TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

NSA CSI IPv6 Security Guidance (2023) [pdf]

64 点作者 codesniperjoe超过 2 年前

5 条评论

simoncion超过 2 年前
From the recommendations document:<p>&gt; The assigned IPv6 address incorporates media access control (MAC) address information from the network interface and may allow for host identification via interface ID, network interface card, or host vendor.<p>How long has it been since NSA has looked at generally-available OSs with IPv6 support? IPv6 &quot;Privacy Addresses&quot; are a thing that&#x27;s on-by-default everywhere (and a damn thorn in my side). SLAAC has been using a identifier that&#x27;s a combination of a randomly-generated ID and the subnet that the address is being generated for rather than the MAC address of the NIC for address generation for ages. (This is yet another thing that I revert back to the old behavior.)<p>They go on to recommend disabling SLAAC and using only DHCPv6. Does NSA know something exploitable about common DHCPv6 implementations that we don&#x27;t? ;)<p>&gt; ...a dual stack DNS implementation may need to support both A and AAAA records.<p>It&#x27;s weird to say &quot;dual stack DNS implementation&quot;. DNS servers can store A and AAAA records, regardless of whether their host is doing &quot;dual stack&quot; addressing or not. (If yours cannot, then by golly, you fucked up when you wrote your DNS server.)
评论 #34482300 未加载
评论 #34484019 未加载
pm2222超过 2 年前
Piece of advice: setup a dedicated firewall’d vlan for iot and obsolete Lin&#x2F;win devices, regardless of v4 or v6.
评论 #34485532 未加载
sn0wf1re超过 2 年前
Interesting that they prefer dual stack to tunnel. I would have thought running your own 6to4 at the network edge would have been more preferential.
评论 #34481574 未加载
codesniperjoe超过 2 年前
TLDR: Avoid it if you can!
评论 #34482044 未加载
评论 #34481540 未加载
评论 #34481584 未加载
评论 #34481569 未加载
评论 #34481675 未加载
yonz超过 2 年前
Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports.<p>I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall settings. [UPDATE: or the router drops incoming IPV6 connections w&#x2F; it&#x27;s firewall]<p>Just think about how many windows machines out there have Remote desktop enabled but were only safe because they were not publicly accessible or the hospital machines that are still running windows XP. God help us.
评论 #34481802 未加载
评论 #34482056 未加载
评论 #34481680 未加载
评论 #34481934 未加载
评论 #34481839 未加载
评论 #34481837 未加载
评论 #34485893 未加载
评论 #34482540 未加载
评论 #34481996 未加载