critical windows 9.8 exploit effects the ENTIRE TCP/IP STACK

[@LowLevelTV]

no way haha anyway, you should go learn to code at lowlevel.academy (hehe)

[@SaltMineRanch]

way

[@Kane0123]

You’ve sold out man. Letting these dodgy sponsors into the channel…

[@byronlefevre8266]

No way. Big if true

[@Bro-trust-me]

Why don't you use adblock?

[@sarkybugger5009]

An IT guy that gets ads in his browser? WTAF? 👎

[@sadface]

"Nobody uses Edge in IE mode" *allow me to introduce 20 year old corporate web apps*

[@twqzjsidIsndusiakdixisqjeksixi]

Lemme introduce Opera 5, Oracle shittiest app that runs on IE mode.

[@pheonixmmkc]

This is 100% true

[@donniedarko7751]

I was gonna say.

[@Chiramisudo]

I can already smell the next big wave of ransomware. 😭

[@test-rj2vl]

Oracle forms application running as a Java applet in IE is always fun thing to work with..... And the 2nd best thing is having like 2 page manual on intranet how to hack it to work....

[@mx338]

A ton of people are still using Edge in IE mode, and they are all part of large companies.

[@benargee]

So ultimately the end user is safe but isn't because a company that has their personal data is gonna get hacked.

[@guusqwertyuiopasdfgh]

Usually you set this up to only open up certain pages in IE mode and not all pages which makes it much harder to exploit. At least according to my experience

[@CrispyCircuits]

@@benargee And if you know nothing about computers, you are going to copy those settings at home, "because they work"

[@trail.blazer]

If configured correctly then Edge will not use IE mode except for specific sites that are put in to a list of sites that require IE mode, such as an intranet site. If not using a centrally managed enterprise list of sites for Edge in IE mode then sites in the browser managed list expire after 30 days. Clicking a random link is somewhat unlikely to send you to Edge in IE mode.

[@ElvenSpellmaker]

I'd wager a lot of people who have Crowdstrike have Edge in IE mode...

[@madezra64]

"Nobody uses Edge or Edge in IE mode" Oh.. sweet summer child...

[@darkshardrex7589]

@@Petrichor_h I work for a large enterprise in health care... we have a IE mode entries in our EMSites list. This is very common in enterprise for support of older software or internal websites.

[@eduardomiranda7640]

Some of the most widespread SCADA systems feature web servers that can only be accessed with IE

[@Anonymous-m9f9j]

So many tech KZbinrs, especially security focused KZbinrs have this cringe ignorance, it’s a lack of real world experience I think.

[@madezra64]

@@Petrichor_h Most EMR and EHR (if not most, it’s still a LOT of) only works on IE. Honest to god it destroys my soul every time I have to configure a Device Configuration profile in InTune for a client that opens up and enforces Edge in IE mode, adding all the providers URLs to the trusted sites list… Madness… Edit: rereading my comment, it sounds like I am trying tell you something you don’t already know. So my bad, was just a general statement

[@2rx_bni]

My last employer only deprecated that because they HAD to, not because they wanted to. Required an entire backend change.

[@yeahaddigirl]

LLL: "no one uses IE mode" Banking companies / check scanner systems: 👀

[@voyager-tc9dz]

those use the original IE on Windows XP, and no, I'm not joking, just have a closer look at your local ATM, you will be surprised ...

[@unmanaged]

I could not believe that a bank is still using IE mode for scanning checks for payroll ... its so odd ... I had to support this garbage

[@jpaderaldo]

Once my mother was using an ATM here in Brazil and when she finished what she was doing the ATM showed a windows xp shutting down screen.

[@psylenced]

I was so happy when they moved from IE6 -> IE8.

[@dooorrr]

Yeah, an average person has no idea what goes on in their bank, Edge IE mode is pretty modern compared to the 100s of legacy mainframe systems. Also as many people already stated, no way you gonna open a wrong link in IE mode unless something is wrong on org settings level.

[@АфанасийШереметьев-б5ч]

Microsoft, this is seventh time in a row you're showing remote code exploit to the class

[@nomore6167]

"Microsoft, this is seventh time in a row you're showing remote code exploit to the class" - Somebody once told them to do what they're good at, and they took that advice to heart. The problem for us is that they're good at being insecure.

[@SomeDudeInBaltimore]

"Nobody uses Edge in IE mode" My career installing electronic security and servicing 10+ year old PoE cams needing ancient obscure ActiveX plugins to manage them says otherwise.

[@ZipplyZane]

Do those actually run on the wider Internet? Because I know people use IE mode for intranet stuff, but a website designed for IE mode would fail for 95% of users.

