Using IPv6 with Linux? You’ve likely been visited by Shodan and other scanners

"One of the benefits of the next-generation Internet protocol known as IPv6 is the enhanced privacy it offers over its IPv4 predecessor. With a staggering 2128 (or about 3.4×1038) theoretical addresses available, its IP pool is immune to the types of systematic scans that criminal hackers and researchers routinely perform to locate vulnerable devices and networks with IPv4 addresses. What's more, IPv6 addresses can contain regularly changing, partially randomized extensions. Together, the IPv6 features cloak devices in a quasi anonymity that's not possible with IPv4. Now, network administrators have discovered a clever way that scanners are piercing the IPv6 cloak of obscurity. By setting up an IPv6-based network time protocol service most Internet-connected devices rely on to keep their internal clocks accurate, the operators can harvest huge numbers of IPv6 addresses that would otherwise remain unknown. The server operators can then scan hundreds or thousands of ports attached to each address to identify publicly available surveillance cameras, unpatched servers, and similar vulnerabilities." -- source: http://arstechnica.com/security/2016/02/using-ipv6-with-linux-youve-likely-b... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

On Tue, 2 Feb 2016 14:02:33 +1300, Peter Reutemann wrote:
"Now, network administrators have discovered a clever way that scanners are piercing the IPv6 cloak of obscurity."
-- source: http://arstechnica.com/security/2016/02/using-ipv6-with-linux-youve-likely-b...
Just to point out that any basic firewall, or even just a simple packet filter, should block this sort of thing. Note how one of the discoverers, Brad Hein, found out about it.
participants (2)
-
Lawrence D'Oliveiro
-
Peter Reutemann