June 2008 - cypherpunks-legacy

detecting ssh tunnels with bayes and packet timing
by Eugen Leitl 30 Jun '08

30 Jun '08

http://coderrr.wordpress.com/2008/06/28/detecting-ssh-tunnels/ Detecting SSH tunnels Filed under: network, security b Tags: network, security b coderrr @ 6:35 pm Italian researchers have published a paper on the Detection of Encrypted Tunnels across Network Boundaries. I came across it in a google search because Ibve been thinking of writing a program which does something similar. It doesnbt seem like anyone else has picked up on this research yet so I thought I should mention it. Here is a link to the actual paper: pdf or scribd. They claim their technique can differentiate between b normalb ssh or scp sessions and ssh sessions which are being used to tunnel traffic (through sshbs port forwarding mechanism). This is accomplished through a naive Bayes classifier, which they first trained with b normalb ssh sessions. The two variables used to classify a session are the size of the packets and the difference in arrival time of two consecutive packets. With just these, they can classify with 99% accuracy whether an ssh session is a tunnel. They were also able to classify the actual protocol (P2P, POP, SMTP, HTTP) of the tunneled connection with close to 90% accuracy. Although their research is quite interesting there are a few things which limit its practicality. They can only detect tunnels going through ssh servers which they control. This is because their detection mechanism can only handle a single authentication type whereas an ssh server can (and usually does) allow multiple (e.g. public-key or password). This requires admins of the server to limit the allowed authentication options to a single consistent choice. They also require the ssh server _and_ client to disable compression. Their technique will also falsely classify a second login attempt (after a failed login) as a tunnel and drop the connection. In their words: b However, this should not be a major problem: simply, if the user is entitled to connect, they will try again.b So it seems the use of a tool like this would be limited to an extremely controlled environment where users are limited to a white-list set of network protocols (so that they canbt use a different tunneling mechanism, stunnel for example) and only allowed to ssh to servers under the control of the censoring party. In which case you would wonder why the admin wouldnbt just set the ssh serversb AllowTcpForwarding option to false. It sounds like this is just preliminary work so maybe their future research will solve all these problems. If perfected this technology could be used by ISPs to block or throttle even encrypted P2P traffic. Ibd also like to note that it would probably be easy to create a tunneling mechanism which thwarts their detection attempts. Knowing that they use packet size and inter packet intervals you could easily manipulate these to match whatever protocol type you wanted. While looking around one of the researchers web pages (Franceso Gringoli) I found a pretty cool Linux/OSX utility called sshgate. It allows you to transparently tunnel all your connections over ssh. This is great for programs which do not give you the option to use a socks server and which do not play nice with socksification. I havenbt tested it out so Ibm not sure if it actually works.

1 0

No Pumps! No Surgery! No Exercises!
by Otis Powers 30 Jun '08

30 Jun '08

Read hundreds of testimonials from satisfied men and their girlfriends on this site. After years of scientific research, a herbal breakthrough is finally achieved - the product rated as #1 by healthcare professionals, with gains of up to 1-3 inches guaranteed, and girth increases from 5% - 30%. Many surveys have shown that ladies prefer their man to have a huge manhood. http://linestay.com/

1 0

Vx MM 6 mont supl _ 211.82 $
by Denver Merrill 30 Jun '08

30 Jun '08

Ciamar a tha thu? V 49 30 oa _ 85.72 $ V FC4 10 oa _ 31.99 $ Phosphodiesterase inhibitors featuring the most po action of the chee ingredient, quickest level of absorption, most intense effect on chm messengers within the tissues of the pee and a fail-safe response of the nervous system. * V BNV 120 oa - 100 m + 4 Free oa + FRAH - 224.26 $ Ci TC1 30 oa _ 107.19 $ Ci MHM 20 oa _ 79.75 $ OraD for male imp, also known as erDy. Having been around for a lot longer, V has a great safety track record and proven effects that start acting in 39 min and last for about 5 hours. Vx 9 3 mont supl _ 116.68 $ . answered our highly raised expectations in its ability to treat and cure the overall whelming disease of edd by su-acte formulation that gives the pii the shortest activation time, most prolonged time of action and 107% positive result. PNN-GW_P OA8 1 mont supl _ 111.97 $ PNN-GW_P 3K 3 mont supl _ 329.93 $ PNN-GW_P HT 6 mont supl _ 607.26 $ All nattu safe and effective mal enh and pee enl pi. http://formarrive.com

1 0

Dreams can cost less Replica watches from Rolex here
by Janna Champion 30 Jun '08

30 Jun '08

Best replica watches from IWC at Replica Classics Trendy replica watches Famous brands, top quality High Quality Rolex Replica Watches http://sauteperski.com/

1 0

Penis Enlargment Reviews
by Jerry Jacobsen 30 Jun '08

30 Jun '08

Many surveys have shown that ladies prefer their man to have a huge manhood. "Ever since I started on your herbal supplement, Sharon says sex is so much more pleasurable for her, and she comes much more easily". David, Florida, USA http://vepamcell.com/

1 0

Degree or Diploma of Your Choice
by Carl Barnes 30 Jun '08

30 Jun '08

Good News! Interested to obtain Bachelors', Masters', MBA's, Doctorate & Ph.D. degrees available in your field in 2 weeks time? It's available now... Call Us and get yours today 1-702-507-0027 Our Education office has someone available 24 hours a day, 7 Days a week Why waiting? 1-702-507-0027

1 0

Looking for a watch? Visit Replica Classics
by Brenda Proctor 30 Jun '08

30 Jun '08

Classical Frank Muller watches at Replica Classics Get the Finest Rolex Watch Replica ! Rolex replica watch http://reactdappiu.com/

1 0

Which Ones Really Work? We List The Top Penis Enlargement Products!
by Newton Nieves 30 Jun '08

30 Jun '08

Many surveys have shown that ladies prefer their man to have a huge manhood. Impress the ladies with the new tool in your pants, and watch them moan in pleasure when you fill them up deeper and more tightly. http://plateoann.com/

1 0

High Quality Rolex Replica Watches
by Wade Rodriquez 30 Jun '08

30 Jun '08

Delightsome Cartier watches at Replica Classics fashionable replica watches Replica Classics if looking for magnificent watches http://filetpyasaw.com/

1 0

Replica Classics trendy replica watches for you
by Nathaniel Bishop 30 Jun '08

30 Jun '08

Classical Frank Muller watches at Replica Classics Most Popular Watches of All Trademarks Christmas Replica Watches http://masonyarmix.com/

1 0