[@devrim-oguz]

Or silverlight…

[@billbuyers8683]

@@SomeDudeInBaltimore ActiveX, yeah that was too many Exes ago to remember

[@TheRealBigYang]

People have no idea how much of the world runs in legacy mode. Edge IE is one of the requirements for the world to run. Large companies usually only change what makes money. We are still migrating to github at work

[@zyplocs]

It's funny you state that no one uses Edge and especially not Edge in IE mode - meanwhile I work for a large, well-known corporation whose handful of extremely important internal applications are incompatible with Edge and can only be run in IE mode...

[@gulagamelee4804]

Had that with infrastructure equipment like switches in really big companies. Their stuff was so ancient that you either had to download a reaaaaaaaaaaaaaaaaaaaaaaaaaaaaaallly old firefox version or use edge in ie mode

[@bouboul3597]

same...

[@syrslava705]

The fnсk is the large well-known corporation whose handful of extremely important internal applications REQUIRE IE IN 2024. Clients need to know XD

[@MelodicMurder]

@@zyplocs is it Delta or Cloudstrike? 😂

[@trail.blazer]

If configured correctly then Edge will not use IE mode except for specific sites that are put in to a list of sites that require IE mode, such as an intranet site. If not using a centrally managed enterprise list of sites for Edge in IE mode then sites in the browser managed list expire after 30 days. Clicking a random link is somewhat unlikely to send you to Edge in IE mode.

[@dk9469]

2:25 „it’s just another Tuesday for Microsoft“ xD

[@mgancarzjr]

_For you, the day Microsoft ruined your security was the most important day of your life. But for me, it was Tuesday._

[@sansmoraxz]

At least it ain't Friday.

[@DoorThief]

"Nobody uses Edge in IE mode" Laughs in Corporate IT

[@SterileNeutrino]

"Yes, master. They left an interpreter in the TCP/IP stack that can be fed instructions directly from the packet" "Good. Good."

[@thedausthed]

A major bug in the TCP/IP stack is not at all surprising, Microsoft is the same company that never bothered to fix a bug in Windows 8.1 that would cause the TCP/IP stack to break after about 30 minutes if you used a Wi-FI driver compiled against Windows 8.1.

[@ArkenGAMES]

What does compiling against mean? Compiling the driver to run on a specific version of windows? Also shouldn't there be tons of Wi-Fi drivers out there from different Wifis manufacturers?

[@mattmurphy7030]

@@ArkenGAMESeach version of windows has its own SDKs (DDKs in the case of drivers)

[@ArkenGAMES]

@@mattmurphy7030 I would have thought that windows has pretty good backwards compatibility and assumed that you don't have to maintain the same driver across multiple windows versions. That must suck. So there is a single global wifi driver pre installed in windows 8.1 that works for all wifi manufacturers and had that bug you were talking about?

[@int16_t]

There's also the WSAPoll bug and they didn't care until Win10 was released.

[@ThePlayerOfGames]

​@@ArkenGAMESnah it's that Microsoft broke the dependencies that WiFi device manufacturers use to build the firmware blobs into installable Windows drivers so that when the driver installs regardless of the manufacturer it will break Another reason the driver should be presented at the kernel level and treated sincerely as such, rather than slapping them on willy nilly

[@kissgergo5202]

For some reason I read the title as "microsoft patches IN extreme vulnerability" and I wasn't even surprised I was just curious what it was

[@jakewarren9]

@@kissgergo5202 underrated comment

[@arcanealchemist3190]

its their new crypto AI skibidi toilet update. it buzzwords your software and such

[@scotts918]

IPv6 is disabled on my machine because it wouldn't play nicely with Outlook... So a bug in one product, saved me from a security vulnerability in another 😅

[@howelon3099]

Turning it off actually doesnt prevent the bug from working just make sure that your windows is up to date

[@erikb4407]

@@howelon3099 7:44 So you interpreted "Systems are not affected if IPv6 is disabled on the target machine." to mean "Systems *are* affected even if IPv6 is disabled on the target machine." or am I missing something...

[@howelon3099]

@@erikb4407 Well when I read the original writeup it said even if ipv6 is disabled the packets bypass the firewall anyways and will execute the said packets/code. Maybe this is referring to something else?

[@Corteum]

@@howelon3099 If you look at the original writeup on the microsoft website for this specific CVE, it says under *Mitigations* _"Systems are not affected if IPv6 is disabled on the target machine."_

[@ThioJoe]

Me who always disables IPV6 because the long weird address is annnoying 😎

[@kodirovsshik]

mfw 127.0.0.1 instead of ::1 (the latter is longer and more annoying)

[@JonahTheWhite]

I always remove (with NTLite) or disable everything that's not really useful. One of them being ipv6.

