4 ms·

The Curious Case of Port 0 (2019) [pdf]

75 points by elvis70 6y ago

tux 6y ago
Here is a similar article by Daniel Stenberg the "curl" author. "Pretending port zero is a normal one" (Oct. 25, 2014) https://daniel.haxx.se/blog/2014/10/25/pretending-port-zero-is-a-normal-one/ https://daniel.haxx.se/blog/2014/10/25/pretending-port-zero-... I'm suprised no one has used this port as an attack vector yet. I'm sure many even miss this port in there iptables.
- gumby 6y ago
  According to the posted article it is used for DDOS attacks.
WarOnPrivacy 6y ago
We home-hosted a modestly successful Minencraft server for 4 years. Occasionally, some disgruntled player would aim a booter service at us. Most of those DDoS attacks were aimed at port 0.
- tux 6y ago
  Very interesting, this is first time I heard of DDoS/Zero ^_^ Did you keep any logs on this?
  - WarOnPrivacy 6y ago
    It's possible. I'll peek around and post back if I find one.
bombcar 6y ago
I’m surprised port zero packets aren’t just randomly dropped by various internet infrastructure devices. Perhaps they’ve been burned by reserved things suddenly becoming used.
- zamadatix 6y ago
  Most of the devices on the internet don't even know the packets they are forwarding are TCP/UDP let alone care about which port number is being used.
nerdponx 6y ago
> When you open a listening socket on a host and request port 0 from the operating system, this call is typically interpreted as a request to return a single, currently unused port to the application But... why? Surely some kind of separate BIND_UNUSED_PORT operation would have been fine, without needlessly overloading the meaning of "port 0".
- toast0 6y ago
  They could have done something like that, but then you need to pass more than a 16-bit value in for port number. Back when that was a concern, limiting to only 65535 usable ports wasn't a big deal. Now, you probably could use a larger integer and pass a flag to really bind to port zero, other than there's probably a lot of network equipment that will drop it. If you also run on an IPv4 address with a final octet of 0 or 255, you'll have a really hard to reach service.
- Joker_vD 6y ago
  Having a specific port number to mean "pick a random unused port" is very useful when you run any application that opens a listening TCP socket and takes the port number from the config. More often than not, the default behaviour (when the port is not specified) is to use some hardcoded port number like 5555 or something. But what if you want to run two/three/many copies of this app, dynamically, without them interefering with each other? One possibility is to do manual free port detection--but it's inherently racy. Another one is to specify port 0 and get the actual port number from the application by some side channel (say, by reading it from stderr/log file). Now, I assure you that if this "some kind of separate BIND_UNUSED_PORT" operation was available in the Berkeley socket API from the start, it would be mostly unused, people would've just used normal bind() instead (it's way simpler), so the latter option simply becomes impossible: you have to manually pick the free ports for temporary servers. In fact, there are some existing applications that actively refuse to listen on port zero, for example, "ssh -D 0" doesn't work for some reason (patching it to remove the zero check breaks nothing, everything keeps working properly), and they're somewhat annoying to use transiently.
  - nerdponx 6y ago
bernardand 6y ago
According to the posted article it is used for DDOS attacks.
theskyo 6y ago
We need to differentiate 2 things: * Port 0 and DDoS: This is usually just a measurement artifact. Reflection-Amplification attacks create UDP packets larger than the current MTU, which leads to fragmentation and hence packet fragments without a UDP header -- however they are still identified as UDP because the ip.proto field is still 17, i.e. UDP). Interpreting such packets often leads to "port 0" instead of "port None", eg in IPFIX. * Port 0 in the actual traffic. This has to be done via RAW sockets, since this usually signals the OS to use ANY port (especially if binding). This technique has been used ages ago (20 years? see Gobbler tool) to fingerprint operating systems, because they all responded differently to such packets.
andrewnicolalde 6y ago
Anyone else getting certificate issues?
- axiolite 6y ago
  You must be using HTTPS-Everywhere or similar add-on. The link is http:// http:// so nobody should be connecting via SSL.
- tigerente 6y ago
  Here's the paper from the research group's page: https://www.cyber-threat-intelligence.com/publications/IFIPNetworking-2019-port0.pdf https://www.cyber-threat-intelligence.com/publications/IFIPN...

