It's begun: 'First' IPv6 denial-of-service attack puts IT bods on notice

I don't have any practical evidence but I could easily imagine a scenario where an IPv6 project team is brought in or created specifically to do an IPv6 project while the core IT team still deal with the everyday IPv4 system. Therefore the normal network team are still managing the IPv4 DHCP and setting up devices on using IPv4 while the project to look at implementing IPv6 takes place in a test environment and gradually into a live environment.

I think it refers to the practice that companies like Facebook are using of not running IPv4 at all. All their systems are IPv6-only with the exception of their edge servers. They simply removed IPv4 networking from all their internal servers, desktops, engineers dev stations etc. That way developers and architects don't have to worry at IPv4, test everything twice, worry about attack vectors using the other protocol etc. They just have to make it work on IPv6 and let the webservers translate it to IPv4 for those users who still have IPv4-only connections.

What does "in parallel" mean?

I assumed it meant side-by-side; one stack for handling IPv4 and another for IPv6, incoming packets handed off to the appropriate stack as they arrive. Dealt with by one team proficient in IPv4 another trying to be in IPv6.

IP6 & IP4 in "Parallel"

It would be pointless to have a Website be IP6 only, since the vast majority of potential visitors only have IP4.

So anyone deploying IP6 also has IP4. The exact technical mechanism isn't relevant to the word "parallel", which here means as well as.

Why do I feel like Lemony Snicket?

Re: Downside???

Until they pwn your IPv6 stack...

Re: Downside???

"This is a very GOOD thing!"

Why? What exactly does IPv6 bring to the table for your average user that IPv4 doesn't? Answer: absolutely bugger all. Well, unless you're a fan of hexadecimal , then you're rocking with the incomprehensible and impossible to remember ip6 addresses.

Re: stating the obvious

"Appears to be more 'fear' advertising."

Surely they'd all have been OK if they'd implemented DevoPS properly? Click here for the whitepaper.

Re: IPv6 is a mess

NAT means we're all slaves to commercial portals for serving data. No f'ing thanks.

Re: IPv6 consumer devices are a dumpster fire

Or not so much. I know it's popular to rag on IoT stuff, but let's actually think about it for a moment. Let's imagine someone who buys a network camera, and who then configures their network so the camera is accessible from the internet so that they can look at it from work (because why else buy a network camera?).

On v4, the camera is found by scanners within a few hours, because the v4 space is tiny and easy to exhaustively scan. On v6? Not so much. You could spend a million times the effort scanning v6 and not even scratch a single /64, let alone all of the rest of the /64s. The camera is relatively unlikely to be found, and thus relatively unlikely to be exploited. This is still the case even if someone completely shuts down their firewall (which I suspect isn't really going to be the most common configuration).

Now, it's true that security by obscurity isn't security and there are various ways to narrow down the search space, but nevertheless if you make it much harder to find your IoT devices it's going to make it correspondingly hard to do anything to them. If anything, v6 seems like it should make the situation better rather than worse.

Re: What about my IoT devices?

> Does this mean I'll have problems querying my refrigerator from the supermarket when I forgot what I was supposed to buy?

Nah, just ask the supermarket, as the fridge manufacturer has already sold that information to the supermarket.

Re: firewalls will be obsolete

No, just only deployed by the clued. An IP4 LAN with one public IP needs a NAT router. Technically a firewall is a separate thing and still needed between your LAN and ISP on IP6 only. Admittedly people might not have one as modem + switch will "work".

Re: FUD

"The funny thing is that securing IPv6 means breaking the end to end philosophy many state as one of its positives."

No, it's simply a matter of allowing the capability as and when you need it, without having to forward ports and stuff like that or resort to such kludges as (gasp) UPnP.

Re: IPv6 and CIDR

You say "of course" but I can't see how CIDR would make it impossible to null-route a subnet.

That was IPv5. The devices hiding behind NAT are already well past a 2^48 bit sized address space - EUI-64 had to be introduced years back to extend MAC to 2^64 bit address space. Then there is 2^64 for network route information. Combining those we find ourselves back at the same size *and* layout of an IPv6 address.