3 ms·

Wasn't Wireguard explicitly designed to avoid that? (IIRC it took lots of inspiration from state of the art data exfiltration methods used by malware)

bogantech 3y ago
IDK but Wireshark has no problem identifying it so there must be something that gives it away
- Aissen 3y ago
  They even have a nice comment explaining the heuristic: https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63aa8638076ec81dc9482972e9/epan/dissectors/packet-wireguard.c#L1618-L1625 https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63... * Heuristics to detect the WireGuard protocol: * - The first byte must be one of the valid four messages. * - The total packet length depends on the message type, and is fixed for * three of them. The Data type has a minimum length however. * - The next three bytes are reserved and zero in the official protocol. * Cloudflare's implementation however uses this field for load balancing * purposes, so this condition is not checked here for most messages. * It is checked for data messages to avoid false positives.
Starmina 3y ago
Not at all, WireGuard is secure, but very easily identifiable.
vbezhenar 3y ago
https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ The initiator sends this message: msg = handshake_initiation { u8 message_type u8 reserved_zero[3] u32 sender_index u8 unencrypted_ephemeral[32] u8 encrypted_static[AEAD_LEN(32)] u8 encrypted_timestamp[AEAD_LEN(12)] u8 mac1[16] u8 mac2[16] } msg.message_type = 1 msg.reserved_zero = { 0, 0, 0 } Seems like this is trivially detected. Just watch for first UDP packet with 01-00-00-00 bytes in the payload.
fruitreunion1 3y ago
No. https://www.wireguard.com/known-limitations/ https://www.wireguard.com/known-limitations/ >Deep Packet Inspection >WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however. >TCP Mode >WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation (see previous point), and can be accomplished by projects like udptunnel and udp2raw.

bogantech 3y ago

IDK but Wireshark has no problem identifying it so there must be something that gives it away

Aissen 3y ago
They even have a nice comment explaining the heuristic: https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63aa8638076ec81dc9482972e9/epan/dissectors/packet-wireguard.c#L1618-L1625 https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63... * Heuristics to detect the WireGuard protocol: * - The first byte must be one of the valid four messages. * - The total packet length depends on the message type, and is fixed for * three of them. The Data type has a minimum length however. * - The next three bytes are reserved and zero in the official protocol. * Cloudflare's implementation however uses this field for load balancing * purposes, so this condition is not checked here for most messages. * It is checked for data messages to avoid false positives.

Starmina 3y ago

Not at all, WireGuard is secure, but very easily identifiable.

vbezhenar 3y ago

https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/ The initiator sends this message: msg = handshake_initiation { u8 message_type u8 reserved_zero[3] u32 sender_index u8 unencrypted_ephemeral[32] u8 encrypted_static[AEAD_LEN(32)] u8 encrypted_timestamp[AEAD_LEN(12)] u8 mac1[16] u8 mac2[16] } msg.message_type = 1 msg.reserved_zero = { 0, 0, 0 } Seems like this is trivially detected. Just watch for first UDP packet with 01-00-00-00 bytes in the payload.

fruitreunion1 3y ago

No. https://www.wireguard.com/known-limitations/ https://www.wireguard.com/known-limitations/ >Deep Packet Inspection >WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however. >TCP Mode >WireGuard explicitly does not support tunneling over TCP, due to the classically terrible network performance of tunneling TCP-over-TCP. Rather, transforming WireGuard's UDP packets into TCP is the job of an upper layer of obfuscation (see previous point), and can be accomplished by projects like udptunnel and udp2raw.