75 points by elvis70 6y ago

tux 6y ago

Here is a similar article by Daniel Stenberg the "curl" author. "Pretending port zero is a normal one" (Oct. 25, 2014) https://daniel.haxx.se/blog/2014/10/25/pretending-port-zero-is-a-normal-one/ https://daniel.haxx.se/blog/2014/10/25/pretending-port-zero-... I'm suprised no one has used this port as an attack vector yet. I'm sure many even miss this port in there iptables.

gumby 6y ago
According to the posted article it is used for DDOS attacks.

WarOnPrivacy 6y ago

We home-hosted a modestly successful Minencraft server for 4 years. Occasionally, some disgruntled player would aim a booter service at us. Most of those DDoS attacks were aimed at port 0.

tux 6y ago
Very interesting, this is first time I heard of DDoS/Zero ^_^ Did you keep any logs on this?
- WarOnPrivacy 6y ago
  It's possible. I'll peek around and post back if I find one.

bombcar 6y ago

I’m surprised port zero packets aren’t just randomly dropped by various internet infrastructure devices. Perhaps they’ve been burned by reserved things suddenly becoming used.

zamadatix 6y ago
Most of the devices on the internet don't even know the packets they are forwarding are TCP/UDP let alone care about which port number is being used.

nerdponx 6y ago

> When you open a listening socket on a host and request port 0 from the operating system, this call is typically interpreted as a request to return a single, currently unused port to the application But... why? Surely some kind of separate BIND_UNUSED_PORT operation would have been fine, without needlessly overloading the meaning of "port 0".

toast0 6y ago
They could have done something like that, but then you need to pass more than a 16-bit value in for port number. Back when that was a concern, limiting to only 65535 usable ports wasn't a big deal. Now, you probably could use a larger integer and pass a flag to really bind to port zero, other than there's probably a lot of network equipment that will drop it. If you also run on an IPv4 address with a final octet of 0 or 255, you'll have a really hard to reach service.
Joker_vD 6y ago
Having a specific port number to mean "pick a random unused port" is very useful when you run any application that opens a listening TCP socket and takes the port number from the config. More often than not, the default behaviour (when the port is not specified) is to use some hardcoded port number like 5555 or something. But what if you want to run two/three/many copies of this app, dynamically, without them interefering with each other? One possibility is to do manual free port detection--but it's inherently racy. Another one is to specify port 0 and get the actual port number from the application by some side channel (say, by reading it from stderr/log file). Now, I assure you that if this "some kind of separate BIND_UNUSED_PORT" operation was available in the Berkeley socket API from the start, it would be mostly unused, people would've just used normal bind() instead (it's way simpler), so the latter option simply becomes impossible: you have to manually pick the free ports for temporary servers. In fact, there are some existing applications that actively refuse to listen on port zero, for example, "ssh -D 0" doesn't work for some reason (patching it to remove the zero check breaks nothing, everything keeps working properly), and they're somewhat annoying to use transiently.
- nerdponx 6y ago

bernardand 6y ago

According to the posted article it is used for DDOS attacks.

theskyo 6y ago

We need to differentiate 2 things: * Port 0 and DDoS: This is usually just a measurement artifact. Reflection-Amplification attacks create UDP packets larger than the current MTU, which leads to fragmentation and hence packet fragments without a UDP header -- however they are still identified as UDP because the ip.proto field is still 17, i.e. UDP). Interpreting such packets often leads to "port 0" instead of "port None", eg in IPFIX. * Port 0 in the actual traffic. This has to be done via RAW sockets, since this usually signals the OS to use ANY port (especially if binding). This technique has been used ages ago (20 years? see Gobbler tool) to fingerprint operating systems, because they all responded differently to such packets.

andrewnicolalde 6y ago

Anyone else getting certificate issues?

axiolite 6y ago
You must be using HTTPS-Everywhere or similar add-on. The link is http:// http:// so nobody should be connecting via SSL.
tigerente 6y ago
Here's the paper from the research group's page: https://www.cyber-threat-intelligence.com/publications/IFIPNetworking-2019-port0.pdf https://www.cyber-threat-intelligence.com/publications/IFIPN...