[@kensmith5694]

Fun fact: There are still some computers that are running code written in COBOL. Be careful what you say nobody does

[@Sypaka]

The IRS does.

[@absurdengineering]

Fun fact: Another language in the “BOL” tradition - SNOBOL4 and SNOBOL5 (Oregon) has ancient syntax but awesome feature set for text data extraction and parsing, and is very much useful today. It may have COBOL vibes but wowzers is it miles better than trying to use regexes to extract data from non-regular-language input (CrowdStrike cough cough).

[@kensmith5694]

@@absurdengineering I just looked up SNOBOL. I knew of its existence but not the nature of the language.

[@mor4y]

@kensmith5694 there's a couple of banks near me offering damm good money for students to do COBOL, apparently saying their last few programmers are in their 60's and 70's(!), and have returned to work after retiring some years ago. They paid for eye surgery for one lol 😆

[@mor4y]

Oh yea, if you want a idea how dire their situation is, heck a cold winter could finish off their COBOL team 😬 the local Unis allow them to come it at fresher week and say to the Comp Sci students can you see yourself doing this? There's a paid 'apprenticeship' right this way if you do.... but every week that you learn more about new stuff you get further away from where we need you to be, so come now No other companies get that opportunity

[@Devvbot]

Heard him say "noone uses edge" thats all I need to know he hasnt a clue about enterprise.

[@Bob-wz4my]

Control systems use Microsoft Edge in IE mode.

[@Kane0123]

Plenty of things use it in the enterprise space… “we either have to upgrade the LOB system and pay a ton of cash… or set GPO to automatically open these in IE Mode.”

[@espfan9841]

Interesting fact: MS at some point took the TCP/IP stack from OpenBSD because they lost knowledge of their own sourcecode. Yet they still fucked up something robust anyway. There is also a story that they asked the Samba project to help them with their SMB protocol code because they also lost the knowledge. They refused because MS wasn't willing tho share information in the past.

[@DrDarkRyder]

I know it isn't really relevant to to the discussion at hand, but saying IPv6 has "billions and billions of addresses" (9:48) is just a *crazy* understatement of how many addresses IPv6 has. It's IPv4 that has "billions AND billions" - about 4.3 billion, in fact - while IPv6 is more like "billions OF billions… OF BILLIONS… of addresses *for each IPv4 address*". If you assigned an entire IPv4 worth of addresses, to every human who has ever lived, once a second, it would take about 21 BILLION YEARS (or about time and a half the current age of the universe) to exhaust IPv6. That is a BIG address space!

[@tomschi9485]

*What a shame that companies never have to take responsibility for grossly negligent behaviour. You know: router manufacturers who set the admin password to ‘admin’ because they think it's better than ‘1234’. *Such a law would be great, because then Microsoft would have to pay the customers, because M$ collects even critical error messages hundreds of thousands of times - and ignores them.*

[@jagdtigger]

10:21 I respectfully disagree, every reputable brand router will have the same defualt deny rule for IPv6 as they have on IPv4 in the firewall config.

[@kneesnap1041]

The problem is that the words "reputable" and "router" usually do not belong in the same sentence

[@jagdtigger]

@@kneesnap1041 Yeah sure, lets nit-pick about semantics while it is clear i simplified my point so normies can understand it......

[@kneesnap1041]

@@jagdtigger perhaps my point was missed, I was hoping to point out that users often do not get a choice what router they can use, I sure don't. I have 2 ISPs in my area, and one is DSL and would go out on an hourly basis, and when it did work it had less than 1MBPS download. So, I've realistically got only one option for my ISP. They refuse to service any router which isn't theirs, and their routers are extremely locked down. I don't have an option

[@jagdtigger]

@@kneesnap1041 You can always hook up yours after the ISP junk.....

[@apexberserker3057]

correction (5:10): the OSI model is a reference model and not actually used in practice. the TCP/IP model is used in practice, though OSI is taught as it's a good entry point into networking.

[@min3craftpolska514]

2024: The year of IT crazyness - vulnerabilities, outages, everything

[@catoleg]

"Nobody uses Edge or Edge in IE mode" I think Ed was speaking to us, viewers.

[@im1random263]

Can't believe that there are still people who don't use an adblocker lol

[@rowbart3095]

especially someone who is allegedly so computer literate

[@Vitis-n2v]

​@@rowbart3095it's probably on purpose to support creators or websites

[@Brahvim]

@@Vitis-n2v Or rather, it's because Ed is actually in a Windows VM to avoid getting his real fingerprinted get identified so he can protect his privacy.

[@Brahvim]

Could it be that he was running a Windows VM for privacy reasons? *_Resisting_* fingerprinting is its own way to getting fingerprinted, LOL.

