https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-38063
If you have the August 13, 2024—KB5041580 update. You're good.
I was mid-proposal. She said, "Yes, as long as this call doesn't e..." Thanks a lot, Microsoft!
People always talk about Arch. I wonder what people think of other oses and the people who run them lol. Like I'm a bearded Debian user (closer to the look of the Dilbert comic unix guy).
I think those are really the only two options when it comes to Linux (that's why I main Windows 10). Hacker man or Dilbert.
Well, I'd like to think I'm just a normal looking dude who blends in in a crowd. I just use Debian 'cause I got sick of Windows' shit a long time ago, like, back when telemetry was introduced in Windows XP. That was the first sign of things to come. When we would start losing control of our own OS and computers and losing privacy as well. I shouldn't even notice the OS when I do normal computer shit, and I want to keep it that way. Those who are old enough to have grown up with PCs in the 90s get what I'm saying. We had control.
Ah man, you toughed it out clear into XP? Win2k was the last version I ever ran here. That whole shit of "oh you inserted a USB drive, please reboot" really got on my nerves. Plus trying to write code and having Windows crash once a week.
having Windows crash once a week
Several times per day sometimes if you came from the Win9x line like us normies had to use and not NT.
I wish I could find something to help me convert my dell laptop into a Debian device. It would be all sorts of fun.
Ive had luck with puppy on older laptops. I have one running on a 2008 machine. Works ok.
I just like my build working. What's wrong with that?
So it took a little while before I could run stable diffusion, I can now!
I run Gentoo, but I'll have to wait until all this is finished compiling before I can move on.
If Linux is so great, then explain why I can't even install this latest security patch for Windows on my Tumbleweed??
Great, it worked!
But now I have ads on my desktop, tiler, and all the menues feature 'sponsored' content instead of my shit.
As a networking nerd, I am endlessly frustrated with how many otherwise smart people are just 'fuck ipv6 lmao'
Giving me goddamn flashbacks to this https://www.youtube.com/watch?v=v26BAlfWBm8
IPv6 genuinely made some really good decisions in its design, but I do question the default "no NAT, no private network prefixes" mentality since that's not going to work so well for average Janes and Joes
No NAT doesn't mean no firewall. It just means that you both don't have to deal with NAT fuckery or the various hacks meant to punch a hole through it.
Behind NAT, hosting multiple instances of some service that uses fixed port numbers requires a load-balancer or proxy that supports virtual hosts. Behind CGNAT, good luck hosting anything.
For "just works" peer to peer services like playing an online co-op game with a friend, users can't be expected to understand what port forwarding is, let alone how it works. So, we have UPnP for that... except, it doesn't work behind double NAT, and it's a gaping security hole because you can expose arbitrary ports of other devices if the router isn't set up to ignore those requests. Or, if that's not enough of a bad idea, we have clever abuse of IP packets to trick two routers into thinking they each initiated an outbound connection with the other.
can you tell me if any device in an IPv6 LAN can just assign itself more IP v6 adresses and thereby bypass any fw rule?
IPv6 has two main types of non-broadcast addresses to think about: link-local (fe80::) and public.
A device can self-assign a link-local address, but it only provides direct access to other devices connected to the same physical network. This would be used for peer discovery, such as asking every device if they are capable of acting as a router.
Once it finds the router, there are two ways it can get an IP address that can reach the wider internet: SLAAC and DHCPv6. SLAAC involves the device picking its own unique address from the block of addresses the router advertises itself as owning, which is likely what you're concerned about. One option for ensuring a device can't just pick a different address and pretend to be a new device is by giving it a subset of the router's full public address space to work with, so no matter what address it picks, it always picks something within a range exclusively assigned to it.
Edit: I butchered the explanation by tying to simplify it. Rewrote it to try again.
In most cases, the router advertises the prefix, and the devices choose their own IPv6. Unless you run DHCPv6 (which really no-one does in reality, I don't even think android will use it if present).
It doesn't allow firewall bypass though, as the other commenter noted.
