Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Implementing fast TCP fingerprinting with eBPF

halb.it

Post reply on HN
Print view View original

31–40 of 42 posts

Re: Implementing fast TCP fingerprinting with eBPF

#31

Post by ethan_smith »

b0a04gl wrote: post #13

why do fingerprinting always happens right at connection start ,usually gives clean metadata during tcp syn. but what is it for components like static proxies or load balancers or mobile networks ,all of these can shift stack behavior midstream. this can make this activity itself a obsolete

TCP fingerprinting remains effective because most proxies and load balancers preserve the original TCP options and behaviors from the client, passing through the distinctive stack characteristics that make fingerprinting possible.

Re: Implementing fast TCP fingerprinting with eBPF

#32

Post by arewethereyeta »

OutOfHere wrote: post #2

More useless and harmful anti-bot nonsense, probably with many false detections, when a simple and neutral rate-limiting 429 does the job.

There are MANY cases for such an implementation. My service [1] implements such a thing, eBPF too, and my users do it for many valid reasons such as:

- shopping cart fraud

- geo-restricted content (think distributing laws)

- preventing abuse (think ticket scalpers)

- preventing cheating and multi-accounting (think gaming)

- preventing account takeovers (think 2FA trigger if fingerprint suddenly changed)

There is much more but yeah, this tech has its place. We cannot just assume everyone has a static website with a free for all content.

[1] https://visitorquery.com/

Re: Implementing fast TCP fingerprinting with eBPF

#33

Post by patmorgan23 »

ranger_danger wrote: post #27
noident wrote: post #26

Earlier quoted context omitted.

Who cares if they pay attention to 429s? Your load balancer is giving them the boot, and your expensive backend resources aren't being wasted. They can make requests until the cows come home; they're not getting anything until they slow down.

If you're rate-limiting by IP, well... some entire countries have only a handful (or one) externally visible IP.

For IPv4 sure, but have you heard of our Lord and Savior IPv6?

Re: Implementing fast TCP fingerprinting with eBPF

#34

Post by ranger_danger »

patmorgan23 wrote: post #33
ranger_danger wrote: post #27

Earlier quoted context omitted.

If you're rate-limiting by IP, well... some entire countries have only a handful (or one) externally visible IP.

For IPv4 sure, but have you heard of our Lord and Savior IPv6?

My local monopoly hasn't. Maybe in 20 years.

Re: Implementing fast TCP fingerprinting with eBPF

#35

Post by vetrom »

v5v3 wrote: post #30
spense wrote: post #29

i've been looking at this recently and this isn't just for bots. ebpf fingerprinting is how cloudflare quickly detects ddos attacks. https://blog.cloudflare.com/defending-the-internet-how-cloud...

What's the simplest way to implement eBPF filtering? As in a NFTables/Fail2Ban level usability.

something like https://github.com/renanqts/xdpdropper or cilium's host firewall or https://github.com/boylegu/TyrShield exist or https://github.com/ebpf-security/xdp-firewall today and implement ebpf filter based firewalling.

Of these there is a sample integration for XDPDropper to fail2ban that never got merged https://github.com/fail2ban/fail2ban/pull/3555/files -- I don't think anyone else has really worked on that junction of functionality yet.

There's also wazuh which seems to package ebpf tooling up with a ton of detection and management components, but its not a simple to deploy as fail2ban.

Re: Implementing fast TCP fingerprinting with eBPF

#36

Post by rkagerer »

Are there canned OS images / browsers / libraries / tools for resisting such fingerprinting? Similar in concept to how some browsers try to make themselves look homogenous across different users?

E.g. Can the MTU / Maximum Segment Size (MSS) TCP option be influenced from the client end to be less unique, retransmission timing logic deliberately managed, etc?

Re: Implementing fast TCP fingerprinting with eBPF

#37

Post by v5v3 »

vetrom wrote: post #35
v5v3 wrote: post #30

Earlier quoted context omitted.

What's the simplest way to implement eBPF filtering? As in a NFTables/Fail2Ban level usability.

something like https://github.com/renanqts/xdpdropper or cilium's host firewall or https://github.com/boylegu/TyrShield exist or https://github.com/ebpf-security/xdp-firewall today and implement ebpf filter based firewalling. Of these there is a sample integration for XDPDropper to fail2ban that never got merged https://github.com/fail2ban/fail2ban/pull/3555/files -- I don't think anyone else has really worked on tha…

Thank you

Re: Implementing fast TCP fingerprinting with eBPF

#38

Post by DamonHD »

ranger_danger wrote: post #27
noident wrote: post #26

Earlier quoted context omitted.

Who cares if they pay attention to 429s? Your load balancer is giving them the boot, and your expensive backend resources aren't being wasted. They can make requests until the cows come home; they're not getting anything until they slow down.

If you're rate-limiting by IP, well... some entire countries have only a handful (or one) externally visible IP.

And some of the bad bots are snowshoeing across many many IPs (and fabricating UAs). How is that load balancer going to help?

Re: Implementing fast TCP fingerprinting with eBPF

#39

Post by DamonHD »

halb wrote: post #8
OutOfHere wrote: post #7

Earlier quoted context omitted.

If it's making a legitimate request, it's not an automated attack. If it's exceeding its usage quota, that's a simple problem that doesn't require eBPF.

What kind of websites do you have in mind when I talk about fraud patterns? not everything is a static website, and I absolutely agree with you on that point: If your static website is struggling under the load of a scraper there is something deeply wrong with your architecture. We live in wonderful times, Nginx on my 2015 laptop can gracefully handle 10k Requests per second before I even activate ratelimiting. Unfor…

I run simple static sites from a (small) off-grid server at home. It has plenty of capacity for normal use, but cannot fully handle the huge traffic overshoots that bots and DoSes and poorly-written systems of household-name-multinationals inflict. I should not have to pay/scale to over-provision by an order of magnitude or more to stop the bullies and overbearing/idle from hurting genuine users. Luckily some relatively simple but carefully considered rules shut out much of the bad traffic while hurting almost no legitimate human visitor that I can find. Nuance and local circumstances are everything. But that took some engineering time on my part, that I also should not have had to spend. Particularly in fending off the nominally-nice multinationals.

Re: Implementing fast TCP fingerprinting with eBPF

#40

Post by mhio »

v5v3 wrote: post #30
spense wrote: post #29

i've been looking at this recently and this isn't just for bots. ebpf fingerprinting is how cloudflare quickly detects ddos attacks. https://blog.cloudflare.com/defending-the-internet-how-cloud...

What's the simplest way to implement eBPF filtering? As in a NFTables/Fail2Ban level usability.

https://bpfilter.io/ https://github.com/facebook/bpfilter https://lwn.net/Articles/1017705/
Post reply on HN