[@Hmm-p9t]

I don't either. I'd rather have my data be stolen by microsoft, google, and other large companies than some unknown browser extension. I don't have ANY browser extension at all. I used to have quite a few and a well-known one in them got hacked one day and I believe it stole my credentials from sites. So I had to change my credentials and reset my computer. Chrome extensions can't really be trusted. The Chrome web store, most obviously, doesn't work like the google play store. Nothing is reviewed on there and there are no constraints over what the extension can access, obviously because most extensions need to access site data such as dark mode readers, and ad blockers, for example.

[@Tenetri]

Pv6 security is more important than I thought! This bug sounds wild - gotta go patch Windows now. Keep up the great vids!

[@felixhex]

@@Tenetri it is, also take a look at the android security bulletin, yeah, it's udp in general, buuuuut, probably easier to exploit with ipv6, there was an unauthenticated, remote code execution in Android's network stack, too

[@ivok9846]

plot twist: you're not on ipv6, just like most of the planet....

[@JohnWilliams-gy5yc]

Crowdstrike: The "Patch Tuesday" is not even close to "Stranded Friday."

[@nomore6167]

"Crowdstrike: The 'Patch Tuesday' is not even close to 'Stranded Friday.'" - I can't say I agree with that. I would much rather have my computer crash and refuse to boot than have a malicious actor take control of it remotely, especially if they can do so without any user interaction.

[@kalfeher]

Correction regarding the IPv6 reach-ability topic. The true protection we get from NAT is the statefulness capability that it forced on dinky home routers. that same statefulness also protects IPv6 hosts, regardless of whether they have an internet routeable address or not. If the connection didnt initiate from my host, it doesnt matter that you can guess my IP. if it _did_ initiate from my host NAT won't protect me from those dodgy packets. This particular vuln would be most effective in places where a host is not behind a firewall or where the malicious actor is already behind the firewall. roaming wifi, some cellular networks, weak govt agency networks, that sort of thing

[@ivok9846]

in other words: how would these "carefully crafted" malicious ipv6 packets even reach my pc if adsl modem/router has all ports closed? and pc has firewall. in that case i have to click something, somewhere...which is same as openiong suspicious mail attachments.... so....not really 9.8 of 10 vulnerability with all those factors. and...well....i'm not on ipv6 anyway.....i hear half the germans are....hehe.....

[@kalfeher]

@@ivok9846 IMO it's still a 9.8. I don't think CVEs should assume anything about local networks when assessing risks. But for the rest of us, its an important reminder that stateful firewalls are useful, IPv6 does not equal direct internet access and maybe stay away from MS Windows.

[@techgeeknzl]

That assumes the dinky router in question even bothers to run a firewall on IPv6.

[@ivok9846]

@@techgeeknzl are you on ipv6?

[@MikeRI170]

NAT can be punched through if you spoof the packet so that it matches one of the opened connections, both for ipv4 and 6.

[@ToyKeeper]

I still haven't enabled ipv6 yet... not even sure if my ISP supports it. But still, it's amazing to see a vuln of this level these days.

[@nickwallette6201]

Likewise. Other than networking that is invisible to us end users (cellular data), I don't actually know a single person or company that I work with, that is using IPv6. I know that's not how things are everywhere, but like... _both_ times in a couple decades of being in IT that someone has asked for support with IPv6, I've had to go back .. again .. and learn it all .. again .. because I never ever have to use it for anything. Part of me is curious whether the sluggish adoption is inevitable (if you have something that works, why bother?), or if it's just because IPv6 is a convoluted mess of a stack that changed so much more than it needed to, and the lack of uptake is more because no network engineer wants to deal with it if they don't absolutely have to.

[@richardokeefe7410]

The figures I've seen say that Edge has 5% of the browser share. It simply isn't true that "nobody uses it".

[@trail.blazer]

Not just Edge, but Edge in IE mode. That means it is really running Internet Explorer with an Edge wrapper.

[@BlueBetaPro]

@@trail.blazer I doubted that would be true and that it would probably just emulate IE like changing the user agent header and a bunch of other compatibility settings but you're actually right it ships with the "Trident MSHTML" browser engine that was first released in 1997, and apparently that means a bunch of new web standards totally wont work. Microsoft is wack. I do not envy anyone who has to maintain software made for IE mode, must be a pain in the ass.

[@abcdqwerty3562]

@@BlueBetaPro Is it really Microsoft that is wack? The reason Microsoft is providing it is that there are ancient pieces of software only compatible with it. So it’s the enterprises using such software that are ‘wack’, if anything.

