IPv6-ghost-ship: Using TOTP as part of an AWS EC2 IPv6 address

https://github.com/aidansteele/ipv6-ghost-ship

by kotaKat • 5 years ago

193 46 5 years ago

github.com

quocanh• 5 years ago

I love this. But also why.

AdamJacobMuller2• 5 years ago

If you have to ask why, you'll never know.

snypher• 5 years ago

Instead of building a OTP gateway into each connection, you can just connect to the constantly rotating IP and go from there. Seems useful!

AdamJacobMuller2• 5 years ago

This is absolutely brilliant and amazing and also completely and utterly useless. I love it.

kadoban5• 5 years ago

Cool.

That is a pretty bad idea in practice though, the issue(s) being: IP addresses are public (especially to anyone in the middle of your connection) and it's trivially brute-forceable.

KiranRao0• 5 years ago

Definitely a cool project. And I agree this is a bad idea in practice for many reasons.

But I wasn't aware that TOTP was brute-forcable. What is the mechanism to achieve this (given only a set of IP address and their timestamps)?

kadoban5• 5 years ago

TOTP implemented this way is brute-forceable because you can just connect to all of the IP addresses (or pick however many connections you can practically make in 60 seconds and hit those).

There's no way to lock out after N failures or even to rate limit attempts.

DarylZero2• 5 years ago

Putting the IP block over WireGuard fixes both issues.

kadoban5• 5 years ago

If you're using wireguard don't you already have a secured connection and don't even need any of this?

georgyo• 5 years ago

I don't think the idea was suggesting that TOTP would be the _only_ method to get in. In fact the code just decides to accept or reject the incoming connection. The normal SSH auth flow would still need to be completed.

So you would need to brute force SSH (which is already decently hard) AND brute force the IP every 30 seconds.

This would stop the constant and relentless failed auth logs. (Yes there are other methods, but this one is novel and good as well)

deathanatos• 5 years ago

I love that the submitter fit the entire idea into the title. Understood it without even clicking. Brevity is the soul of wit.

Clever idea, wouldn't have thought of it on my own.

zeptonix• 5 years ago

Brilliant!

gauravphoenix• 5 years ago

Aidan is one of the most brilliant engineering person I have known. I share a slack workspace with him and his posts are always enlightening.

Glad to see him on HN front-page.

wmf• 5 years ago

This is like port knocking except using the low 48 bits of the IP address instead of the port. Personally I'm not into port knocking but some people are.

rzzzt• 5 years ago

Add a local DNS server that rotates the AAAA record in tandem, and voila!

viraptor• 5 years ago

Risky - both because browsers use DoH more and more, and otherwise DNS cache will be out of sync.

jl6• 5 years ago

Amazing. But why “ghost ship”?

Schnitz• 5 years ago

A ghost ship mysteriously appears and disappears in a number of seemingly random locations, presumably leading mariners to follow it to nowhere chasing ghosts.

eknkc3• 5 years ago

I know that even with /80 prefixes on everything we will not run out of IPv6 addresses but why do they provide such large blocks to individual instances, servers etc?

Is there any practical reason? Like easier routing? Just curious.

emteycz• 5 years ago

That individual instance might host hundreds of LAMP vhosts, each could have its own IP now

eknkc3• 5 years ago

That individual instance can host 300 trillion vhosts with individual IPs with a /80 block. It has more publicly adressable IP addresses than the entire ipv4 address space.

That is exactly my question, is there a technical / practical reason for this? Or is it simply an arbitrary prefix?

reincarnate0x143• 5 years ago

It's more "why not." The mindset that addresses are something that need to be conserved and carefully parceled out simply does not jive with V6. It takes a while for that to really sink in particularly if one is used to having to care a lot.

Who cares if they need 100 or 200 or 500,000. Give them a /64 or /80 and let them use it for whatever they come up with. As to why specifically /64 and /80 it probably makes the internal net magic easier versus something that isn't 4-byte aligned.

eknkc3• 5 years ago

Yeah I don't really have a problem with the use of large spaces, was just curious about the prefix selection.

As to why specifically /64 and /80 it probably makes the internal net magic easier versus something that isn't 4-byte aligned.

Thanks for the insight!

richardwhiuk• 5 years ago

/64 is the standardized value for the host part of an IPv6 address. Specifically, it's half the address.

FL410• 5 years ago

And to me, this is part of the problem with IPV6. This HUGE amount of space that results in "why not" numbering, also means long hexadecimal IP addresses that no one can ever remember. The ship has sailed, but adding an octet to IPV4 and not planning to assign 28912479812 IP addresses to a toaster would have been so much easier.

db48x• 5 years ago

It says right there in the description:

    “You could use the feature to run 281 trillion containers with their own IPs (which I assume is what AWS intended for the feature), but I wanted to find a more fun use.”

escalt• 5 years ago

It's actually a pretty small prefix in the IPv6 world. The recommendation for an IPv6 network is to be at least a /64, because features like SLAAC, which mostly replaces DHCP, need a /64 prefix to work properly. If you have multiple networks, it's standard to use a separate /64 prefix per network. My ISP for instance gives every home user a /56 prefix, some ISPs even give out /48 prefixes.

fulafel• 5 years ago

It's a odd size but more for being too stingy - normally in these kinds of setups you get something like a /48 or /56 for routing which lets you still have some bits for routing and then you can hang normal /64 subnets at the end of your routes.

Operating systems don't support non-64 prefixes very well and v6 wasn't designed to work like that.

withinboredom• 5 years ago

Operating systems don’t support non-64 prefixes

Then how do routers work? Docker containers? VMs running on a machine with some part of a /64?

jimmySixDOF• 5 years ago

Reminds me of port knocking a little bit lol but it's a cute solution for on the fly obfuscation

taddevries• 5 years ago

TOTP = Time-based One Time Password

For those like me who are bad with remembering acronyms.

rjsw• 5 years ago

Thanks, I'm sure I'm not the only person from the UK who thought it was something else [1].

[1] https://en.wikipedia.org/wiki/Top_of_the_Pops

IPv6-ghost-ship: Using TOTP as part of an AWS EC2 IPv6 address

Related Stories