Circumventing Deep Packet Inspection with Socat and Rot13
gist.github.com
Circumventing Deep Packet Inspection with Socat and Rot13
1–10 of 39 posts
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#2It's interesting how the pendulum of ideas swings back and forth over history, similar problems arise and similar solutions to them resurface also. It would be great to see that on some kind go graph or timeline.
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#3So once the maintainers of the deep packet inspection software read this they will add rot13 to their code.
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#4So once the maintainers of the deep packet inspection software read this they will add rot13 to their code.
Which would slow down inspection by a factor of 25 if it were to check the whole keyspace.
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#5So once the maintainers of the deep packet inspection software read this they will add rot13 to their code.
The use of rot13 was just an amusement in this case given its vintage. Replacing rot13 with any other simple stdin/stdout transcoder should be simple to do via the socat invocation, eg base64, a sed replace command, gzip/gunzip, even an actual symmetric encryption protocol like AES, etc.
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#6I don't get it. Why did you need SSH at all? The task was completed the moment a TCP connection was established to your server.
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#7So once the maintainers of the deep packet inspection software read this they will add rot13 to their code.
The author only used rot13 to make a point about the failure mode of inspection. DPI is only there to stop everyday employees from bypassing security policies inadvertently, not to stop an actual attacker. An attacker could use any number of other approaches: hiding payloads in innocuous keywords, using actual encryption, steganography, what have you.
I'm not a security expert but we had those kind of measures at a previous job and AFAIK they are there so that a lazy employee (me) doesn't just skip configuring their tools to go through Artifactory out of laziness and introduce a supply chain vulnerability. If "pip install XYZ" just worked out of the box, how likely would it be that all 10k devs in your organization would bother configuring it to avoid PYPI?
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#8So once the maintainers of the deep packet inspection software read this they will add rot13 to their code.
Which would slow down inspection by a factor of 25 if it were to check the whole keyspace.
Where does the keyspace come from? rot13 has no keys.
Of course you could do rot2 - rot24 and all the other combinations. Is that were the factor 25 comes from?
The deep inspection needs to look only at the first couple of bytes of each new a TCP connection. So it's not that disrupting. After 2 bytes you can already skip for a vast fraction of other traffic.
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#9The method is interesting as a mental exercise and its archaeological interest. If you are a company employee be careful about trying these or any other type of tunneling or deep packet inspection circumvention methods.
Some companies mention in their employment contracts these type of circumvention activities, unless explicitly allowed, are a firing offense.
Re: Circumventing Deep Packet Inspection with Socat and Rot13
#10Earlier quoted context omitted.
Which would slow down inspection by a factor of 25 if it were to check the whole keyspace.
Where does the keyspace come from? rot13 has no keys. Of course you could do rot2 - rot24 and all the other combinations. Is that were the factor 25 comes from? The deep inspection needs to look only at the first couple of bytes of each new a TCP connection. So it's not that disrupting. After 2 bytes you can already skip for a vast fraction of other traffic.
You'r right, the rot13 command is a shell wrapper around:
`
exec /usr/bin/caesar 13 "$@"
`
Forcing the key to be 13. You can obviously invoke /usr/bin/caesar with any of the 25 keys.