All Windows users should immediately update their computers. An exploit rated 9.8/10 (CVE-2024-38063) compromises all devices running Windows with an IPv6 address.
Security Update Guide - Microsoft Security Response Center
If you have the August 13, 2024—KB5041580 update. You're good.
😏🐧
Just say you run Arch and move on.
I run Arch and move on.
People always talk about Arch. I wonder what people think of other oses and the people who run them lol. Like I'm a bearded Debian user (closer to the look of the Dilbert comic unix guy).
You run Arch and move on.
(Am I doing this right?)
🐧🌿 (♏)
Just say you run Arch and move on.
You run Arch and move on.
I thought he was saying he's sexually attracted to punguins...
I run Arch and since then moved on.
Still waiting for a distro named "Arch btw"
Cachy me outside. I’ll run arch over you.
As a networking nerd, I am endlessly frustrated with how many otherwise smart people are just 'fuck ipv6 lmao'
Giving me goddamn flashbacks to this https://www.youtube.com/watch?v=v26BAlfWBm8
Just sayin'
IPv6 genuinely made some really good decisions in its design, but I do question the default "no NAT, no private network prefixes" mentality since that's not going to work so well for average Janes and Joes
No NAT doesn't mean no firewall. It just means that you both don't have to deal with NAT fuckery or the various hacks meant to punch a hole through it.
Behind NAT, hosting multiple instances of some service that uses fixed port numbers requires a load-balancer or proxy that supports virtual hosts. Behind CGNAT, good luck hosting anything.
For "just works" peer to peer services like playing an online co-op game with a friend, users can't be expected to understand what port forwarding is, let alone how it works. So, we have UPnP for that... except, it doesn't work behind double NAT, and it's a gaping security hole because you can expose arbitrary ports of other devices if the router isn't set up to ignore those requests. Or, if that's not enough of a bad idea, we have clever abuse of IP packets to trick two routers into thinking they each initiated an outbound connection with the other.
Routers simply need to block incoming unestablished packets (all modern routers allow for this) to replicate NAT security without NAT translation. Then you just punch holes through on IP addresses and ports you want to run services on and be done with it.
Now, some home routers aren't doing this by default, but they absolutely should be. That's just router software designers being bad, not IPv6's fault, and would get ironed out pretty quick if there was mass adoption and IPv4 became the secondary system.
To be clear, this is not a reason not to be adopting IPv6.
Why would you think it wouldn’t work for the average Jane and Joe?
As a tech nerd who self hosts stuff, I'm more like "what is IPV6 and why is it causing me issues, I can't figure this out, I guess I'll disable it, wow my problems are fixed now."
I guess I can see why people don't like it, as it's caused me issues, but just because I don't understand it doesn't mean it's dumb. I'd need to understand how it works before I could say anything about it, positive or negative. I guess all I could say is that it's been way less intuitive to me, I can't memorize the numbers, and the reason it exists makes sense. Beyond that, I unno.
I should probably spend the time to learn about it, but I already have a full time job where I work on computers all day, I'd rather focus on my other hobbies while I'm at home.
Ye fuck ipv6 lol. I still have no need to move to it lol.
IP4 is running out, that's the problem. Or better, IP4 is hoarded by companies and they don't give them up. The insane amount of network devices every human being uses on a daily basis doesn't make the situation better. It exploded the last 10 years and only gets worse. The fuckery ISPs are doing to solve it without IP6 is insane, fuck cgnats and co. The whole networking world would be so much better to get it over with and adopt IP6 everywhere and let the hoarders drown in their mountain of IP4.
"Compromises all devices running .... an IPv6 address."
Oh so no one is effected. (other then network nerds, and they are not real)
IPV6 is already rolled out in parts of the world. My provider has a Dual Stack lite architecture, the home connection is over IPV6, IPV4 is normally being tunneled via V6 through a provider grade NAT.
As I AM a network nerd, I pay for a dedicated IPV4 address every month, so I can reach my stuff from outside from old IPV4 only networks.
So when I plug in my router, connect a windows machine and just google stuff then all this traffic will be IPV6 without me configuring anything.
