Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate/Fix Cryptographic issues #20

Open
utoni opened this issue Feb 27, 2020 · 1 comment
Open

Investigate/Fix Cryptographic issues #20

utoni opened this issue Feb 27, 2020 · 1 comment

Comments

@utoni
Copy link
Owner

utoni commented Feb 27, 2020

As mentioned by @cdpxe in #16:
Some important points has to be investigated and fixed (see: https://onlinelibrary.wiley.com/doi/full/10.1002/sec.1471):

  1. Sniffing of header/payload: The payload is usually SSH/VPN/stunnel based and encrypted. But it is still possible to do a payload or timing analysis to detect the encapsulated protocol. Also the header is not encrypted and therefor can leak important data to middleboxes.
  2. Man-in-the-middle attack: Data send/recv is neither authenticated nor integrity checked - header/payload data can be modified ad libitum. The client/server has no chance to discover such cases.
@utoni utoni added this to the Crypto issues. milestone Feb 27, 2020
@utoni utoni changed the title Investigate/Fix issues reported by @cdpxe in #16 Investigate/Fix Cryptographic issues Feb 27, 2020
@cdpxe
Copy link

cdpxe commented Feb 28, 2020

One more comment: I believe that a low-haning fruit would be to implement the magic number as described in section 5.1 of our paper. This will already prevent several rules (e.g. Snort rules) from working correctly as they simply filter for the magic number :) It would then also make it easier to prevent rule-based blocking of the ping tunnel traffic.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants