netdev - Re: [PATCH v2] add stealth mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFnufp1_JAutAm7LZsQXXPspipUy4n2C9K3Li+jsWzNpgqYBJw@mail.gmail.com>
Date:	Mon, 13 Jul 2015 01:13:44 +0200
From:	Matteo Croce <matteo@...nwrt.org>
To:	Austin S Hemmelgarn <ahferroin7@...il.com>
Cc:	Valdis Kletnieks <Valdis.Kletnieks@...edu>,
	Nicolas Dichtel <nicolas.dichtel@...nd.com>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] add stealth mode

2015-07-08 15:32 GMT+02:00 Austin S Hemmelgarn <ahferroin7@...il.com>:
> On 2015-07-06 15:44, Matteo Croce wrote:
> Just to name a few that I know of off the top of my head:
> 1. IP packets with any protocol number not supported by your current kernel
> (these return a special ICMP message).

Right, I'll handle them

> 2. SCTP INIT and COOKIE_ECHO chunks when you have SCTP enabled in the
> kernel.

Well, I've never played with SCTP before

> 3. Theoretically, some IGMP messages.
> 4. NDP messages.
> 5. ARP queries looking for the machine's IP addresses.

Yes I know, but it's unlikely to receive this packets from WAN, right?
My flag is intended to be used mostly on WAN interfaces,
machines in LAN should be easily discoverable IMHO

> 6. Certain odd flag combinations on single TCP packets (check the
> documentation for Nmap for more info regarding these), which I believe
> (although I may be reading the code wrong) you aren't accounting for.

I've tried many TCP flags combination with hping3, NUL, SYN/ACK, ACK,
SYN/FIN, etc.
They doesn't get any response when the flag is set

> 7. DAD queries.

Never looked at this packets, are a subset of NDP?

> 8. ICMP address mask queries (which you also don't appear to account for).

It's deprecated and actually it doesn't get any response already

> This is by no means an exhaustive list, but all of them really should be
> addressed if you want to do this properly.
>
>

Thank you,
-- 
Matteo Croce
OpenWrt Developer
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER
 -----------------------------------------------------
  * 1 1/2 oz Gin            Shake with a glassful
  * 1/4 oz Triple Sec       of broken ice and pour
  * 3/4 oz Lime Juice       unstrained into a goblet.
  * 1 1/2 oz Orange Juice
  * 1 tsp. Grenadine Syrup
 -----------------------------------------------------
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html