It's so great fun having the attack surface being doubled by dual stack setups.
they certainly don't run windows.
IPv6 is enabled by default on windows.
EDIT Here's how to disable it. If you can't on your modem/router. Open the network menu from the icon in bottom right of screen > right click on the network you are connected to and click "status" > In the popup click on the "Properties" button > You'll get another popup with the name of your network adapter in a top line/box and a secondary box with a list of things in it > Look for the entry "Internet Protocol Version 6 (TCP/IPv6)" and uncheck the box in front of it > click OK.
Unfortunately (or fortunately, it depends on how you see it), some providers are already on IPv6. My Italian ISP has IPv6 with CGNAT, so all its users are on IPv6 without even knowing what it is.
Dang Italian network nerds! That will teach them for believing in a better tech future.
Looking at the IP logs of the users on a website of mine shows that many people are already using IPv6 alongside IPv4. Some ISPs even don't use IPv4 anymore unless you pay extra (Germany/Austria)
IPv6 huh? There are dozens of us!
Yay, new Xbox jailbreak method, can't wait for new modded warfare videos about it
Serious question - I haven't touched my Xbox one for about 4 years , it wasn't powered and wasn't connected to the internet - I would love to jailbreak it and run Linux on it. Can it be done?
About Linux, it's not yet feasible, probably soon, right now Xbox one/series jailbreak scene is only making first steps with dumping of games and launching roms and emulators without dev mode
I updated Windows so hard Linux popped out.
It sure is 😜
Sick my isp doesn't even support ipv6
Be the change you want to see in the world, send an email asking for IPv6.
I did that years ago, and they said basically "never". Then a couple years later all of a sudden, there it was.
To note: It shows even Windows Server 2008 as affected. Since MS is only testing against OSses they support, it is possible this has existed as a problem all the way back since IPv6 was first introduced to Windows XP.
Also, for all of you "disable IPv6 because I don't understand it" people... unless you are running Windows 8 or older, just update Windows. IPv4 has been out of addresses for so long that CGNAT is a thing, which means connectivity problems when you're hosting stuff, and more latency and packet drops from ISP routers getting saturated with NAT tasks. IPv6 is alive on the internet since 2011 and very much used on the internet, does not tie up routers by requiring NAT translation, and therefore just performs better. Plus, if you use your network printer's or network device's link-local ipv6 to connect locally, you will never have to deal with static ip address or changing ipv4 lan address pain, as link-local (non-routable on the internet) addresses don't change unless you force it.
Also don't use $35 routers for your internet. If your router does not support ipv6 firewalling, it is long since time to fix that with one that does.
just update Windows
I'm still on 22h2 lol
Every version of 10 going back to 15.07 original release is affected.
Lmao good thing we're all on ipv4
This would presumably mainly be an issue for computers open to the internet. So not so much for home PCs, unless the router's firewall is opened up.
I've not read the CVE but assuming it works on any IPv6 address including the privacy extensions addresses, it's a problem. Depending on what most routers do in terms of IPv6 firewalling.
My opinion is, IPv6 firewalls should, by default, offer similar levels of security to NAT. That is, no unsolicited incoming connections but allow outgoing ones freely.
In my experience, it's a bit hit-and-miss whether they do or not.
Now, if this works on privacy extension addresses, it's a problem because the IPv6 address could be harvested from outgoing connections and then attacked. If not, then scanning the IPv6 space is extremely hard and by default addresses are assigned randomly inside the /64 most people have assigned by their ISP means that the address space just within your own LAN is huge to scan.
If it doesn't work on privacy extension IPs, I would say the risk is very low, since the main IPv6 address is generally not exposed and would be very hard to find by chance.
Here's the big caveat, though. If these packets can be crafted as part of a response to an active outgoing TCP circuit/session. Then all bets are off. Because a popular web server could be hacked, adjusted to insert these packets on existing circuits/sessions in the normal response from the web server. Meaning, this could be exploited simply by visiting a website.
