Re: [Full-Disclosure] idea

From: Justin (justin-fulldisclosure_at_soze.net)
Date: 09/21/03

  • Next message: Rick Kingslan: "RE: [Full-Disclosure] patent clarification" 
    To: full-disclosure@lists.netsys.com
Date: Sat, 20 Sep 2003 22:45:05 +0000

    D B (2003-09-20 17:20Z) wrote:

    > what the port hopping tries to achieve is making it
    > even more difficult to sniff because one cant just
    > sniff a certain port.... with a random range u have to
    > suck in garbage data and this increases the time it
    > takes to reassemble if it is even possible

    But radios that listen to more than one frequency (simultaneously or
    not) are (still) more difficult to construct, while popular packet
    sniffers already capture everything.

    I'm not sure there's anything to gain unless you have other streams that
    have port (pairs) picked in a similar manner, introducing into the
    collected packets 1) junk or 2) other encrypted streams undifferentiable
    from the primary stream by an eavesdropper.

    At that point, Isn't it just as effective to insert junk into the
    original stream, which prevents attackers from 1) knowing the size of
    the message and 2) being able to get a pure ciphertext stream?

    The utility of obfuscating message lengths isn't clear. If you pick a
    random number n over a wide range (1-1000) and transmit it in the
    encrypted stream at the beginning, and if every packet except a multiple
    of n is junk, an eavesdropper has virtually no idea of the message
    length (but has a maximum possible message length assuming n=1,
    obviously). But the more streams/messages you transmit, if they can be
    assumed to be roughly the same length, the better an idea attacker gets
    of the minimum and maximum n, and also the length of the messages.

    And if you don't like that possibility, there are mix networks, but they
    assume no sniffing at the source or at all/most of the ingress nodes in
    the network. 

    -- 
No man is clever enough to          Times are bad.  Children no longer
know all the evil he does.          obey their parents, and everyone
-Francois de la Rochefoucauld       is writing a book.  -Cicero
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Rick Kingslan: "RE: [Full-Disclosure] patent clarification"

    Relevant Pages

    • Re: Sending a file from memory to the client
      ... Check the part where you create/fill the stream. ... > I'm having another problem where it places junk at the end of the file ... Prev by Date: ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: recieve XML and trash before it...
      ... The best way to delete the offending data is a custom pipeline component. ... You will want to implement your own stream that only returns data after the ... i recieve the xml form our system with a leading junk characters... ...
      (microsoft.public.biztalk.general)
    • Re: mpg123 and shoutcast streams
      ... > Playing MPEG stream from ... ... > Junk at the beginning ff55fb30 ... with a few 'mpg123: Can't rewind stream by 50 bits!'. ... shoutcast streams which play perfectly well on a windoze box. ...
      (comp.os.linux.setup)
    • Quantcast