DHCPv6 is very much in use with large ISPs. SLAAC only lets you get a single /64 (one network) from the ISP, but if you use DHCPv6, which is also provided ISP side, you can often request a /60 to get you 16 networks to use. Also, DHCPv6 doesn't base the IPv6 address off the MAC address like SLAAC does, so it is better for device privacy.
Why Android does not support DHCPv6 is beyond me. It's honestly quite ridiculous as it makes configuring LAN-side DNS and other things a lot easier.
Dhcpv6-pd is used by isps for prefix delegation, which most routers support now (not so when my isp first started with it).
But for advertising prefixes on a lan most networks use router adverts.
They're different use cases though.
Yeah, I butchered my answer by trying to simplify the process. I rewrote it in a hopefully more accurate but still simple to understand way.
Yep, it's all good. In my opinion, IPv6 routers should just be dropping incoming connections by default. If you want to run services you give your machine a static IPv6 and open ports on that IP/port specifically. It's actually easier than NAT because you don't need to translate ports and each IP can use the same ports (multiple web servers on 80/443).
I do agree that the average joe is going to expect NAT level security by default and that would provide that.
ok. thank you. stuff like this just made me wonder: https://en.avm.de/service/knowledge-base/dok/FRITZ-Box-7590/573_Configuring-IPv6-in-the-FRITZ-Box/
for linux etc they suggest du enable dhcpv6 and i cant figure out where they adress this in their firewalls. still learning.
Best thing to do to test the firewall is run some kind of server and try to connect to your ipv6 on that port.
Like I've said in other posts, routers really should block incoming connections by default. But it's not always the case that they do.
Unless you run DHCPv6 (which really no-one does in reality)
Question for you since I have very little real world IPv6 experience: generally you can provide a lot of useful network information to clients via DHCP, such as the DNS server, autoconfig info for IP phones, etc. how does a network operator ensure that clients get this information if it's not using DHCPv6?
You can include some information in router advertisements, likely there will be rfcs for more. Not sure of the full list of stuff you can advertise.
For sure I'm quite sure I had dns servers configured this way. I'll check when not on a phone to see what options there are.
DHCPv6 is very definitely used with ipv6 and isps, as DHCPv6-PD is needed anyway to send prefix allocations to the router
DHCPv6 does the same thing DHCP does, just for v6 addresses. This includes pushing domain suffix and dns servers.
There is also Router Advertisement, which tells the discovering client that it is a router, what the prefix is, if there is a DHCPv6 server, and what the DNS is. As an alternative to DHCPv6, the client can set their own address based on the combination of the prefix and their MAC address, the SLAAC address. The way IPv6 routing tables are built, the router can always find a route by asking upstream on the address, and upstream only has to forward downstream on an address.
Honestly, I think most fear of IPv6 is just borne out of ignorance and assigning their understanding of IPv4 onto IPv6 and making assumptions.
assigning their understanding of IPv4 onto IPv6 and making assumptions.
This is also what makes it more difficult to learn, unfortunately.
That's true. But there are not many differences. It's just, the differences there are, are crucial to understanding it.
so back to the beginning of this thread: ipv6 in home lans is likely to be unsafe due to the defaults in some/many/most routers? and those ipv6 devices can in these szenarios escalate their permissions be spawning new ip adresses that would overcome lazy output fw rules?
thanks for all the explaining here so far!
or if i upload a malicious apk to some smartTV and have a it spawn a dhvpv6 server and then spawn a new virtual device that would be given an IP by my fake dhcpv6 to bypass. and we all can use macaddresschanger.
so you say with macfiltering the router would still prevent unwanted direct connections between my c&c server and some malicious virtual device? that'd be cool, but i dont understand how.
ipv6 in home lans is likely to be unsafe due to the defaults in some/many/most routers?
no
and those ipv6 devices can in these szenarios escalate their permissions be spawning new ip adresses
yes and this is not "escalating their permissions", it is in fact the expected behavior with Privacy Extensions (RFC 4941) where devices will probably have multiple addresses at the same time that are used for outgoing connections
that would overcome lazy output fw rules?
