Technology

59374 readers

3846 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

692

All Windows users should immediately update their computers. An exploit rated 9.8/10 (CVE-2024-38063) compromises all devices running Windows with an IPv6 address. (msrc.microsoft.com)

submitted 3 months ago* (last edited 3 months ago) by [email protected] to c/[email protected]

207 comments fedilink hide all child comments

archive

If you have the August 13, 2024—KB5041580 update. You're good.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 3 months ago (26 children)

can you tell me if any device in an IPv6 LAN can just assign itself more IP v6 adresses and thereby bypass any fw rule?

[–] [email protected] 3 points 3 months ago (3 children)

Not if your firewall router is setup right (strict mac address filtering)

[–] [email protected] 1 points 2 months ago (2 children)

so back to the beginning of this thread: ipv6 in home lans is likely to be unsafe due to the defaults in some/many/most routers? and those ipv6 devices can in these szenarios escalate their permissions be spawning new ip adresses that would overcome lazy output fw rules?

thanks for all the explaining here so far!

or if i upload a malicious apk to some smartTV and have a it spawn a dhvpv6 server and then spawn a new virtual device that would be given an IP by my fake dhcpv6 to bypass. and we all can use macaddresschanger.

so you say with macfiltering the router would still prevent unwanted direct connections between my c&c server and some malicious virtual device? that'd be cool, but i dont understand how.

[–] [email protected] 4 points 2 months ago (1 children)

ipv6 in home lans is likely to be unsafe due to the defaults in some/many/most routers?

and those ipv6 devices can in these szenarios escalate their permissions be spawning new ip adresses

yes and this is not "escalating their permissions", it is in fact the expected behavior with Privacy Extensions (RFC 4941) where devices will probably have multiple addresses at the same time that are used for outgoing connections

that would overcome lazy output fw rules?

any router that doesn't have deny as the default rule for WAN->LAN traffic (probably not many) is trash, and if you're filtering LAN->WAN traffic (not really usual for a home network) then you want default deny there too, but at that point that is not an ipv6 problem

or if i upload a malicious apk to some smartTV and have a it spawn a dhvpv6 server and then spawn a new virtual device that would be given an IP by my fake dhcpv6 to bypass. and we all can use macaddresschanger.

rogue dhcp is not an ipv6 exclusive problem

so you say with macfiltering the router would still prevent unwanted direct connections between my c&c server and some malicious virtual device? that’d be cool, but i dont understand how.

yes, firewall rules can work based on mac addresses, not sure exactly what you mean

[–] [email protected] 1 points 2 months ago

ok. cool.that was really helpfull.

load more comments (22 replies)