Hi all!
Recently I was wondering how top websites by Alexa are doing with security. Actually I was thinking to have a look from IPv6 perspective. Usually, security engineers forget about the firewalls, when it comes to IPv6.
Frankly speaking, I was surprised. Not by the security issues, but with the "readiness" of these websites to IPv6 world. ISPs usually say, that they are not interested in IPv6, because there is no content for users. Now I understand them.
10 000 top Alexa websites was researched. Here are some numbers.
Recently I was wondering how top websites by Alexa are doing with security. Actually I was thinking to have a look from IPv6 perspective. Usually, security engineers forget about the firewalls, when it comes to IPv6.
Frankly speaking, I was surprised. Not by the security issues, but with the "readiness" of these websites to IPv6 world. ISPs usually say, that they are not interested in IPv6, because there is no content for users. Now I understand them.
10 000 top Alexa websites was researched. Here are some numbers.
9.6%
of websites support IPv6. Not bad, you may think. No, that is bad. IPv6 is out for almost 20 years by now, so 9.6 of top websites is not so good.
39%
of IPv6-ready websites are hosted by Cloudflare. Awesome! These guys are doing really great things. 17.2% belong to Google :) Well done!
39
websites have IPv6 address, but no open ports. This means, that they are not working for users with active IPv6.
These are the stats on opened TCP ports on hosts, that have both IPv4 and IPv6 running:
IPv4 "wins" because of the following factors:
These are the stats on opened TCP ports on hosts, that have both IPv4 and IPv6 running:
- Not all services automatically bind to IPv6 address. I can see, that there are bunch of services running on IPv4 address, but only web is up on IPv6.
- Cloudflare hosted websites (39% of all scanned) have 80, 443, 8080 and 8443 ports opened on IPv4 addresses, whereas 8443 is closed on IPv6.
Anyhow, there are some hosts with undesired opened ports on IPv6 address. SSH opened there, SMTP here, and so on.
Of course, if to dig deeper and have a look at not just a website, but to research whole IPv6 infrastructure of these companies, we might find some serious security threats, but that would take a lot of time and effort. Scanning an IPv6 range is an impossible task in a foreseeable future (/64 block that is usually assigned to any logical entity has 2^64 = 18446744073709551616 addresses, so good luck with scanning). So conducting an audit of IPv6 network is extremely interesting field for a security engineers.
No comments:
Post a Comment