4 ms·

One reddit user suspects that they are looking for TTL's on packets that do not match what iOS uses. I would love for somebody more knowledgeable about TCP/IP

by pak 16y ago

One reddit user suspects that they are looking for TTL's on packets that do not match what iOS uses. I would love for somebody more knowledgeable about TCP/IP on HN to evaluate the likelihood of this... http://www.reddit.com/r/technology/comments/g62wv/i_woke_up_this_morning_to_this_lovely_email_from/c1l6ixe http://www.reddit.com/r/technology/comments/g62wv/i_woke_up_... If this is the case, user agent spoofing will not work, and it would be quite a bit of hackery to trick iOS' IP stack into spoofing TTL's for packets from tethered devices.

signa11 16y ago
hmm, apart from ttl, you can use other tcp fields e.g. windows, tcp-options, packet-length etc. then, from a captured trace run passive os fingerprinting to find out with reasonable certainty the device generating the traffic. these can/may be manipulated via ip-tables, but then you still have a huge data-volume to account for...
- bostonvaulter2 16y ago
  Not to mention things like adobe checking for updates
- drdaeman 16y ago
  Can iPhone just route all your traffic through some encrypted VPN? I've heard there's a port of OpenVPN for iOS — that should be sufficient. At least you'll be sure telco guys are not inspecting your packets by any means, be it "teethering detection", blocking some kind of traffic, or something more malicious, like profiling your Google searches. (Timing analysis may still apply.)
- vlisivka 16y ago
  Yeah, it is trivial to analyze traffic of somebody else when you are working in FBI with court order...
drdaeman 16y ago
> [from Reddit link]> well there's no way you can set it to 256. With GNU/Linux iptables it's just one rule in the "mangle" table with TTL target. On *BSD with pf "packet normalization" can be done with pf's "scrub" directive with min-ttl option. Unfortunately, I've never used iOS and/or OS X/Darwin, so I don't know what are possibilities are there. But I believe there should be some.
- metageek 16y ago
  It can't be set to 256 because it's only 8 bits. (Edit: on reflection, if you know enough to know about the forwarding chains, I'm sure you know that TTL is 8 bits. Sorry.)
  - drdaeman 16y ago
    My bad, I probably didn't explain myself correctly. I was talking about modifying TTL of the forwarded packets on the phone, to make the packets look like they were originated from the phone itself.
    - metageek 16y ago
      OK, yeah. I don't know how MyWi works; if it forwards everything by hand, then it can definitely do that. If not, yeah, it's dependent on what the kernel can do.

by pak 16y ago

signa11 16y ago

hmm, apart from ttl, you can use other tcp fields e.g. windows, tcp-options, packet-length etc. then, from a captured trace run passive os fingerprinting to find out with reasonable certainty the device generating the traffic. these can/may be manipulated via ip-tables, but then you still have a huge data-volume to account for...

bostonvaulter2 16y ago
Not to mention things like adobe checking for updates
drdaeman 16y ago
Can iPhone just route all your traffic through some encrypted VPN? I've heard there's a port of OpenVPN for iOS — that should be sufficient. At least you'll be sure telco guys are not inspecting your packets by any means, be it "teethering detection", blocking some kind of traffic, or something more malicious, like profiling your Google searches. (Timing analysis may still apply.)
vlisivka 16y ago
Yeah, it is trivial to analyze traffic of somebody else when you are working in FBI with court order...

drdaeman 16y ago

> [from Reddit link]> well there's no way you can set it to 256. With GNU/Linux iptables it's just one rule in the "mangle" table with TTL target. On *BSD with pf "packet normalization" can be done with pf's "scrub" directive with min-ttl option. Unfortunately, I've never used iOS and/or OS X/Darwin, so I don't know what are possibilities are there. But I believe there should be some.

metageek 16y ago
It can't be set to 256 because it's only 8 bits. (Edit: on reflection, if you know enough to know about the forwarding chains, I'm sure you know that TTL is 8 bits. Sorry.)
- drdaeman 16y ago
  My bad, I probably didn't explain myself correctly. I was talking about modifying TTL of the forwarded packets on the phone, to make the packets look like they were originated from the phone itself.
  - metageek 16y ago
    OK, yeah. I don't know how MyWi works; if it forwards everything by hand, then it can definitely do that. If not, yeah, it's dependent on what the kernel can do.