any router that doesn't have deny as the default rule for WAN->LAN traffic (probably not many) is trash, and if you're filtering LAN->WAN traffic (not really usual for a home network) then you want default deny there too, but at that point that is not an ipv6 problem
or if i upload a malicious apk to some smartTV and have a it spawn a dhvpv6 server and then spawn a new virtual device that would be given an IP by my fake dhcpv6 to bypass. and we all can use macaddresschanger.
rogue dhcp is not an ipv6 exclusive problem
so you say with macfiltering the router would still prevent unwanted direct connections between my c&c server and some malicious virtual device? that’d be cool, but i dont understand how.
yes, firewall rules can work based on mac addresses, not sure exactly what you mean
Routers simply need to block incoming unestablished packets (all modern routers allow for this) to replicate NAT security without NAT translation. Then you just punch holes through on IP addresses and ports you want to run services on and be done with it.
Now, some home routers aren't doing this by default, but they absolutely should be. That's just router software designers being bad, not IPv6's fault, and would get ironed out pretty quick if there was mass adoption and IPv4 became the secondary system.
To be clear, this is not a reason not to be adopting IPv6.
Yes, and no. A firewall is still a firewall if it is configured to have all ports open. The Linux kernel firewall is still active, even though its default configuration is, everything open.
My point is, for some reason there are some that are not configured to block incoming IPv6 by default. When that should be the standard home/consumer router default setting. Then the user can open ports to ips as they need them.
Not the person you were replying too, but I was there when we had modems and raw-dogged the internet.
The average person clicks "Yes" on everything without reading it, has no idea what a firewall is, and they never update anything unless it does it without asking.
Having things accessible from outside your network is great if you're a network nerd and that's what you want, but most people are going to be in a world of unprotected shit. Especially in a world of pointlessly online devices. I don't trust any of those fuckers to have their shit in order.
I would assume/hope the default setting for a consumer router would still be to drop incoming connections. That should suffice for the average person as long as ISPs don't make it easy to disable that without actually understanding what the consequences are.
I would also assume that to be the default, but unfortunately the first Google search for "why doesn't my smart fridge work from my phone when I leave the house" will be a set of instructions for turning that feature off.
NATs and port forwarding is annoying, but it's also very manual, and only lets you fuck up one device at a time.
Then the instructions are bad. They should be how to open the firewall port for that device, which is almost the same as setting a NAT port forward, with the same limitation of only exposing one device.
Yeah, but that's going to involve knowing what the device is called on the router, or knowing what the address is.
I'm afraid the great age of computer literacy has come and gone.
If anything it makes me want routers to not even allow a blanket whitelist for all devices...
Honestly the more I think about it the more I realize I'm wrong. I was thinking someone could enable a server on their client device without realizing it but the firewall on the router would still need to be modified in that situation, and anything not requiring firewall modifications would be just as much of a security hole on IPv4
Yeah it’s a common trip up. We’re all so used to the way that things are done in IPv4 that our natural response is to try and apply IPv4 logic to IPv6, but you’re absolutely right.
Many people think NAT is a security feature but but that’s only a coincidence and it doesn’t do anything a firewall doesn’t already do. And if we take it one step further we can actually see that a firewall and IPv6 is actually more secure than NAT. The only inherent risk of port warding in NAT is that the IP you’re forwarding to is ultimately arbitrary. Think, have a port open to SMB for a publicly accessible file sharing container, then later ditching it and via DCHP your laptop picks up that old IP and now voila you've technically exposed your laptop. It’s not quite that simple but that’s the essence of it.
But with IPv6, IPs are no longer arbitrary. When you allow access in certain ports to a certain machine and that machine goes away, that rule will always only allow access to nowhere.
As a tech nerd who self hosts stuff, I'm more like "what is IPV6 and why is it causing me issues, I can't figure this out, I guess I'll disable it, wow my problems are fixed now."
