Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

github.com

Post reply on HN
Print view View original

51–56 of 56 posts

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#51

Post by catlifeonmars »

ranger_danger wrote: post #47
megous wrote: post #44

Earlier quoted context omitted.

You don't need websockets, just Connection: Upgrade to anything you want. You can upgrade directly to ssh protocol and just pass on decrypted data from https socket to local port 22 from then on with no further processing.

Proper DPI can tell that wouldn't be acting like a typical HTTP stream, encrypted or not.

Hehe true, SSH traffic is so characteristically obvious that the packet size and timing can be used as a side channel to leak information about a session.

Tangential: but I recall reading about a similar technique used on SRTP packets to guess the phonemes being uttered without needing to decrypt the traffic.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#52

Post by ranger_danger »

catlifeonmars wrote: post #51
ranger_danger wrote: post #47

Earlier quoted context omitted.

Proper DPI can tell that wouldn't be acting like a typical HTTP stream, encrypted or not.

Hehe true, SSH traffic is so characteristically obvious that the packet size and timing can be used as a side channel to leak information about a session. Tangential: but I recall reading about a similar technique used on SRTP packets to guess the phonemes being uttered without needing to decrypt the traffic.

I guess you would need to either mimic a protocol that always uses a fixed packet size/rate (like a MPEG-TS video stream or something), or artificially pad/delay your packets to throw off detection methods.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#53

Post by megous »

ranger_danger wrote: post #47
megous wrote: post #44

Earlier quoted context omitted.

You don't need websockets, just Connection: Upgrade to anything you want. You can upgrade directly to ssh protocol and just pass on decrypted data from https socket to local port 22 from then on with no further processing.

Proper DPI can tell that wouldn't be acting like a typical HTTP stream, encrypted or not.

would not be able to tell from websockets uses

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#54

Post by ranger_danger »

megous wrote: post #53
ranger_danger wrote: post #47

Earlier quoted context omitted.

Proper DPI can tell that wouldn't be acting like a typical HTTP stream, encrypted or not.

would not be able to tell from websockets uses

I think most websockets do not sustain large amounts of bidirectional traffic for prolonged periods, so IMO this would immediately be suspicious.

Re: Show HN: SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPI

#56

Post by megous »

ranger_danger wrote: post #54
megous wrote: post #53

Earlier quoted context omitted.

would not be able to tell from websockets uses

I think most websockets do not sustain large amounts of bidirectional traffic for prolonged periods, so IMO this would immediately be suspicious.

My typical ssh session does not either.
Post reply on HN