[deleted]
I may be the only evil bit user on the internet
31–39 of 39 posts
Re: I may be the only evil bit user on the internet
#32While a very good story, I suspect the offending firewalls might drop traffic with any of the reserved bits set, not just the "evil" bit. Very fun exercise though!
It looks like they're performing exactly to spec, which states packets with the evil bit set MUST be dropped.
Re: I may be the only evil bit user on the internet
#33The "security by obscurity" bit is interesting. I'm now imagining a server where it checks that the initial sequence number of the SYN packet ends with your current OATH two-factor authentication code, or something, and it drops the packet if you have the wrong code. (Which elevates it quite a bit past simply "obscurity.") The traffic is indistinguishable from normal SSH traffic, and there's very little code that has…
While not quite to the same level of obfuscation, your suggestion reminded me of this project:
http://www.cipherdyne.org/fwknop/
Its essentially port knocking with a single encrypted packet.
Haven't tried it (yet) myself but sounds interesting.
Re: I may be the only evil bit user on the internet
#34The "security by obscurity" bit is interesting. I'm now imagining a server where it checks that the initial sequence number of the SYN packet ends with your current OATH two-factor authentication code, or something, and it drops the packet if you have the wrong code. (Which elevates it quite a bit past simply "obscurity.") The traffic is indistinguishable from normal SSH traffic, and there's very little code that has…
See fwknop and the history of port knocking.
Re: I may be the only evil bit user on the internet
#35The "security by obscurity" bit is interesting. I'm now imagining a server where it checks that the initial sequence number of the SYN packet ends with your current OATH two-factor authentication code, or something, and it drops the packet if you have the wrong code. (Which elevates it quite a bit past simply "obscurity.") The traffic is indistinguishable from normal SSH traffic, and there's very little code that has…
I just hope that anyone doing that only does it with private networks. I still remember that painful time I had to debut the fact that someone was blocking the heartbeat TLS extension by simply dropping traffic and I had a product that most of the time sent that extension by default ("everything else can connect, so it's clearly your fault that you cannot"). I also hope that said network actually patched Heartbleed, but I sincerely wonder about that.
Re: I may be the only evil bit user on the internet
#36> Is it that someone didn’t see the date of the RFC, maybe sarcasm doesn’t translate very well, possibly someone in the real world actually sent the evil bit when doing evil things, and cause some products to target it? I think it was done just for fun. It is slightly concerning that a live equipment has such a joke enabled, but I'd say its fun-to-price ratio is relatively high.
I'm not intimately familiar with the RFC's but you could argue that since that bit is technically `reserved` when it's set the packet is 'invalid' and thus should be dropped (by some manufacturers reasoning maybe, not mine specifically)? Also: IIRC IP packets contain CRC's/checksums of some sort. I'm not sure if the poster corrected for that or maybe the other side does(n't) and somewhere the CRC doesn't check out an…
I don't know about RFC reserved bits, but I believe the linux kernel's policy is to enforce that any unused bits (in say, a bit flag field) MUST be zero, because otherwise some programmer will leave them uninitialized or something and break everything when they suddenly have meaning.
Re: I may be the only evil bit user on the internet
#37Earlier quoted context omitted.
This seems like a really bad thing to do. If any of those reserved bits get used for a legitimate purpose in the future then none of these networks will be accessible. Reserved should mean "set to 0 when you send, ignore on when you receive". It's not like these bits actually cost any additional processing. There's literally no benefit to dropping these packets, and it's shenanigans like this that mean we can't impro…
Firewalls and other middleboxes are notorious about doing very bad things like this to the detriment of the internet as a whole. See PMTU discovery, why it was impossible to deploy TCP RED or SCTP, etc.
"Windows DNS is broken" was a meme for about five years due to Cisco ASA's blocking EDNS traffic.
Re: I may be the only evil bit user on the internet
#38Funny enough, we found a practical application for this during my time at BreakingPoint. The BPS-1000 appliance would mix a huge number of concurrent streams through a device under test; we added a feature to flag the exploit traffic as evil by setting the RFC 3514 bit: https://strikecenter.ixiacom.com/articles/permalink?month=06...
This made it easier for manufacturers of IDS/IPS/UTM/NGFW equipment to quickly isolate false negatives during fully loaded tests.
Re: I may be the only evil bit user on the internet
#39The "security by obscurity" bit is interesting. I'm now imagining a server where it checks that the initial sequence number of the SYN packet ends with your current OATH two-factor authentication code, or something, and it drops the packet if you have the wrong code. (Which elevates it quite a bit past simply "obscurity.") The traffic is indistinguishable from normal SSH traffic, and there's very little code that has…
See fwknop and the history of port knocking.
Some information on this is located in the fwknop tutorial: