4 ms·

LOL. Good luck with that. It's trivially easy to detect this kind of TOS abuse, even if the traffic is encrypted. I'm all for the creation of bypass networks

by Nrsolis 12y ago

LOL. Good luck with that. It's trivially easy to detect this kind of TOS abuse, even if the traffic is encrypted. I'm all for the creation of bypass networks but suggesting that connecting those networks to a cable modem connection is just going to end badly.

tga_d 12y ago
"It's trivially easy to detect this kind of TOS abuse, even if the traffic is encrypted." It is? How? How could you possibly differentiate traffic coming from a single household with high bandwidth usage and a single person sharing their connection if it's all tunnelled over a VPN?
- Nrsolis 12y ago
  I won't go into detail here, but consider how de-anonymization of TOR network users is done with multiple layers of onion routing and encryption. All that needs to happen is that you correlate the injection of traffic to a particular node and then watch the actual traffic from a cable modem. You don't need to see the decrypted packets, you just need to know that when I inject N packets into a particular node, I get N packets out. Synchronized over a sufficiently long time series in a pattern that's only known to the attacker and you'll get a statistical certainty that a particular cable modem is being used for this kind of application and presto, your household is banned from the service. Like I said, trivial.
  - mindslight 12y ago
    Of course there's a solution to that too: For the VPN, choose a fixed packet size, and maximum bandwidth in packets per second (evenly spaced "ticks"). Every tick, if there is a packet waiting to transmit, send it with padding to the max size. Otherwise, send a dummy packet that is discarded by the remote. That's right telcos - we can reinvent circuit switching too!
    - Nrsolis 12y ago
      Is this just your idea? Or is it an actual working solution? Because people have known about padding for a while and yet we still have methods to de-anonymize TOR networks. When you use those techniques on a minor mesh network like this, it's an order of magnitude easier. Keep in mind that the cable company or broadband provider doesn't have to have much in the way of proof, just a suspicion and your connection will be terminated.
      - mindslight 12y ago
        It's a very simplistic idea I threw out there, and it should stand on its own - if the only thing the intermediate network ever sees is uniformly distributed packets at uniformly distributed times regardless of contents, there's simply no signal for correlation attacks. But it's clearly inefficient as fuck. > broadband provider doesn't have to have much in the way of proof This pretty much goes for any software that doesn't just visit Facialbook et al. Barring any sort of public utility regulation, the only way to push back against that is to get software widely deployed.
    - qq66 12y ago
      That means you have to pay for peak bandwidth 100% of the time.
  - MaxScheiber 12y ago
    I wouldn't exactly call that trivial if it needs to be "synchronized over a sufficiently long time series."
- gress 12y ago
  For one thing, traffic patterns, and the VPN endpoint would be a clue.
- pdkl95 12y ago
  Among many other methods (such as the deep packet inspection devices that have been common for quite a while), one particularly easy attack would be checking the TCP initial sequence numbers for changes in randomness[1]. Similarly, port number and usage can also be an easy tell when you see sockets opening on a pattern like this over time: [ ..., 15001, 15002, 15005, 9004, 9005, 15006, 9006, ...] Often IPmasq/NAT doesn't help either, as it can exhibit its own distinct pattern of port/etc usage often due to how router maintains its statefulness. [1] http://lcamtuf.coredump.cx/newtcp/ http://lcamtuf.coredump.cx/newtcp/ At least we're improving with more randomness - the old version this paper ( http://lcamtuf.coredump.cx/oldtcp/tcpseq.html http://lcamtuf.coredump.cx/oldtcp/tcpseq.html ) shows how bad it used to be, with some vendors exhibiting very reliably non-random patterns.

by Nrsolis 12y ago

tga_d 12y ago

"It's trivially easy to detect this kind of TOS abuse, even if the traffic is encrypted." It is? How? How could you possibly differentiate traffic coming from a single household with high bandwidth usage and a single person sharing their connection if it's all tunnelled over a VPN?

Nrsolis 12y ago
I won't go into detail here, but consider how de-anonymization of TOR network users is done with multiple layers of onion routing and encryption. All that needs to happen is that you correlate the injection of traffic to a particular node and then watch the actual traffic from a cable modem. You don't need to see the decrypted packets, you just need to know that when I inject N packets into a particular node, I get N packets out. Synchronized over a sufficiently long time series in a pattern that's only known to the attacker and you'll get a statistical certainty that a particular cable modem is being used for this kind of application and presto, your household is banned from the service. Like I said, trivial.
- mindslight 12y ago
  Of course there's a solution to that too: For the VPN, choose a fixed packet size, and maximum bandwidth in packets per second (evenly spaced "ticks"). Every tick, if there is a packet waiting to transmit, send it with padding to the max size. Otherwise, send a dummy packet that is discarded by the remote. That's right telcos - we can reinvent circuit switching too!
  - Nrsolis 12y ago
    Is this just your idea? Or is it an actual working solution? Because people have known about padding for a while and yet we still have methods to de-anonymize TOR networks. When you use those techniques on a minor mesh network like this, it's an order of magnitude easier. Keep in mind that the cable company or broadband provider doesn't have to have much in the way of proof, just a suspicion and your connection will be terminated.
    - mindslight 12y ago
      It's a very simplistic idea I threw out there, and it should stand on its own - if the only thing the intermediate network ever sees is uniformly distributed packets at uniformly distributed times regardless of contents, there's simply no signal for correlation attacks. But it's clearly inefficient as fuck. > broadband provider doesn't have to have much in the way of proof This pretty much goes for any software that doesn't just visit Facialbook et al. Barring any sort of public utility regulation, the only way to push back against that is to get software widely deployed.
  - qq66 12y ago
    That means you have to pay for peak bandwidth 100% of the time.
- MaxScheiber 12y ago
  I wouldn't exactly call that trivial if it needs to be "synchronized over a sufficiently long time series."
gress 12y ago
For one thing, traffic patterns, and the VPN endpoint would be a clue.
pdkl95 12y ago
Among many other methods (such as the deep packet inspection devices that have been common for quite a while), one particularly easy attack would be checking the TCP initial sequence numbers for changes in randomness[1]. Similarly, port number and usage can also be an easy tell when you see sockets opening on a pattern like this over time: [ ..., 15001, 15002, 15005, 9004, 9005, 15006, 9006, ...] Often IPmasq/NAT doesn't help either, as it can exhibit its own distinct pattern of port/etc usage often due to how router maintains its statefulness. [1] http://lcamtuf.coredump.cx/newtcp/ http://lcamtuf.coredump.cx/newtcp/ At least we're improving with more randomness - the old version this paper ( http://lcamtuf.coredump.cx/oldtcp/tcpseq.html http://lcamtuf.coredump.cx/oldtcp/tcpseq.html ) shows how bad it used to be, with some vendors exhibiting very reliably non-random patterns.