Re: AWS Elastic IP architecture

[Nikolay Shopik <shopik () inblock ru>]

Matthew, Good list

- Windows doesn't run non-privacy addresses, so it won't work next time.
- If you could guess address of router props to you
- Before using SNMP you still need device address.
- If you can install software on remote PC, when you probably have same
result in IPv4 world.
- If you able run popular web/DNS server you probably have already
enough money from elsewhere unless someone offer you more money to sell
that info and this applies both to IPv4 and IPv6 regardless of firewall.

So I'm not saying IPv6 doing just fine w/o firewall, just that it doing
much better than IPv4 and its NAT with security through obscurity. And
especially from simple kind attacks.

On 02.06.2015 19:35, Matthew Kaufman wrote:
> Ah, the "IPv6 subnets are so big you can't find the hosts" myth.
>
> Let's see... to find which hosts are active in IPv6 I can:
> - run a popular web service that people connect to, revealing their addresses
> - run a DNS server that lots of folks directly use (see Google)
> - use the back door login your router vendor provided and ask
> - query your unsecured public SNMP and ask
> - get you to install software that sends back a list of what's on your subnet
> - make educated guesses about your non-privacy IP addresses based on the MAC address ranges of popular hardware that 
> is available in stores this year to reduce the search space to a manageable size
> - hack the site where you get automatic updates from and use its logs
>
> That's just off the top of my head
>
> Matthew Kaufman
>
> (Sent from my iPhone)
>
> > On Jun 2, 2015, at 9:21 AM, Nikolay Shopik <shopik () inblock ru> wrote:
> >
> > Tell me how do you plan find printer in /64 subnet, scan it?
> >
> > > On 02.06.2015 18:08, Matthew Kaufman wrote:
> > >
> > > I can't run my laser printer without a firewall in front of it, and I
> > > can't even guess how secure the controller in the septic system pump box
> > > might be... so I don't risk it. And I *know* that some of the webcams I
> > > have are vulnerable and have no updates available.