5 ms·
Zeek (aka Bro IDS) is awesome for tracking down TCP QUANTUM injection attack incidents: something that Suricata and Snort are still unable to detect. Zeek scri
by egberts1 4y ago
Zeek (aka Bro IDS) is awesome for tracking down TCP QUANTUM injection attack incidents: something that Suricata and Snort are still unable to detect.
Zeek script: https://github.com/fox-it/bro-scripts https://github.com/fox-it/bro-scripts
Presentation: https://old.zeek.org/brocon2015/slides/hu_qi_detection.pdf https://old.zeek.org/brocon2015/slides/hu_qi_detection.pdf
- tptacek 4y agoIs "QUANTUM" what we're calling TCP hijacking now? From the Fox-IT presentation, it sure seems like this attack is identical to Joncheray's '95 "Simple Active Attack on TCP", and, like, every TCP hijacking tfile written after that. If that's the case, the reason Suricata and Snort might not detect it is that nobody cares; it's an extraordinarily situational, second-order, and low-impact attack.
- tedunangst 4y agoQuantum insert is actually rather simpler than that attack. Watch for GET request, passively, then inject a response, racing the web server. The real response arrives a millisecond late and gets dropped as duplicate. No need to desync streams.
- pixl97 4y agoOnly if your still running http without the s, right?
- tptacek 4y agoYes.
- Nullabillity 4y agoIf you care then you're already running TLS anyway, and they'd only be able to inject garbage. If you don't run TLS then it's already game over anyway.
- egberts1 4y agoLow-level, but yet still a useful tool of and by the determined.
- tptacek 4y agoIf it's what I think it is, it was extremely useful in the mid-1990s, when nothing was encrypted. Today, it's just one of 100 different ways to deliver a browser clientside exploit, and it's far from the most common or effective. But NSA gave it a stupid name, so people think it's important. It is not.
- egberts1 4y agoMost servers do not run a web browser. #headduck