that you opened up a random high numbered port that is an SSH service to show up on the list of people that are probably exponentially more intelligent than the normal script kiddy scanning the internet
This does not make you more or less likely to be hacked just for having SSH open. But hey,go go gadget whatever.
A) The comment you responded to didn't claim you're less likely to be hacked, they said it cuts down on log spam.
B) When you talked about just becoming of more interest to non-benevolent places, was that not a suggestion you're more likely to be hacked? Then I think you phrased that pretty badly.
And
> elite hacking crew
It was your comment. Not to mention the blog post to which I originally responded to said “ you might not want to put your servers on low numbered IPs “
Step 1, know the difference between UDP and TCP and even a few of the implications
Yep. Party on
You said "the minute you change the port, you just become of more interest" and then talked about places that are less "benevolent" than shodan.
Is being of "more interest" to less "benevolent" places supposed to imply an increased risk of being hacked, or not?
How does anyone know I changed the port to find me more interesting?
> But venture anywhere off the beaten path, and a place like shodan is the most benevolent of those kind of places, and it still takes about an hour for your IP and newly opened SSH port to be indexed.
I just checked the first VoIP server I ever deployed with a non-standard SIP port. It's been up for a decade and provides public facing services so its accessible to the global internet minus whatever systems have found their way in to our denylist over the years. It's not listening on the standard port 5060, but the port we chose is not particularly uncommon as it's a recommended alternative in the documentation of the platform we're using. Shodan has found this server and scanned it repeatedly over the years, but it still has no idea what port SIP is listening on. It only sees 80/443 for the public-facing web UI.
The thing about non-standard ports is that unless your service identifies itself with a banner or similar upon connection the attacker has to open with a valid request to receive a response. If someone connects to my SIP server and sends a HTTP GET, they're not going to get a response despite how similar SIP and HTTP are. They have to connect to the non-standard SIP port and then send a valid SIP message to identify my service.
I responded to this elsewhere.
> I just checked the first VoIP server I ever deployed with a non-standard SIP port. It's been up for a decade and provides public facing services so its accessible to the global internet minus whatever systems have found their way in to our denylist over the years.
And that is what is called “UDP”. Also the “spray and pray” of the networking world. Meaning, you literally don’t get a response.
Fundamental difference.
> The thing about non-standard ports is that unless your service identifies itself with a banner or similar upon connection the attacker has to open with a valid request to receive a response.
Which is exactly what ssh does and the point of why comparing the two and obscuring the port/IP makes no difference.
554 server.local Mail server not ready
SSH-2.0-
> Fundamental difference.
And that is what's is called a bad assumption. SIP also uses TCP, and these days it's pretty common for end-user facing services because of both NAT being terrible and more data being crammed in to messages leading to fragmentation issues with UDP. This particular system's services facing the open internet are 100% TCP.
> Which is exactly what ssh does and the point of why comparing the two and obscuring the port/IP makes no difference.
Yes, SSH does have a banner by default, but it's possible to change that behavior.
Sure, if an attacker is specifically targeting your IP and has some ideas what services you might be running then it's hard to entirely hide, but when you're just another system on the internet no one's going to put the effort in to look for services on odd ports.
I have dozens of systems out there running SSH on a port that's not 22 as well and most of them have never logged a SSH ban on fail2ban after years of operation.
The ones that listen on port 22 on the other hand log literally thousands a day.
Exactly the opposite. If you did change the default than it can signal what you are harder to break. Malware owners aren't interested in 'more interesting' addresses or machines, they are interested in machines which can be easily identified to be susceptible for exploiting. In the end their ware is a cheap computing resources.
If you ever run machines in a diverse environments then you could had seen by just a simple 'There were N failed attempts since last logon' what the machines with a non-standard SSH port receive way less attention than the machines on the defaults.
Sure next step can be going for a port scan, but how big scan do you want to do before fail2ban or similar will lock you out?
He's posting his learning and realizations as he goes.
He often has posts of style "I thought X, but then I noticed certain things (in the logs), and after more digging it's actually Y." Or "Last time I checked things were A, but at some point things changed and now they're B, and going into the release notes it appears to be about at about C."
Now your logs will show only deliberate attacks on you, not the mass probing spam.
And you can't setup neither routing nor firewalling because of random ip addresses.
There are two types of people: 1) excited about ipv6 2) actually managing networks
Or you can be smart and "easily" address such probing attacks in your FW rules... https://nvd.nist.gov/vuln/detail/CVE-2024-50252
The same technique can be used for IPv4. Disable both and become invulnerable to probing!