lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 31 Dec 2014 22:54:59 +0100 From: Julian Kirsch <kirschju@....in.tum.de> To: netdev@...r.kernel.org CC: Christian Grothoff <christian@...thoff.org>, Jacob Appelbaum <jacob@...elbaum.net> Subject: [PATCH] TCP: Add support for TCP Stealth -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, one year ago [0] we tried to convince you to add support for a new socket option to the linux kernel. Equipped with an improved version of our patch we're back to accomplish this task today. :-) TCP Stealth is a modern variant of port knocking which borrows techniques from network steganography to enable clients to authenticate themselves towards a server on TCP level. You can find technical details in an rfc draft we wrote earlier this year [1] and in my master's thesis [2]. In summary, TCP Stealth derives authentication information from a pre-shared secret and embeds it into the ISN sent along with the first SYN from the client. Our motivation is simple: During this year we gained hard evidence on secret services actively port scanning the internets followed by exploitation of your services using 0-day exploits [3, 4]. We don't want our machines to be turned into relays from where they continue to cascade their attacks. TCP Stealth makes port scanning more expensive by a factor of 2^31 (on average). A copy of this patch as well as patches for several user space applications can be found on the project's home page [5]. All the best for the upcoming year, Julian & Christian [0] https://lkml.org/lkml/2013/12/10/1155 [1] https://datatracker.ietf.org/doc/draft-kirsch-ietf-tcp-stealth/ [2] https://gnunet.org/kirsch2014knock [3] http://www.heise.de/ct/artikel/NSA-GCHQ-The-HACIENDA-Program-for-Internet-Colonization-2292681.html [4] https://firstlook.org/theintercept/2014/12/13/belgacom-hack-gchq-inside-story/ [5] https://gnunet.org/knock -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJUpHCvAAoJENwkOWttRRA4g10IALbJZU9/5Gp8tVdpXqbkOIMp Kz+yOMyYULqYeM8yguSBZjZLbaz/VAS7SNpQxKGU+W0aAXa22FsSfVoUU7wqp3NT 3EGRuPkMaJkQ66IP8MtX+6/hSeWSh78tEaIFWVjyutihPyQGz0LefFc66gm54X4T s8IYW7jKFhNmmROu9CXLTxq4B5t2v+Evv/qWqotZqR1t3IbIUmZAiKrlkMRd7dtM SaS5JwFeiObxn+0M/7javQCAhfgPXYEOU0QKAGY55MXcPAner/5PuExIZdOJ41R3 XD9tgoLGhHEiQkxj0/bP2cs3Cl5xfJl9t2iecVfTIR7PytaTJ/kFuE4gNgWEcTA= =T6/C -----END PGP SIGNATURE----- View attachment "tcp_stealth_3.18.diff" of type "text/x-patch" (18521 bytes) Download attachment "tcp_stealth_3.18.diff.sig" of type "application/pgp-signature" (287 bytes)
Powered by blists - more mailing lists