I guess I can see why people don't like it, as it's caused me issues, but just because I don't understand it doesn't mean it's dumb. I'd need to understand how it works before I could say anything about it, positive or negative. I guess all I could say is that it's been way less intuitive to me, I can't memorize the numbers, and the reason it exists makes sense. Beyond that, I unno.
I should probably spend the time to learn about it, but I already have a full time job where I work on computers all day, I'd rather focus on my other hobbies while I'm at home.
It's not terribly difficult to learn when you avoid trying to relate it to IPv4 concepts. Particularly: forget about LAN addresses and NAT, and instead think about a large block of public addresses being subdivided between local devices.
instead think about a large block of public addresses being subdivided between local devices.
Thinking about all my devices being exposed like that gives me the heebie jeebies. One public facing address hiding everything else on a private network is much less frightening to my monkey brain.
This is what a firewall is for. Blocks inbound to the whole subnet space. Better than a NAT, which can open a port through STUN or simply a malformed packet.
Back in the days I had an ISP that offered me IPv6 network, it was really easy to self host things over the internet, because IPv6 is unique to all devices, so the server had its own IPv6 global address, which I could access from anywhere with IPv6 connectivity. No more dealing with port forwarding (considering that the ISP didn't block the forwarding of ports). Just a firewall setting and voila, the service was accessible. It's that simple.
IP4 is running out, that's the problem. Or better, IP4 is hoarded by companies and they don't give them up. The insane amount of network devices every human being uses on a daily basis doesn't make the situation better. It exploded the last 10 years and only gets worse. The fuckery ISPs are doing to solve it without IP6 is insane, fuck cgnats and co. The whole networking world would be so much better to get it over with and adopt IP6 everywhere and let the hoarders drown in their mountain of IP4.
My ISP gave me a IPV6 router. I have it bridged (or whatever the right term is) to another router that serves IPV4 addresses to all my devices. Worked well so far with the added bonus that the ISP can't see what's going on within my network.
Old tale, I know, but just cause v4 is running out on the internet it doesn't stop anyone from using it in their homes. I manage some ASNs on the internet. I have no need yet to worry about implementing v6 on the inside.
The thing is that if IPv6 were actually adopted, it would be straight up better. For everyone. It's easier to use if it's all the networking instead of just a niche case.
It's really not though. ISPs are a problem, but every hosting provider I've used has offered IPv6. It's really trivial to setup IPv6 name DNS, and host a website on both IPv4 and IPv6. I just do it by default now.
Once it becomes the default to deploy to both, if IPv4 died then the IPv6 side would just keep working.
For DNS, you can make a single glue record contain an IPv4 and IPv6 address.
DNS just needs A and AAAA records for the Name servers. NS records still point to the hostname as normal.
For Web servers, the web server just needs to bind to the IPv6 address(es). Then in DNS just have an A and AAAA record for each website hostname. The server name directives will cover both.
There really isn't much to it right now. The technology is mature now. It used to be a pain, but now it isn't.
It really is for me when I've got thousands of servers and hundreds of firewall rules, hundreds of subnets and routing to worry about.
Just anyone with a windows xp machine really
Could also be a joke on how there was a single XP serial number used by nearly everyone that got it from, uhh, non-official sources. FCKGW FTW.
Eh, they're alright. They had to deal with more bullshit than I ever had to in high school.
They had to deal with the daily threat that a school shooting could be their school. All I had to deal with was teenage girls having a war over who was hotter. Backstreet Boys, or N-Sync.
Which to be fair, if you said the wrong one to a teenage girl in the 90s, she'd be likely to flip out on you. Still though, they wouldn't pull a gun!
I'm honestly surprised that the closest we ever got to a parody boy band was Justin Timberlake singing Dick in a Box with Lonely Island. Seems like SOMEBODY should have made a parody band! Weird Al can't do EVERYTHING, ok???
They had to deal with the daily threat that a school shooting could be their school.
What kinda hellscape country is that?
Oh wait. I know this one.
