Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deep packet inspection is dead, and here's why (2017)

security.ias.edu

Post reply on HN
Print view View original

101–110 of 126 posts

Re: Deep packet inspection is dead, and here's why (2017)

#101

Post by hrez »

rocqua wrote: post #25

I'm worried about this development. One the one hand, ubiquitous encryption is simply required for security on the internet. Things like lets encrypt and warning on http are great improvements. On the other hand, the owner of a network has some right to look into the packets on that network. Especially if the owner of the network also owns the end-points of that traffic. My main use-case here isn't corporate networks…

Just wait for devices with 5G modem. They will skip your network control entirely.

Re: Deep packet inspection is dead, and here's why (2017)

#102

Post by xemdetia »

anonymousisme wrote: post #49

It's not dead. Encryption has (unjustifiably) pushed the enterprise to install fake catchall certificates on proxies so they can snoop plain-text traffic. (Why anyone would ever think this is a good idea is beyond me.)

There's plenty of this stuff at the US government level for data exfiltration and the fact that ordinary websites can have XSS or other funny business going on. For instance there's EINSTEIN https://www.dhs.gov/einstein.

There's also the opposite of what the initial boon of DPI gave you for egress traffic and instead doing DPI on ingress traffic in places in front of critical applications using things like SSL bump and so on. This seems worse but better in a way, where the DPI is part of the secure system instead of doing a carte blanche decrypting streams (the traffic that the internal secure system receives is in fact the traffic that it is party to instead of just wile e coyote to the universe). It's very hard to detect targeted attack to third party enterprise webapps otherwise.

Re: Deep packet inspection is dead, and here's why (2017)

#103

Post by jandrese »

zrm wrote: post #96
jandrese wrote: post #72

Earlier quoted context omitted.

How else are you going to catch APT (Advanced Persistent Threat) data exfiltration/control channel traffic? Assumption 1: Machines on your network are already compromised and fully owned by a sophisticated and extremely difficult to detect rootkit. This is true of every large business. There is always that guy who will click on any link or open the document from what appears to be their co-worker. Assumption 2: APT t…

> There is always that guy who will click on any link or open the document from what appears to be their co-worker. Which is another reason why DPI is ineffective. The smart malware will identify when its connection is presenting a custom root certificate rather than the expected one and not proceed with its suspicious activities (if not deploy some kind of steganography). Then the same "that guy" will plug his perso…

I'd argue that those examples are a higher bar to hurdle than failing to recognize a spear phishing attack, and can be mitigated by solutions like always-on VPN.

And if the malware doesn't work because it has certificate pinning, well, that's a win too. Its not a 100% solution, but you can significantly raise the bar on your attackers.

Re: Deep packet inspection is dead, and here's why (2017)

#104

Post by jsperx »

mabbo wrote: post #20

A few years ago, one of the best managers I ever worked for left to become the CTO of a company doing pattern analysis of network traffic, rather than Deep Packet Inspection. The premise was that most of the internet traffic on your network follows the same typical patterns, but nefarious traffic doesn't. Drop their system into the network and voila, you can start to find the weird things going on that seem out of th…

What was the name of the company? My management responsibility at work includes networks (by default, we are small) and I always say I don’t have to know/care that you’re using BitTorrent (encrypted/port shifting), so much as there’s an anomaly on the network impacting others. I’d rather have something flagging “hmm this is atypical” based on size/src/dst/ports then try to make rules ahead of time that might miss new trends.

Re: Deep packet inspection is dead, and here's why (2017)

#105

Post by adrianratnapala »

This sort of development seems good, not exactly from an moral point of view, but from the point of view of long-term reliability of the internet.

The IP protocols have some expectation of end-to-end packet delivery. Over time we found ways in which networks could be kept "working" with this requirement relaxed. Except what could be known to "work" was just whatever was tested by the manufacturers of various middle-boxes, making change and development of new ways of solving problems harder than it should be.

The less visibility middle-boxes have into what the the traffic is, the less they are able to selectively screw things up and the internet will be more reliable for it.

Re: Deep packet inspection is dead, and here's why (2017)

#106

Post by [deleted] »

TeMPOraL wrote: post #100
diminoten wrote: post #99

Earlier quoted context omitted.

Techies don't "know" this, I want to be abundantly clear that having a technical background doesn't make you more savvy to security concerns -- if this were true, the prevalence of security problems throughout the industry wouldn't be nearly as pervasive. Security isn't about being perfect, so stop pushing that false narrative. It's about being good enough, and plenty of companies making smart TVs can certainly becom…

I'm not talking security. I'm talking user-hostile practices and bad engineering.

[deleted]

Re: Deep packet inspection is dead, and here's why (2017)

#107

Post by diminoten »

TeMPOraL wrote: post #100
diminoten wrote: post #99

Earlier quoted context omitted.

Techies don't "know" this, I want to be abundantly clear that having a technical background doesn't make you more savvy to security concerns -- if this were true, the prevalence of security problems throughout the industry wouldn't be nearly as pervasive. Security isn't about being perfect, so stop pushing that false narrative. It's about being good enough, and plenty of companies making smart TVs can certainly becom…

I'm not talking security. I'm talking user-hostile practices and bad engineering.

Then you're even more offbase, in addition to being off topic.

Re: Deep packet inspection is dead, and here's why (2017)

#108

Post by jethro_tell »

kevin_thibedeau wrote: post #93
jethro_tell wrote: post #70

Earlier quoted context omitted.

yeah, while that's true, a manufacture like amazon or apple is much more likely to update your device since they are still hoping to sell you content. You think your offbrand Smart TV is going to update past a couple bugs? They already made all the money they are going to make off that TV and they are done. Still have to trust the manufacture for that to work, but at lease you're not just left wide open there. (I mea…

That's where RokuTV has an edge. They deploy firmware updates and have a consistent track record of supporting old hardware better than any of the consumer electronic giants with proprietary systems.

might be, I'd take a smart tv that was backed by roku, apple, amazon, or even microsoft over some low budget company that doesn't really care once they've made the sale.

I prefer to just have a screen and a box though. I cut the wifi out of my TV and only plug it in to update firmware a few times/year.

Re: Deep packet inspection is dead, and here's why (2017)

#109

Post by aeternus »

DenisM wrote: post #89
wernercd wrote: post #71

Earlier quoted context omitted.

Smart TVs can be left unconfigured and not plugged in via Ethernet.

I would also smash any 2.4gz antennas inside the TV for a good measure. They might not have access to your WiFi network, but the XFinitiWiFi is available to any TV maker for a modest sum of money. That, or you can buy a commercial display instead of a TV.

4G radios are also pretty cheap now and antennas can be embedded on-circuit..

Might need to invest in a large Faraday cage

Re: Deep packet inspection is dead, and here's why (2017)

#110

Post by amaccuish »

rocqua wrote: post #25

I'm worried about this development. One the one hand, ubiquitous encryption is simply required for security on the internet. Things like lets encrypt and warning on http are great improvements. On the other hand, the owner of a network has some right to look into the packets on that network. Especially if the owner of the network also owns the end-points of that traffic. My main use-case here isn't corporate networks…

It's a major bugbear I have with Android. Now most apps don't by default respect CAs you've added, even via MDM. They get marked differently and can only be used by VPN, WiFi, ActiveSync, and apps that opt in to your custom certs.
Post reply on HN