4 ms·
What about a special set of bytes that are standardized that all IOT machines should send in every request. Some sort of IS_IOT signature. That way if there's a
by zeven7 10y ago
What about a special set of bytes that are standardized that all IOT machines should send in every request. Some sort of IS_IOT signature. That way if there's a huge influx, all messages containing the signature could be filtered.
- willglynn 10y agoRFC 3514 seems appropriate here: 1. Introduction Firewalls [CBR03], packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. The problem is that making such determinations is hard. To solve this problem, we define a security flag, known as the "evil" bit, in the IPv4 [RFC791] header. Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1. https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
- kccqzy 10y agoThis RFC was published on April 1.
- willglynn 10y agoQuite correct, but nonetheless, that RFC does explore the topic of "why not just mark the traffic?" One basic objection which detaro pointed out is that there's nothing to stop attackers from clearing such marks. As Wikipedia puts it: > The evil bit has become a synonym for all attempts to seek simple technical solutions for difficult human social problems which require the willing participation of malicious actors https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit
- detaro 10y agoThat would be quite complicated to integrate so deep into the stack that the malware running on a compromised device couldn't just ignore it.