Zoomers are fine, just making fun of the concept of young people thinking Windows 3.1 couldn't connect to the internet. America Online, bitch. A/S/L? Also Zi could type my friend's phone # into Doom and it'd call his modem and we could play each other
You can equate your highschool experience to a war between boy band favorites.
Sounds like you had a good time in high school.
"Compromises all devices running .... an IPv6 address."
Oh so no one is effected. (other then network nerds, and they are not real)
IPV6 is already rolled out in parts of the world. My provider has a Dual Stack lite architecture, the home connection is over IPV6, IPV4 is normally being tunneled via V6 through a provider grade NAT.
As I AM a network nerd, I pay for a dedicated IPV4 address every month, so I can reach my stuff from outside from old IPV4 only networks.
So when I plug in my router, connect a windows machine and just google stuff then all this traffic will be IPV6 without me configuring anything.
It's so great fun having the attack surface being doubled by dual stack setups.
Why not instead use the money to pay for a domain name and use a router with a dynamic DNS daemon?
Because behind the carrier grade NAT I don't get a routable IPV4 at all, so no inbound connections.
With the IPV4 I use I do use dyndns now, so I can resolve it from outside.
Some ISPs have basically destroyed their segment of the Internet, turning it into a cable tv network.
IPv6 is enabled by default on windows.
EDIT Here's how to disable it. If you can't on your modem/router. Open the network menu from the icon in bottom right of screen > right click on the network you are connected to and click "status" > In the popup click on the "Properties" button > You'll get another popup with the name of your network adapter in a top line/box and a secondary box with a list of things in it > Look for the entry "Internet Protocol Version 6 (TCP/IPv6)" and uncheck the box in front of it > click OK.
you can have both addresses at the same time - this site shows both if you have them: https://whatismyipaddress.com/
Depending on your ISP and network setup, you could very well have both v4 and v6 addresses.
Unfortunately (or fortunately, it depends on how you see it), some providers are already on IPv6. My Italian ISP has IPv6 with CGNAT, so all its users are on IPv6 without even knowing what it is.
Looking at the IP logs of the users on a website of mine shows that many people are already using IPv6 alongside IPv4. Some ISPs even don't use IPv4 anymore unless you pay extra (Germany/Austria)
Serious question - I haven't touched my Xbox one for about 4 years , it wasn't powered and wasn't connected to the internet - I would love to jailbreak it and run Linux on it. Can it be done?
About Linux, it's not yet feasible, probably soon, right now Xbox one/series jailbreak scene is only making first steps with dumping of games and launching roms and emulators without dev mode
I did that years ago, and they said basically "never". Then a couple years later all of a sudden, there it was.
To note: It shows even Windows Server 2008 as affected. Since MS is only testing against OSses they support, it is possible this has existed as a problem all the way back since IPv6 was first introduced to Windows XP.
Also, for all of you "disable IPv6 because I don't understand it" people... unless you are running Windows 8 or older, just update Windows. IPv4 has been out of addresses for so long that CGNAT is a thing, which means connectivity problems when you're hosting stuff, and more latency and packet drops from ISP routers getting saturated with NAT tasks. IPv6 is alive on the internet since 2011 and very much used on the internet, does not tie up routers by requiring NAT translation, and therefore just performs better. Plus, if you use your network printer's or network device's link-local ipv6 to connect locally, you will never have to deal with static ip address or changing ipv4 lan address pain, as link-local (non-routable on the internet) addresses don't change unless you force it.
Also don't use $35 routers for your internet. If your router does not support ipv6 firewalling, it is long since time to fix that with one that does.
ipv4 is PERFECTLY fine for local networks, so most DO NOT NEED ipv6. I disable it on all devices, I don't use it, don't need to see it my ipconfigs
This would presumably mainly be an issue for computers open to the internet. So not so much for home PCs, unless the router's firewall is opened up.
I've not read the CVE but assuming it works on any IPv6 address including the privacy extensions addresses, it's a problem. Depending on what most routers do in terms of IPv6 firewalling.
My opinion is, IPv6 firewalls should, by default, offer similar levels of security to NAT. That is, no unsolicited incoming connections but allow outgoing ones freely.