[@BlueBetaPro]

@@abcdqwerty3562 I know it's not wack to provide the backwards compatibility in the first place but it's the way that they went about it from a technical perspective that sounds wack. From a web development perspective it's really incompatible with modern standards despite being in a modern browser, and from a software development perspective it's lazy to include something that I assume is quite a large binary/library into the application just to provide a little bit of backwards compatibility.

[@ThePlayerOfGames]

The number of users is inflated as Microsoft force edge to launch by overriding default settings Plus Windows 11 silently uses edge to run user-implied search requests

[@Hezeri]

"Systems are not affected if IPv6 is disabled on the target machine." Oh, so basically every Windows machine I've had to touch is already unaffected. IPv6 is one of the first things I disable on any machine and I have never needed it in local network environment.

[@Vifnis]

1:40 "no one uses Edge" I would like to point out -- for all it's flaws... *MS* does a *FANTASTIC* job with the *READ ALOUD* function it is TOP TIER ! ! !

[@Nerd3927]

yep, use that too, to check on my own documents. You can read across missing words, but hearing it read aloud you spot all the things the spelling checker misses.

[@niv8880]

@@Nerd3927 Hmmmmmm... I need to check this out

[@nikolatasev4948]

The Edge tab management is the best. I wish Firefox could do that.

[@tranthien3932]

LLL: "No one uses Edge in IE mode." The comments section: "You just activated my trap card!" Large companies: "Guess I'll die" Banks: "First time?" Me: *grab popcorn*

[@mytechnotalent]

This is a huge deal. Thank you for this. I was hoping to catch you at DEFCON but hopefully next year!

[@rifle]

1:40 I can't speak for everyone, but there are some systems I have worked with that still require the compatibility mode for their web app to function, and this is in Health Care, although it may not be many, the impact that could have on patient privacy needs to be taken into consideration

[@GrannyDryden]

This reminds me if the issue back in the day, with Windows XP SP1 called "Raw Sockets". This was a vulnerability that allowed attacker to attack a system remotely, outside of the standard TCP/IP protocol and allowed attackers to be able to manipulate both the Transport and IP Layers. It was kind of a big deal back then and a major reason why, Microsoft implemented a firewall in Windows XP SP2.

[@Josh4x4]

I’ve never heard IPv6 explained so succinctly.👏👏👏

[@byAnArgentinian]

I always have ipv6 disabled by default. There's a lot of privacy and security concerns about being directly out with an unique address.

[@RoddyDev]

firewalls exists for that. and NAT for IPv4 is a hack and was never meant for security.

[@byAnArgentinian]

@@RoddyDev It was not, but it's a by product of the workaround.

[@techgeeknzl]

IPv6 also has an implementation of private-enhanced addresses; whereby your OS can use unique, randomly generated addresses for different sessions.

[@christianalvarado528]

I thicked ever insecurity box: - A stupidly large number of open ports. - Having SMB (v1) enabled all the time. - Turning off antivirus always. - Questionable custom Firewall rules. Turns out randomly choosing to disable IPv6 would actually save my ass.

[@bocote3119]

Unrelated but, adblockers are your best friends

[@charliecharliewhiskey9403]

Plenty of people use Edge. And even those who don't, still have times where they use edge, because windows continues defaulting links into Edge regardless of your chosen browser. And as others have said, there are many corporates that still rely on legacy IE mode for Edge. Saying "noone uses Y" is weird in a world where Southwest Airlines was able to escape the Crowdstrike issue solely because their systems are all Windows 3.1 or 95 and where banks are still running Fortran-based systems.

[@guymenashe6856]

Love your security technical reviews !!❤ I think it would also be cool if you would do this as a series about Snowdens leaks

[@AnonymousAnarchist2]

one thing that really gets me. Why is consumer, programer, and buisness service windows the same windows? Seems like Microsoft is inviting problems. Its one thing to have cross compatability, its another to try and make the same product for all of them

[@UNcommonSenseAUS]

Somebody found the cia's backdoor & thry had to cover their asses

[@originzz]

If it were that easy they wouldn't be the CIA

[@UNcommonSenseAUS]

@@originzz one of their access paths likely Waa discovered. Let's not forget that your: CPU Gpu Bios Cables TV Phone Entire life is backdoored. There is no privacy, soon we will see covid & 1940s esque neighbours snitching on neighbours and anyone they can in order to win favour with big brother. Dangerous times ahead

[@jenpsakiscousin4589]

I still use win7, I don’t get to participate in patch Tuesday anymore

[@Ttarler]

Edge is basically mandatory for the large government agency I work for. I think usage is somewhat higher than you would expect.

