Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

github.com

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#22

Post by bmenrigh »

Large volumes of SMTP-like traffic are a huge red flag. Competent companies an ISPs should already be looking for large volumes of outbound mail to identify abuse / spam bots / data exfiltration.

If I came across this in netflow data I'd first assume outbound spam. But a hallmark of sending mail is that the client to server byte ratio is extremely skewed towards client -> server bytes, whereas running a VPN-like service is usually more balanced but still skewed towards server -> client bytes. I'd see the large server -> client byte count and immediately know something strange was going on.

That said, very little code here is involved in looking like SMTP. The SMTP obfuscation basically boils down to a few lines of plaintext between the client and server before a STARTTLS and then everything after that has nothing to do with SMTP. You could swap out the fake stub conversation quite easily to look like many other protocols. Whether the in to out bytes ratio makes sense for those protocols is another matter.

These days, I think the best thing to disguise as is HTTPS. There is so much variety in HTTPS traffic and such a huge volume of it, that spotting hidden tunnels is very hard.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#25

Post by jeroenhd »

montyanne wrote: post #3
thedougd wrote: post #2

Quite a few things use STARTTLS. I imagine the same technique could be applied to those other protocols, giving users some options as they fight hostile networks. Clever

Just curious - how much of this was AI generated? The readme has crazy emojis & the code was all checked in at once, which is usually my telltale for these kinds of things. Didn't see anything crazy in the source files. I think its polite to indicate AI agent usage in security related projects like this since they can have huge holes if they're just being vibe coded. -- Edit: Intended to post this on the board root,…

High emoji use is something I've noticed a certain generation/subgroup of developers just default to. Keeps things informal/quirky. The AI had to steal that style from someone, after all. This repo is actually very low on the emoji side.

Looking through the code itself, I can't tell if it's AI generated or not, but I wouldn't assume the use of emoji automatically mean AI wrote the text.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#26

Post by compsciphd »

bmenrigh wrote: post #22

Large volumes of SMTP-like traffic are a huge red flag. Competent companies an ISPs should already be looking for large volumes of outbound mail to identify abuse / spam bots / data exfiltration. If I came across this in netflow data I'd first assume outbound spam. But a hallmark of sending mail is that the client to server byte ratio is extremely skewed towards client -> server bytes, whereas running a VPN-like serv…

a former company I was at, didn't allow outbound ssh (which I liked to enable me to vnc into boxes at home). I installed installed a webvnc application on my home machine (protected by https / password) and was able to access it without an issue.

When I left the company they went through my outbound email and were like "why did you forward an email you got out of the company". That e-mail was a friend visiting and me getting sent their picture from the lobby telling me that I had a visitor (so figured it be cute to share the image with them). I was amused that they only bothered to ask me as I was leaving, not when it actually occurred.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#27

Post by ralferoo »

This seems daft to me as it would be trivial to identify on a network. Real SMTP will have significant data flow in one direction towards the destination, will close the connection fairly quickly once it's transferred (so no pauses) and has very little traffic being returned. It's hard to think of a worst protocol to try to hide a proxy in.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#28

Post by GoblinSlayer »

pogue wrote: post #9
zamadatix wrote: post #7

Earlier quoted context omitted.

TECHNICAL.md lays it out a bit more, but it claims to be RFC 5321 compliant with a realistic initiation sequence so it should somewhat look like a real SMTP server for the first bit. Ending up on any DNSBLs shouldn't be a problem unless you have a static home IP you plan on running an actual SMTP server from after this though.

>SMTP traffic on port 587 (submission) is expected and normal Any residential dynamic or static IP with this port opened is definitely going to get flagged. Most ISPs already prevent these ports from being open, either by policy or by residential routers. It would probably very quickly end up on something like SpamHaus's PBL, which looks for this kind of thing.[1] I would imagine you would also find yourself on Shoda…

Spamhaus blocks port 25, not 587. If they blocked port 587, they would blanket ban all email clients.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#29

Post by lateral_cloud »

bauruine wrote: post #11
m132 wrote: post #4

That's an interesting protocol choice, especially given the purpose. SMTP is probably the most filtered protocol on residential networks, SMB being a runner-up.

SMTP isn't filtered it's port 25 that is. And from a short look at the readme it looks like it's using the transmission port 587 which shouldn't be filtered.

Any decent firewall these days is layer 7 aware. The port doesn't make a difference
Post reply on HN