In my experience, it's a bit hit-and-miss whether they do or not.
Now, if this works on privacy extension addresses, it's a problem because the IPv6 address could be harvested from outgoing connections and then attacked. If not, then scanning the IPv6 space is extremely hard and by default addresses are assigned randomly inside the /64 most people have assigned by their ISP means that the address space just within your own LAN is huge to scan.
If it doesn't work on privacy extension IPs, I would say the risk is very low, since the main IPv6 address is generally not exposed and would be very hard to find by chance.
Here's the big caveat, though. If these packets can be crafted as part of a response to an active outgoing TCP circuit/session. Then all bets are off. Because a popular web server could be hacked, adjusted to insert these packets on existing circuits/sessions in the normal response from the web server. Meaning, this could be exploited simply by visiting a website.
IPv6 firewalls should, by default, offer similar levels of security to NAT
I think you're probably right. We had decades of security experts saying that NAT is not a firewall and everyone on the planet treated it like one anyway. Now we're overexposed for a no-NAT IPV6 internet.
What about torrenting through a VPN with IPv6? Would that make you vulnerable to this exploit?
I think it depends on all the caveats I mentioned. If it could have worked with an outgoing connection, then someone with a bad client could execute it for sure. The VPN wouldn't protect you.
Harvesting IP addresses shouldn't be a problem, since the firewall shouldn't allow packets from a peer you haven't talked to first. But true, if you can be attacked in response by a server you're connecting to that would be bad.
For a professional sysadmin's home network? Maybe. For the average Joe who probably has their 12-year-old toaster still connected to their wifi? I wouldn't bank on it.
One restart post-update restarts changed it and helped, but something was still off. Took me like 30 minutes but it looks like my nvidia HDMI audio output got reset to a really low 16 bit sample rate. Got that set back to a decent 24 bit and its closer, but something is still off. I don't think I had any settings/levels/enchanments.
I tried to roll out ipv6 when I was sysadmin for a small ISP. ARIN gave me a /32 block with no fuss. I started handing them out only to discover most routers at the time couldn't use them. Not much has changed. No one offers them and I just turned it off at my present job. None of my windows machine have the ipv6 stack enabled.
I'm not running my computer with an IPv6 address. Only my modem has an IPv6 address. Does that mean I'm not affected?
I'll make sure to updats either way though.
"There but for the grace of god go thee."
Or, to be less poetic, "don't get cocky".
Hacks can happen to anyone. Better lessons to learn is "don't enable or install what you don't need" and "keep machines you don't trust off your local network"
Actually it is 100% that simple, proton has fixed gaming on Linux.
It doesn't work for a few rare games that install a rootkit on your Windows PC, but that's already silly and irresponsible of you to allow a game to do anyway, in my opinion.
Nearly all the games i play run worse on linux than windows. Counterstrike, the finals, vrising. Im sure at least one of them dont have rootkit installed. Even got glorious egg proton profiles and still no luck.
Ill have to test counter strike 2 later today and see if its still runs poorly cause it could have been due to it being recently released when i tested CS2 out.
Though just last night i was testing out the Finals and i noticed that the grqphics were significantly different from windows. In windows i had their polished texture and effects but in linux it was permanently foggy and the wall textures were super bad with shitty shadows.
I tried replicating those textures and settings on windows but i wasnt able to. Im beginning to think the game is not using my graphics card.
So in short; do you have any experience in this kind of issue with the graphics?
I used to agree with this statement, but I'm no longer that sure.
I built a new PC a week ago, installed windows first then Linux. The idea was that I needed Windows for gaming.
Thought I'd try proton + Steam, regardless, just to see how it stacks up.
No performance difference. HDR works through gamescope. The window manager of the DE isn't insane and I can alt tab around my OS without problem.
Pretty good stuff. Still have windows for work and Valorant, but otherwise I play all my games on Linux these days. The only part that's lacking, in my opinion, is hot plugging controllers. Annoying that that doesn't work.