[@lennox3094]

Instant subscription. Keep up your awesome work

[@nomore6167]

So, in other words, to take control of a Windows system which has IPv6 enabled, an attacker simply needs to know the IPv6 address of a target machine and send a specially-formed packet (or series of packets) to it. The saddest part of this is not that this vulnerability exists, but rather that it's not surprising. Microsoft (and all other companies) needs to either fire all of its programmers for negligence or stop releasing software until they patch all of the existing security vulnerabilities and audit the software to find all vulnerabilities that are currently unknown (and fix them, too). It's infuriating that virtually nobody who writes software thinks of security as a priority. Security should be the top priority, far ahead of performance and "how quickly can we get this product released".

[@TheDoomSlayerButPettingaCat]

I love that everyone is talking about "Edge in IE mode"

[@Lukeff7]

Love your channel, I am fairly technical due to my career and interests in computers and so I enjoy how you recap stuff, explain stuff but also don’t go so far as sucking eggs. Subscribed!

[@lauram5905]

I used to work for a company that was using IBM's SAP HR platform which required all the computers to be versions of windows that still supported full IE (so it was Windows 7 across the board), not to mention it had an antique Java backend

[@usefirefox]

Can we please have a break from worldwide critical IT messups 😩😩😭 I’m gonna cry

[@cancer5895]

pause for "7 days" saves me again

[@endunry]

"So you and i can use our PC in a safer way" *laughs in Linux*

[@bokami3445]

The problem is that hackers use these patches to see what Microsoft is patching and then reverse engineer and/or start investigating the code that is being patched and discover how to use the exploit. I give it a few days before the IPv6 TCP/IP stack *is* being used to exploit systems in the wild. Patch or disable IPv6 on your NIC interfaces NOW!

[@geroffmilan3328]

So many comments about Edge & IE when there's a CVSS 9.8 RCE in TCP/IP. Corporate machines will get patched pretty quick, the concern will be those "unpatchable" devices, since we need to assume this bug has existed in the codebase of older OS, IPv6 is fully routabble, edge security may not be blocking the affected traffic, and patch reversing is a whole thing for motivated attackers & curious minds.

[@darkfox2401]

Edge is Also a background process windows uses to operate. so you don't have to use there browser to lose everything.

[@Oxxygen_io]

well a quick google says you get roughly 2.5 pow(21) IP addresses per grain of sand in sahara, still way way to big to visualize. given that 7506320 grains of sand per sqf, and average depth of sand is 200feet. Some large numbers like this, what is understandable is that we no longer need NAT :D

[@mhdm]

As a security researcher you should set a good example and use an ad blocker.

[@AttilaAsztalos]

Except unless your Grandma is somehow still managing to use XP or Win7, she IS PATCHING, whether she bloody likes it or not, pretty much every time she turns on her computer.

[@burtburtist]

@@AttilaAsztalos ?

[@SreenikethanI]

@@burtburtist watch from 3:54 onwards

[@burtburtist]

@@SreenikethanI i mean how is someone just using whatever came with their pc patching, the os stopped getting patches, i dont imagine them manually going through the kb catalogue, just disabling update notifications

[@ZipplyZane]

@@burtburtist Because Windows automatically updates (and forces restarts), and you cannot override this without knowing a decent bit about computers. The only way a Windows 10+ computer wouldn't be updating is if it isn't online. But then it isn't vulnerable.

[@burtburtist]

@@ZipplyZane thanks for the actual answer, i didnt consider it working as intended i guess, the windows 7 failing to update bug seems pretty common, and im pretty sure 7 was no longer getting updates anyway, forgot if the update to 8 then 10 or whatever was truly automatic but its been a hot minute since ive run 7 myself.

[@babayega1717]

appreciate you spreading the word.

[@epic-buffalo]

No one uses Edge, until you realise that google won't allow you to block ads...

[@bmanpura]

A lot of people hated NAT and welcomed IPv6 back when it was first introduced. I was still at high school or uni back then. Can't believe NAT nowadays are desired for the security side-effects. Wish Internet were less hostile like the old days.

[@lassipulkkinen273]

Honestly it's really weird how he seemed to imply a lack of firewalling for IPv6 would be the user's fault. Obviously that's a terrible default -- no NAT != no firewall. I'm sure there are some sloppy routers out there that do that, but I should also add my own anecdote of a router whose IPv6 firewalling was so effective you couldn't disable it at all; turning of the firewall only applied to IPv4. Also very annoying, but at least it's secure.

[@Tabu11211]

When ,"I have your ip" means something haha

[@beauxq]

I think what he meant was: "Nobody that we care about uses Edge in IE mode."

[@AlbatrossCommando]

IPV6 considered harmful. Seriously though how the hell am I first hearing of this here? Thanks for the info, I updated my machine.

