4 ms·
I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this k
by teraflop 8y ago
I guess the biggest problem is that the mitigation isn't future-proof. Someday, there might be other command-line tools besides cURL that can be used for this kind of attack.
A better fix would be to just drop all incoming IPv4 packets that have the "evil" bit set. (https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt) Extending this protection to IPv6 is left as an exercise for the reader.
- StavrosK 8y agoAh, but what about packets that aren't evil, just gullible and manipulated by some third party?
- dvhh 8y agoThen add a "tainted by evil" flag to the ipv7 spec, or better, just add a "pure" flag to future ip spec.
- StavrosK 8y agoI think I'd almost prefer an "alignment" flag, so we don't mischaracterize all the Chaotic Neutral packets.
- wincy 8y agoWell if you’d read the RFC it’s obvious it’s your routers responsibility to flag those bits as evil. And if you’re using heuristic intrusion detection systems you need to do flag each bit as evil 50% of the time. It’s good we have such amazing protections in place.
- shmerl 8y agoIt's not like curl can't easily spoof a user agent either.
- kevin_thibedeau 8y agoWe can claim the LSB of the sequence number.