IETF Logo Mail Archive

Re: Scripting attacks [was Next step for draft-ietf-6man-rfc6874bis]

Michael Richardson <mcr+ietf@sandelman.ca> Tue, 05 July 2022 20:27 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 815D5C13C363 for <ipv6@ietfa.amsl.com>; Tue, 5 Jul 2022 13:27:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.706
X-Spam-Level:
X-Spam-Status: No, score=-1.706 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (public key: not available)" header.d=sandelman.ca
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q00-AmVTjEtd for <ipv6@ietfa.amsl.com>; Tue, 5 Jul 2022 13:27:25 -0700 (PDT)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C17A3C13C364 for <ipv6@ietf.org>; Tue, 5 Jul 2022 13:27:25 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 95FCA1804B; Tue, 5 Jul 2022 16:44:24 -0400 (EDT)
Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id RQIp7mvMkU6n; Tue, 5 Jul 2022 16:44:24 -0400 (EDT)
Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id F2E3118011; Tue, 5 Jul 2022 16:44:23 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sandelman.ca; s=mail; t=1657053864; bh=xiZBmbJFIZIiKS86JbGvmRjdGXRk2v8jxNwxONdAwpg=; h=From:To:cc:Subject:In-Reply-To:References:Date:From; b=kqILobO/7Edl7lhHIsyj4JDqHcuFV+ww2Zj/t5k1mZ8dLneA6JSEymn+VwSP7djNH E0b/Cqs8kIqN9P+eIGQbg3dnvBCpNUJRivdAhFU8ZC44aG8bv+c7GTxIpoDf5883Jx QpqKk9jt0nIZrVMG29xhJsZKyhrjJzV7HPrtPCDR23V7VC5NuuyBIjMuiFrdIV9N7U Ev8TLzD3ZU//xmZRMezwHQ938yef2nqx8KIrK8QXs0BDOQplmcrCbT6gvRqEgVFIWv 1I2UlTRcgfwSoPeDj4gVnL4cCCZTgBVCUOkpaS74tsGNYQV/agoiCe+aFl8yQ941WH XE+fCxhuuvWQg==
Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id D9F1E65E; Tue, 5 Jul 2022 16:27:23 -0400 (EDT)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
cc: 6man <ipv6@ietf.org>
Subject: Re: Scripting attacks [was Next step for draft-ietf-6man-rfc6874bis]
In-Reply-To: <84051939-be78-731f-fd29-6056f1fcb886@gmail.com>
References: <164938402532.17740.11717866110301931501@ietfa.amsl.com> <b1780128-2069-b32e-7ca5-86977c119f0c@gmail.com> <11d4e419-11a9-8768-abf2-1335e5f1c3d8@gmail.com> <149924f9-da30-fa79-0509-c01c439d1796@gmail.com> <5BEFA97B-CF09-44D7-8C10-017FEAE4C3A8@tiesel.net> <e6ff75e7-b6c6-ea03-2e10-b1ad95d650f0@gmail.com> <98D15BD9-A631-4D09-AE9E-9D4C750714C9@tiesel.net> <95c82ad3-2138-ab2a-7ba5-57ad80472964@gmail.com> <E5C368C5-9DAE-4C61-ADDE-B881EA11EDA0@tiesel.net> <6968ca7b-dac3-b192-41ed-a193adab7eb4@gmail.com> <529B863C-BCC9-40C1-A5B8-B0598E7DF17C@tzi.org> <bf8c5c54-d548-a40a-0381-0583ef946f26@gmail.com> <CAPt1N1=4wbqrrzvwdr4FD7awa6pkyffhwRZC3zAWLs7uzY3BJQ@mail.gmail.com> <86509E47-77CE-4210-A1B7-C1E9955D9672@tzi.org> <edc17d00-83c7-25df-d125-14c8f15da172@gmail.com> <31680.1657032425@localhost> <84051939-be78-731f-fd29-6056f1fcb886@gmail.com>
X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 27.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Date: Tue, 05 Jul 2022 16:27:23 -0400
Message-ID: <2740.1657052843@localhost>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipv6/MuE_0MAUFxvMeXR8D7AXJjY6H7Y>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 05 Jul 2022 20:27:31 -0000

Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
    > A bit off topic here perhaps, but:

    >> PS: how long to scan all of RFC1918 space... 2^24 for 10.xx, and then far
    >> less than double that for the rest of 172.16 and 192.168.x.y.

    > Hardly any time, given that the router's IPv4 address is probably written
    > on its "getting started" guide. It wouldn't be hard to compile a list.
    > I'd try 192.168.178.1 first, 10.1.1.1 second, and so on. It always seems
    > to be x.x.x.1 . So you could probably do it in a matter of minutes.

Ah, good point.  One can connect to the .1 first to see which prefix is in
use, and then just scan that.
The point being that it hardly takes any time at all to scan IPv4.
A feature of IPv6.

    > I still don't think these numbers should be in the draft, because it's
    > easy to prove them wrong for any particular scenario.

okay.

--
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

v2.23.0 | Report a Bug | By Email