IPv6 firewalls should, by default, offer similar levels of security to NAT
I think you're probably right. We had decades of security experts saying that NAT is not a firewall and everyone on the planet treated it like one anyway. Now we're overexposed for a no-NAT IPV6 internet.
What about torrenting through a VPN with IPv6? Would that make you vulnerable to this exploit?
Harvesting IP addresses shouldn't be a problem, since the firewall shouldn't allow packets from a peer you haven't talked to first. But true, if you can be attacked in response by a server you're connecting to that would be bad.
For a professional sysadmin's home network? Maybe. For the average Joe who probably has their 12-year-old toaster still connected to their wifi? I wouldn't bank on it.
My LAN has ipv6 disabled. So there.
I tried to roll out ipv6 when I was sysadmin for a small ISP. ARIN gave me a /32 block with no fuss. I started handing them out only to discover most routers at the time couldn't use them. Not much has changed. No one offers them and I just turned it off at my present job. None of my windows machine have the ipv6 stack enabled.
I just updated and now my audio sounds like shit.
That's pretty odd. Did you try turning it off and on again?
One restart post-update restarts changed it and helped, but something was still off. Took me like 30 minutes but it looks like my nvidia HDMI audio output got reset to a really low 16 bit sample rate. Got that set back to a decent 24 bit and its closer, but something is still off. I don't think I had any settings/levels/enchanments.
Dude 10-Base2 won, get over it!
Nah, bus with terminators is better.
Amateurs, not using null modem db9 serial
I'm not running my computer with an IPv6 address. Only my modem has an IPv6 address. Does that mean I'm not affected?
I'll make sure to updats either way though.
What about reactOS?
"There but for the grace of god go thee."
Or, to be less poetic, "don't get cocky".
Hacks can happen to anyone. Better lessons to learn is "don't enable or install what you don't need" and "keep machines you don't trust off your local network"
Switch to Linux, be done with all of this Microsoft software nonsense
I used to agree with this statement, but I'm no longer that sure.
I built a new PC a week ago, installed windows first then Linux. The idea was that I needed Windows for gaming.
Thought I'd try proton + Steam, regardless, just to see how it stacks up.
No performance difference. HDR works through gamescope. The window manager of the DE isn't insane and I can alt tab around my OS without problem.
Pretty good stuff. Still have windows for work and Valorant, but otherwise I play all my games on Linux these days. The only part that's lacking, in my opinion, is hot plugging controllers. Annoying that that doesn't work.
Actually it is 100% that simple, proton has fixed gaming on Linux.
It doesn't work for a few rare games that install a rootkit on your Windows PC, but that's already silly and irresponsible of you to allow a game to do anyway, in my opinion.
Well, not ALL Windows machines...
"Systems are not affected if IPv6 is disabled on the target machine."
I can't remember the last time I saw an IPv6 machine...
It is on by default in Windows.. More likely people have routers with it disabled.
Definitely on by default on my laptop
And disabling it fucks with Windows AD.
Where I work, everything is on IPv6. Both the infrastructure for the software services that we run, and our own internal corporate network.
My ISP also provides publicly routable IPv6 prefixes over DHCP. Any layman in my city with this ISP will be on IPv6 by default.
I also use IPv6 for my LAN.
Like, it's just kind of the default in my neck of the woods...
My entire network runs IPv6. I don't have any windows machines though.
IPv6 is enabled by default on windows. Additionally, MS does no testing against machines with ipv6 turned off. People that go through the effort of turning it off may run into problems.
My ISP enabled native IPv6 for me a few months back. It's pretty great. I don't have any windows machines, but I doubt my wife has disabled it on hers.
Anyway, our router is set up to drop incoming IPv6 traffic by default, sanely enough.
Hah! Joke's on you. I accidentally restarted my PC and updated it without wanting to.
Yeah? Well I was playing a game and it rebooted in the middle of a boss fight!
I was mid-proposal. She said, "Yes, as long as this call doesn't e..." Thanks a lot, Microsoft!
Tell me you didnt take a look at your windows update settings without saying so.
Mine restarted while I was watching a movie.
Thanks Windows.
Linux time?
A working clock is always right!