5 ms·
I like this explanation. But is this good network security?
by banku_brougham 9y ago
I like this explanation. But is this good network security?
- deleted 9y ago[deleted]
- laser 9y agoNo, just good humor :)
- sillysaurus3 9y agoIt will make your pentesters sad. We like movies.
- fweespeech 9y agoIt depends if you want to annoy human pentesters to give you the finger. Also, no.
- userbinator 9y agoSomewhat tangentially related: a long time ago, certain scanning tools would crash or otherwise not react well to getting a stream of /dev/urandom. You could consider this the more human version.
- mattstreet 9y agoAnd then someone uses you in an DoS amplification attack instead of going after you directly.
- snorkel 9y agoNope. Good fun but not good security. Better to just refuse the connection.
- ChuckMcM 9y agoI did a killclient which would send back a malformed packet to any ssh handshake and kill the connecting client. This made the pentesters mad. Sending them spoilers will just make the sad, and not so mad.
- pbhjpbhj 9y agoIs that a feature or was that a hack. Did the same packet kill multiple clients? More info?
- ChuckMcM 9y agoIt was a hack, I was getting a nice regular supply of probes from Brazillian addresses, connect to port 22, try 5 different passwords on several different ids ad naseum. So I hacked the openssh server to start mutating the response packets. (very trivial genetic programming where the 'fitness' function value was time to respond between calls, longer = better) That went on for a while until the mutated response was somewhere around 10K bytes and then the call would just stop. A couple of weeks after that I got DDOS'd from a Brazilian botnet. Fail2ban cleaned that up but in practical terms it was easier to just use fail2ban on all of that.
- Crespyl 9y agoThat sounds extremely interesting, do you have a write up or source code somewhere? I'd be interested to hear about more applications of adaptive/genetic code to network security.
- ChuckMcM 9y agoI think it sounds more complicated than it is, think of it as response fuzzing. It is exactly like trying to find vulnerabilities in servers by sending them fuzzed packets except in this case you're trying to find vulnerabilities in clients by returning a fuzzed packet.