[@TheIncredibleLaser]

IPv6 Windows Implementation considered harmful more like

[@7etsuo.c]

Love your content man.

[@TSgotstolengoddamm]

When he stated that the extreme vulnerability is related to ipv6 i laughed as i always disablr that on every machine i get :)

[@SterileNeutrino]

If you want to pick up a necessary skill (that should be in first semester but wasn't truly mentioned at my uni except in electronics engineering): "Practical UML Statecharts in C/C++ - Event-Driven Programming for Embedded System". Nothing complex or trendy, just a great book explaining the skills one should have. Pricey though, it's that luxury CRC company (and suddenly you understand why Godot is doing what it does in the way it does it)

[@hi_im_crimson]

so what is the vulnerability. you just said that its ipv6 because there is no nat needed.

[@Novastar.SaberCombat]

Gone are the days of Woz's Apple II. 😓 I miss the 80's.

[@Dagobah359]

"No one uses Edge." Well, that's not true. They based it on Chromium and a lot of people no longer have any resistance to the MS pressure to use it, so use of Edge is increasing. "No one uses Edge in IE mode." Oh, bless your heart. You've never worked in the DoD. I'm sure you'll feel really safe learning that a LOT of DoD systems are outdated and can only be accessed using IE or Edge in IE mode.

[@dewmi4403]

Me waiting for the day when thumbnail says "Playing this video can hack your computer"

[@mechwarrior83]

did anyone figure out where the bug was? @7:50

[@T1ppyTaps]

"No one uses Edge in IE mode" Anything to do with the DEA: hold my beer.

[@seansingh4421]

Microsoft having severe RCE vulnerabilities ? And the sky is blue

[@bborkzilla]

Another Windows vulnerability? I'm shocked, SHOCKED!

[@AlexanderBelikov]

Silverlight apps could only run in Edge in IE mode. But even if one is running, the new URLs would be opened in normal not-IE mode in Edge

[@firetroll91]

As an IPv6 stan this saddens me! Knee jerk reaction will be to turn off IPv6 and never turn it back on. IPv6 does have a private address range. Hopefully router manufacturer default will be to use these addresses and not a public addresses for your LAN Link-Local addresses are a god send when a remote device gets replaced with a spare and you get the call that it's not working.

[@Lue30499]

No, please. Do not use IPv6 private ranges. They are there for a legacy reason. Your router should use DHCP-PD to ask for a range from your ISP. Then your router will announce that range via SLAAC to the internal networks. IPv6 is designed to not need DHCP server. The concept of public v private is a characteristic of your firewall. Your internal networking being publicly routeable doesn't mean they are publicly accessible.

[@nickwallette6201]

@@Lue30499 I will never, ever understand this ridiculous notion. "Let's not have private addresses anymore! YAY! Everyone is directly on the Internet!" and it's equally daft companion ... "NAT is not security!" Except _it literally is._ If you're not reachable directly via the Internet, you are not vulnerable to exploits that attack you ... directly ... from the Internet. The route just does not exist. "So use a firewall that blocks incoming traffic." And that's fine. _If you do it._ With IPv4, and the near-ubiquitous usage of NAT imposed by the IP shortage, there was basically no choice. Everyone was behind a one-way filter by a matter of course. With IPv6 ... eh. It's optional. The problem with that, of course, is that.... _it's optional_ ... and therefore, it _will_ be turned off. (Or just never turned on.) More to the point, you won't necessarily know, because it works either way. IPv6 has gazillions of IPs. There's no need to conserve. But that doesn't mean NAT isn't still a really good *layer* to have in the security stack. Removing it from conventional network design was the dumbest freakin thing about IPv6. And there are a lot of dumb things about IPv6.

[@lassipulkkinen273]

How can you be an "IPv6 stan" and advocate for IPV6 NAT?

[@HaveYouHeardOfManedWolves]

​@@Lue30499what meaningful difference does being publicly routable make if it doesn't allow packets the user may not have expected or prepared for to reach the device?

[@galacticminx]

@@lassipulkkinen273 I'd take everything said by someone who's username contains "troll" with a grain of salt.

[@geweurzgurke]

Well shows how little IPv6 is used even after 25 Years😜

[@ezgarrth4555]

Any day now!

[@ElectronicInspiration]

2025 will be the year of IPv6!!!

[@clashcon11]

NAT cancel IPv6

[@nickwallette6201]

Doing a ping-sweep on IPv6 is a little like the SETI mission statement. There's gotta be somebody out there somewhere.... right? I guess bounds-checking code in the IPv6 stack is down there on the priority list, when having malformed packets hurled randomly at your machine from the ether would be an event so novel that it might inspire the plot of a science fiction movie.

