Subject: RE: Why IPv6 is a must?

From: Charles Adams <[email-masked]>
Date: Wed, 28 Nov 2001 09:19:48 -0600

If it hides the IP address of your fridge, wouldn't that impair anyone from
drinking your milk?  If access to the resource is blocked using NAT, then
isn't that aspect of security inherent to NAT?

Charles

 +-------------------------+-------------------------+
 |  Charles Adams          |  US Pipe and Foundry    |
 |  Network Security Admin |  3300 1st Avenue North  |
 |  [email-masked]      |  Birmingham, AL 35222   |
 +-------------------------+-------------------------+

All opinions expressed here are solely my own.

Peter Deutsch wrote:
...
> 
> The moral of the story? Traffic patterns and metadata can be powerful
tools and
> one person's junk is another person's data. You should not assume that the
> majority of people shouldn't or wouldn't care about it leaking out, even
if at
> first glance it seems pretty mundane.

Absolutely true. Nothing to do with NATs. Any router conceals internal
traffic 
patterns. Any router can hide internal addresses that don't talk to the
outside. 
All the NAT hides is the number of logically (not physically) distinct hosts

inside that do talk to the outside. This is not security; it might hide
the IP address of your fridge, but it doesn't hide your fridge.

   Brian

---

From: "Meritt James" <[email-masked]>
Date: Wed, 28 Nov 2001 11:08:52 -0500

Here is a point - what kind of I&A would go on these accessible
devices?  Do you WANT to be able to address (and control) your fridge
remotely?  How about your home heating?  Want to come home to find a
disgruntled hacker thought it funny to have your fridge turned off and
130 degrees in your house?

-- 
James W. Meritt CISSP, CISA
Booz | Allen | Hamilton
phone: (410) 684-6566

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 28 Nov 2001 17:52:22 +0100

Look, either your fridge is accessible from outside so that you can check
how much milk you have from the office, or it isn't. That's independent
of whether its address happens to be NATted. It's dependent on the
security policy you choose to apply.

   Brian

---

From: Keith Moore <[email-masked]>
Date: Wed, 28 Nov 2001 12:20:55 -0500

> drinking your milk?  

it also impairs *you* from drinking your milk from another part of the 
network,  even if you have a milk transfer protocol (MTP) client on your
PDA :) 

or even if you're in the same room as the fridge but your PDA's network 
connection is through a wide area wireless network rather than the house
LAN.

> If access to the resource is blocked using NAT, then isn't that aspect 
> of security inherent to NAT?

two things: 

1. NAT blocks all external access even though you typically want to allow 
some kinds of external access.  that's not good security because it's
too coarse-grained.

2. the fact that NAT blocks external access doesn't justify NAT.
if you want to block all external access, you can do this more 
easily (and more reliably) without NAT.

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 28 Nov 2001 13:02:07 -0500

>  Do you WANT to be able to address (and control) your fridge remotely?  

not unless the fridge also maintains its own inventory and orders 
more milk when its inventory gets low.

> How about your home heating?  

absolutely.  I want to be able to turn the heat down when I'm out of
town, and up before I return, without having to drive home to do this.

> Want to come home to find a disgruntled hacker thought it funny to have 
> your fridge turned off and 130 degrees in your house?

surely you don't think I'd use a Microsoft refrigerator ?

Keith

---

From: Lloyd Wood <[email-masked]>
Date: Wed, 28 Nov 2001 22:51:22 +0000 (GMT)

On Wed, 28 Nov 2001, Keith Moore wrote:

> some kinds of external access.

Please read RFC2663, section 4, paying particular attention to 4.2 and
4.3.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>