Re: R41 in draft-ietf-v6ops-cpe-simple-security-07

[Rémi Denis-Courmont <remi@remlab.net>]

On Mon, 3 Aug 2009 21:02:43 -0700, Mark Baugher <mbaugher@cisco.com> wrote:

> Manual config can at least be authenticated.  Conficker reportedly

> uses UPnP NAT traversal on IPv4 home networks and could have just as

> easily used NAT-PMP.  So we're recreating this issue in IPv6 unless we

> authenticate such requests.  How much worse off are we with no

> firewall than with one where practically any piece of malware can open

> it.



That's just NOT TRUE. Typically the trust between your CPE and your

computer comes ENTIRELY from the fact that the computer is behind the CPE.

If you computer is already infected, then you are already screwed.

Certainly the CPE should protect itself from the computer, but it cannot

protect the rest of the internal network, especially not the already

infected computer.



As for UPnP-IGD and NAT-PMP... if Conficker is already behind the CPE, it

can use UDP or make outbound connections anyway. The hole punching protocol

just makes it more slightly more convenient for the worm.



-- 

Rémi Denis-Courmont