Circumventing Deep Packet Inspection with Socat and Rot13

[xelxebar]

Not at all the main point, but tr can do rot13 and more; plus GNU Coreutils' implementation is fast:

    $ time openssl rand -base64 1000000000 | tr a-z n-za-m >/dev/null

    real    0m1.073s
    user    0m1.327s
    sys     0m0.644s
    $ time openssl rand -base64 1000000000 | rot13 >/dev/null

    real    0m19.225s
    user    0m20.101s
    sys     0m0.747s

[sporksmith]

Folks interested in the state of the art of this kind of DPI evasion might want to check out obs4, which is a "look-like nothing obfuscation protocol", and the default pluggable transport for connecting to tor bridges from places where tor is blocked.

obs4: https://github.com/Yawning/obfs4

obs4 in tor: https://support.torproject.org/glossary/obfs4/

[MadsRC]

I love this! Using a 2000+ year cipher to circumvent Deep Packet Inspection seems almost poetic.

I feel like the article missed out on mentioning one key thing: Using a deny-list doesn’t work. It’s much more viable to default block and allow the stuff you know you’ll allow. Defaulting to allow and blocking stuff you don’t want is how you end up being owned by rot13.

[pdkl95]

http://www.ranum.com/security/computer_security/editorials/d...

"The Six Dumbest Ideas in Computer Security"

> #1) Default Permit

> #2) Enumerating Badness

[throw0101a]

In case someone is not aware, socat allows for TLS connections with the OPENSSL-LISTEN and OPENSSL options:

* http://www.dest-unreach.org/socat/doc/socat.html#ADDRESS_OPE...

* http://www.dest-unreach.org/socat/doc/socat.html#ADDRESS_OPE...

Just create a self-signed certificate:

    openssl req -newkey rsa:2048 -nodes -keyout socat.key -x509 -days 1000 \
        -subj '/CN=www.mydom.com/O=My Company Name LTD./C=US' -out socat.pem

for the server and tell the client not to check ("verify=0").

[belter]

The method is interesting as a mental exercise and its archaeological interest. If you are a company employee be careful about trying these or any other type of tunneling or deep packet inspection circumvention methods.

Some companies mention in their employment contracts these type of circumvention activities, unless explicitly allowed, are a firing offense.

[throwaway984393]

At one job I tunneled out of work to my home PC, and the head security guy found out and made a big stink, and I got fired

[sockpuppet_12]

It's interesting how the pendulum of ideas swings back and forth over history, similar problems arise and similar solutions to them resurface also. It would be great to see that on some kind go graph or timeline.

[zokier]

> They permit SSL to some known websites (for https), but the moment I try to create an SSL or SSH connection to an unknown server (eg. to the bastion box), their gateway instantly terminates the TCP connection!

They are clearly already whitelisting connections, but still allow unidentified connections through?! What sort of logic is that?

[ranger_danger]

Why block all HTTP(non-S) traffic when you can inspect its plaintext? At least I assume that was their thinking.

[aaomidi]

Probably to not break on unknown protocols.

[annoyingnoob]

This message is double rot13 encoded for your protection.

[jeffrallen]

Hmm, I managed to decode it with quadruple rot13... Maybe check your settings, could be insecure!

[aaaaaaaaaaab]

I don't get it. Why did you need SSH at all? The task was completed the moment a TCP connection was established to your server.

[usr1106]

So once the maintainers of the deep packet inspection software read this they will add rot13 to their code.

[xmcqdpt2]

The author only used rot13 to make a point about the failure mode of inspection. DPI is only there to stop everyday employees from bypassing security policies inadvertently, not to stop an actual attacker. An attacker could use any number of other approaches: hiding payloads in innocuous keywords, using actual encryption, steganography, what have you.

I'm not a security expert but we had those kind of measures at a previous job and AFAIK they are there so that a lazy employee (me) doesn't just skip configuring their tools to go through Artifactory out of laziness and introduce a supply chain vulnerability. If "pip install XYZ" just worked out of the box, how likely would it be that all 10k devs in your organization would bother configuring it to avoid PYPI?

[jortr0n]

The use of rot13 was just an amusement in this case given its vintage. Replacing rot13 with any other simple stdin/stdout transcoder should be simple to do via the socat invocation, eg base64, a sed replace command, gzip/gunzip, even an actual symmetric encryption protocol like AES, etc.

[vermilingua]

Which would slow down inspection by a factor of 25 if it were to check the whole keyspace.

[ocdtrekkie]

This is why rolling your own crypto often works in practice if you are a smaller operator: Nobody ****ing expects it, and there's a good chance nobody cares enough to investigate manually what you did or add support to commercial products to handle it.

[dvh]

I once did rot13 on /lib/firmware/* (not just 13 but 0-255), piped it via 'strings' command and find longest word in English corpus (/usr/share/dict/*). I forget what I found but it's trivial to replicate.

[rwmj]

This was my best attempt at this:

  cd /lib/firmware
  ( find -name '*.xz' -exec xzcat {} \; ; find -type f -a \! -name '*.xz' -a -exec cat {} \; ) |
    rot13 |
    grep -aEo '\w+' |
    awk '{print length, $0 }' |
    sort -nsru |
    head -20

I didn't see anything very interesting in the top results.

Edit: The sort -u option hides words of the same length. Removing that option (and the head command) gives more results, but nothing that interesting.

[spdegabrielle]

So it may not be an effective security measure but at least it stops your staff from doing online banking or shopping on work devices.

[spdegabrielle]

Or it would if they realised their credentials are in the DPI log files.

[jeffrallen]

OP should use rot14, it's more secure. /s

[kzrdude]

double rot13 has an unfortunate meet-in-the-middle weakness but triple rot13 was invented for this very purpose. I hope he makes the upgrade.