{"id":2557,"date":"2020-07-28T09:18:09","date_gmt":"2020-07-28T13:18:09","guid":{"rendered":"https:\/\/zzzptm.com\/wordpress\/?p=2557"},"modified":"2020-07-28T09:18:09","modified_gmt":"2020-07-28T13:18:09","slug":"check-all-your-rfc-1918-ranges","status":"publish","type":"post","link":"https:\/\/zzzptm.com\/wordpress\/?p=2557","title":{"rendered":"Check ALL Your RFC 1918 Ranges…"},"content":{"rendered":"\n

Let me set the scene: a customer<\/a> asks about being able to track<\/a> users<\/a> that bring up unauthorized<\/a> VMs on Windows<\/a> machines. He explains that he’d like to look at the 192.168.0.0 RFC range to see how many addresses we see in that range. That’s OK by me, all I have to do is add that to the scope of the networks<\/a> we track…<\/p>\n\n\n\n

At that moment, we only looked at 10.0.0.0\/8. I added the 192.168.0.0\/16 range and we watched the new devices<\/a> pop up into the discovery window.<\/p>\n\n\n\n

And then we watched as those devices started to churn… the IP addresses<\/a> stayed the same, but the MAC<\/a> addresses kept changing. Loads of Netgear<\/a>, Arris, Cisco-Linksys, Belkin, TP-Link<\/a> devices… what was causing all this?<\/p>\n\n\n\n

The horror! The horror of the home networks!<\/em><\/p>\n\n\n\n

And then it dawned on us: these were all teleworker home networks bleeding into the corporate network<\/a> estate! The traffic<\/a> to and from 192.168 networks wasn’t supposed<\/em> to be routable, but here it was, coming and going and getting picked up on the SPAN session<\/a> monitoring<\/a> north-south traffic at the datacenter<\/a> gateway.<\/p>\n\n\n\n

192.168.1.1 and 192.168.0.1 were the addresses that changed MAC addresses most frequently. No surprise there, as those are default gateways<\/a> on oh-so-many home networking<\/a> products. 192.168.1.254 changed less often, as that was the default gateway<\/a> on Arris routers<\/a> used for AT&T broadband networks (I used to have one, so I know) and only a handful of other home devices. I saw Nest controls<\/a>, Roku streamers, gaming<\/a> systems<\/a>, the works. And all of this was exposed to the customer network<\/a>, and all of the customer network was exposed to these environments.<\/p>\n\n\n\n

Granted, there was going to be a mess as far as being able to route to any endpoint<\/a> for much time, but the IP<\/a> addresses that were less commonly used were also the ones with the most persistent MAC addresses and connections. The biggest concern was that the customer did allow any guest traffic on the wired<\/a> network – but here were untold numbers of guest devices, the kind that don’t usually show up on BYOD<\/a> networks!<\/p>\n\n\n\n

Moral of the story? Those teleworker devices for home office<\/a> networks are part of your perimeter. Make sure you keep an eye on those points of entry, as well as the big one you pay the ISP<\/a> for.<\/p>\n","protected":false},"excerpt":{"rendered":"

Let me set the scene: a customer asks about being able to track users that bring up unauthorized VMs on Windows machines. He explains that he’d like to look at the 192.168.0.0 RFC range to see how many addresses we see in that range. That’s OK by me, all I have to do is add that to the scope of the networks we track… At that […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-2557","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/2557","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2557"}],"version-history":[{"count":1,"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/2557\/revisions"}],"predecessor-version":[{"id":2558,"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/2557\/revisions\/2558"}],"wp:attachment":[{"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zzzptm.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}