[@galacticminx]

@@clashcon11 "NAT cancel IPv6" This. The problem it was designed to solve no longer exists.

[@tuxrandom]

Good thing that one of the first things I do on a new machine is to disable IPv6 for the crapton of QoS issues it causes for me. (Ignoring that I don't use Windows for anything important.)

[@Zuff21]

You should make a video on the killchain methodology. You have a great way of drawing parallels

[@Wkaelx]

every single day, every day, every week there is a new zero day exploit a new data leak, bro whats happening

[@thetso99]

Shiiiish! Sir, great job! Very interesting to listen!

[@todayonthebench]

To be fair, the two bad things to take away from this video is: 1. IPv6 forgoes a major advantage of public vs privet networks. This is honestly a bigger security issue. Why were this logical easily defended boarder considered unnecessary? 2. TCP/IP on Windows for IPv6 is currently insecure. Ie, two compounding issues that honestly makes the whole situation worse for most people. But at least a lot of people don't have an IPv6 address to start with, since a lot of ISPs haven't yet adopted such, despite it soon being 3 decades since its inception.

[@endunry]

While yes, the most that are watching this already know about IPAdresses, but i basically just Forward this to my family so they Update their PC so i appreciate explaining this a bit more on a surface level.

[@tonym5857]

Great content 👌👏

[@reidarcederqvist]

I work with developing router operating system, and we always block incoming traffic from WAN. But I agree that people look at ipv6 as if nat was still in use. For example I was tasked with creating a gui page for "ipv6 port forwarding" 😆

[@kneesnap1041]

Dude I'm shocked. I had no idea IPv6 didn't have any form of NAT. I suspect there's a LOT of other software engineers who didn't know this either. How has this not been plastered everywhere? I just don't understand.

[@o0alessandro0o]

Is it me or remote escalation bugs in pieces of software that should be decades old (and therefore bug free) are getting more and more common? What exactly *is* patch Tuesday these days? Adding two bugs for every one you fix?

[@BobSockTwo]

Hello, I'm just here to flex on most people here and say that I'm using Linux even though no one asked me.

[@mikerope5785]

Arch Linux user confirmed.

[@temposparkz]

Plot twist they actually use windows 11 jk

[@AntonioZL]

I use Arch, btw.

[@dazealex]

Does using a Mac count? Nobody asked me either. I'll go back to my over paid walled garden... Sorry.

[@klukva3296]

Surely linux have 0 vulnerabilities

[@Coffeemancer]

there are 365 days in a year, there are 1,208974 major exploits every year

[@michamichalski8633]

In terms of regular Edge (no IE mode) - I’m using it and actually enjoy it very much. Best organization features I’ve seen in any web browser due to workspaces and collections. Bit sad about the starting page not being customizable but I don’t care. Rarely see it anyways.

[@howardelton6273]

Many companies use Edge on their managed operating environments (MOE) for Windows Clients and indeed Servers, and in fact we actively have been removing Chrome due to all of the security vulnerabilities that is was getting compared to Edge (issues not related to the common Chromium compoent). When you have to do regular patching cycles and off-cycle urgent securty patching for many different software tools (Microsoft, Google, Adobe etc), it makes sense to consolidate the number of update points if you can, without impacting the users' ability to work effectively. It's more efficient and easier to maintain. No real need for Chrome in a Microsoft Azure environment, for example, unless you have some wierd software that is somehow dependent on Chrome (highly unlikely situation since Edge move to Chromium though). I am not saying that that Edge is better than Chrome al the time, but it is better in those type of corporate situations. Obviously IE Mode is just asking for trouble, but this can be locked down using group policy.

[@MsHojat]

My guess is that this bug requires computers to be connected directly to the internet not through a router. While common 20 years ago these days it seems like it never happens, at least where I live.

[@galacticminx]

IPv6 doesn't require NAT. It's entirely possible for your computer's network interface to be publicly addressable, even when it's behind a home router. This is the "default security" you get with NAT that he was talking about, which doesn't apply to IPv6.

[@MsHojat]

@@galacticminx yeah I heard him that part, but I was thinking that traffic will still typically go through the router even though it isn't necessary for IPv6. I could definitely be wrong though.

[@h4ktbtw]

Great coverage of this week’s patch. Also, Ed seems to be a little bit out of sync with audio 😅

[@Nyxar-2077]

2:12 I'm curious why you are allowing ads?

[@scscyou]

Is there a reason why no tools like anti-viruses are built to protect from these threats when we're behind with patches? Surely there must be a suspicious behavior executed if it's ever abused.

[@ragectl]

This is different to the 0.0.0.0 security fixes? Damn that's crazy