Re: [v6ops] draft-ietf-v6ops-ula-usage-recommendations - work or abandon?

[Owen DeLong <[e-mail]>]

>>> If a network has a policy of only allowing outgoing connections, then
>>> any workaround to do that is an attack on that policy. And 
>>> making.that workaround more difficult can thus be seen as a feature.
>> 
>> Such a policy is misguided
> 
> Says who? It's the policy that is being enforced. Period.

The author of that post for one.
Me for another.

> 
> 
>> because it ignores the reality that today 
>> outgoing connections are just as dangerous as incoming ones, if not 
>> more.
> 
> I disagree. Your claim can be correct for an enterprise with BYOD. BUt
> it is certainly not true for virtually every home network where a number
> of devices are attached to it -- possibly un-updated, with bad defaults,
> etc.

It absolutely is even more true in that case because if you allow those
hosts to make outbound connections, nothing prevents them from initiating
a TCP-based tunnel to a BOT CNC center which then fully opens inbound
access for exploitation regardless of NAT, diode firewall, or anything else.

This has happened more than once and you know it.

QED.

> In any case it's possible to DoS a device with a single packet, or
> worse, that you can root a device with a single packet (see one of the
> few openbsd remotely exploitable vulns, alas IPv6-based), a diode
> firewall would prevent such devices from being owned from the Internet.

No… It just _MAY_ add to the steps necessary to do so. See above.

> (Not to mention reflection attacks, etc.)
> 
> This doesn't mean "yeah.. there couldn't be nothing evil inside", but is
> rather along the lines of the principle of "least privilege" applied in
> security -- "if I don't need something for ding what I need to do, then
> I get read of it"... whether that's superuser privileges, or
> connectivity privileges.

Sort of, but there are other ways to achieve the same effect which
do a better job of accounting for the dangers of outbound connections
as well.

> Yes... in general, your ability to play with my network is at odds with
> my network's security.

Sure, but the assumption that this relates to which direction connections
are allowed to be initiated is fundamentally flawed.

Owen