Fusker - a NodeJS security system that attacks back
1–10 of 36 posts
Re: Fusker - a NodeJS security system that attacks back
#2It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you decide to use.
Hate to be a killjoy, but things like this are usually not a good idea. Unfortunately, somebody has to rediscover that every six months or so.
edit: nevermind, I was going off of hilariously out-of-date information. TCP ISNs haven't been easy to predict in -- gulp -- about a decade. Damn, now I feel old.
Re: Fusker - a NodeJS security system that attacks back
#3It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you…
Fair enough, 'attacking back' might be a bit of overkill, but you can't deny the utility of a pluggable module that spots possible attacks (as connectjs middleware, for instance). What I got out of this is a simple way to implement some form of protection on my site.
Re: Fusker - a NodeJS security system that attacks back
#4It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you…
You'd have to have a high level of control of the network that the server lives on in order to do this sort of spoofing of tcp connections for arbitrary IP addresses.
And if you had that level of control anyway, you wouldn't need to spoof attacks against the server, you could just redirect all incoming requests to a different server which returns whatever HTTP response headers or bodies that you want.
So your described attack is highly unlikely to ever happen.
Re: Fusker - a NodeJS security system that attacks back
#5It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you…
> is run a script that launches lame attacks with spoofed IPs against a fusker site
How do you spoof your IP in TCP? If you spoof your source address you shouldn't be able to get past the handshake.
Re: Fusker - a NodeJS security system that attacks back
#6It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you…
I'm not an expert, but HTTP travels over TCP and, if I remember correctly, TCP uses sequence numbers to prevent IP spoofing.
Re: Fusker - a NodeJS security system that attacks back
#7It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you…
> is run a script that launches lame attacks with spoofed IPs against a fusker site How do you spoof your IP in TCP? If you spoof your source address you shouldn't be able to get past the handshake.
http://en.wikipedia.org/wiki/TCP_sequence_prediction_attack
You spoof the IP address you are sending from and then predict the TCP sequence number so you can make it look as though you are receiving the replies (even though they are going to another machine since you spoofed the IP address).
Such an attack was proposed by Hacker News' very own rtm: http://tools.ietf.org/html/rfc1948
Re: Fusker - a NodeJS security system that attacks back
#8It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you…
Good point. Altough a funny tought to see some company redirect it's customers to goatse.
I think, a more realistic approach for example would be a ssh honeypot like kippo (https://code.google.com/p/kippo/).
Re: Fusker - a NodeJS security system that attacks back
#9I love the idea, but I think the fighting-back tricks are a bit disappointing. I expected stuff like "uses its own botnet to ddos the attacker". Yeah yeah, stupid, not realistic. But redirecting to goatse? Come on. That's less exciting than a garfield comic.
Re: Fusker - a NodeJS security system that attacks back
#10It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you…
[deleted]