Slashdot Mirror
RFC 3514: New Bit Defined for IPv4 Headers
RFC 3514
was just released, with a new bit definition for use in the headers of IP packets. Because there are important security implications, anyone coding internet services (on either the client or server end) should probably take a look.
Finally, the scriptkiddie bit! Now we'll be able to drop all that pesky DDoS traffic with ease!
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
The bit set to 1 indicates a pr0n site, the bit set to 0 indicates a non-pr0n site.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
This is such an amazingly important invention, but you are 2 hours early on the release. No one was supposed to know that.
Darn! You have already thwarted my evil plans yet again.
~ kjrose
Microsoft have released a beowulf distro.
Linus has joined redhat.
Slackware is closing down.
Linux now runs on single entangled electrons at MIT
etc etc etc
Official GOD FAQ.
I love April fool's day.
Perl programmers may want to check out their beloved cpan.org site today, too. :-)
Mirror 1
Mirror 2
To lighten the load.
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
It'll be the Router Admin Full Employment Act of 2003!
"The most sensible request of government we make is not, "Do something!" But "Quit it!"
Does the DMCA impose penalties for modifying the bit?
Please, please, please take this wonderful advance in technology and extend it to email. Then Spam can have a new header called "Evil: Yes". Then we can leverage the same technology to do perfect Spam filtering.
- Persnickity
Hey: it's still before midnight where I am! I'll need to take this seriously for the next couple of hours...
Call me old fashioned, but I like a dump to be as memorable as it is devastating - Bender
Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.
Note to self: Remember to set "evil" bit to 1 when launching world domination attempt.
134340: I am not a number. I am a free planet!
If your cursor finds a menu item followed by a dash, and the double-clicking icon puts your Window in the trash, and your data is corrupted 'cause the index doesn't hash, then your situation's hopeless and your system's gonna crash!!
If the label on the cable on the table at your house says the network is connected to the button on your mouse, but your packets want to tunnel to another protocol that's repeatedly rejected by the printer down the hall, and your screen is all distorted by the side effects of gauss, so your icons in the window are as wavy as a souse; then you may as well reboot and go out with a bang, 'cuz sure as I'm a poet, the sucker's gonna hang!
When the copy of your floppy's getting sloppy in the disk, and the macro code instructions cause unnecessary risk, then you'll have to flash the memory and you'll want to RAM your ROM. Quick, turn off the computer and be sure to tell your Mom!
Blatently pinched from - Twisted Monkey Entertainment
_________________
Cheap Web Site Hosting - recommended by some worker posting on slashdot!
More info is here
http://saveie6.com/
Unfortunately the RFC neglects to define what levels of evil the values of the 128-bit strength indicator maps to.
Therefore I, on behalf of the United Corp^H^H^H^H^H States government, submit that the top values should be reserved for the following:
2^127-n
4: Unpatriotic activity.
3: Terrorism. For up to date definition, see www.dhs.gov
2: Attempt to secure personal communication by encryption
1: Circumvention of copy protection mechanisms for purposes of piracy
0: Circumvention of copy protection mechanisms for purposes of "fair use"
Note that the last bit is reserved to indicate whether the packet originates from a foreign country.
My Sig: SEGV
The fine print: Aforementioned crimes are only illegal in Afghanistan and include, but are limited to, allowing women to walk around without being entirely concealed under a table cloth, teaching children how to read and write, and singing nursery rhymes.
Here
Also note that it's actually based on the ideas initially developed by HTCPCP protocol, which just turned 5 years.
3.243F6A8885A308D313
An attacker can take advantage of the quantum nature of reality to set this bit to an indeterminate/combined value influenced by the nature of the observer of the packet. An observer who knows the evil nature of the sender of the packet will see the "evil" bit set to one, as it should be. However, unsuspecting observers, including firewalls and potential victims, will see the bit set to zero and be fooled.
The inherent subtlety of this attack is revealed by considering what happens when a security expert attempts to analyze the attack. As soon as he recognizes the evil nature of the attacker, the packets appear to have the 'evil' bit set, and his firewalls start dropping the packets, depriving him of further packets for analysis. The attack is thus even more precisely targeted towards the naive than an attack on Microsoft IIS.
Is it time to bring out the April Fools Day Tree yet?
Should I start opening the April Fools Day gifts?
Serious question: Will this bit work over Carrier Pigeon?
And one other thought, will Windows2003Server recognize it? Oh...they'll have to release the Service Pack because anything set to 0 won't get through because of a buffer overflow extension illegal operation segfault doo-hickey.
Any other cliches missed?
I liked this bit (emphasis mine):
NGWave - Fast Sound Editor for Windows
No link necessary. Matt's Script archive is well-known among Perl programmers as one of the densest collections of hole-ridden crappy code on the net.
There's even a project to write secure, well-written clones of his scripts so the poor bastards stuck with his can drop-in something that won't allow remote exploits on their machine. :-)
If only it was that easy to detect evil intent in real life...
"Sally, cross your legs! His bit is set to 'evil'!"
On second thought...
"Watch your cornhole, bud."
jumping the gun on April Fools Day a bit, aren't we?
;) and thinking "wtf is an evil bit?"
;)
Thanks for the reminder.
I am sitting here, reading the article before the replys here (yes, some of us really do before we post
I mean, the whole protocol thing is over my head, but I read anyway to maybe learn something. It took about 3 minutes of head scratching before I really looked at the url, return here suspicious and decide that I had been had.
I am betting 1% of the readers come back and think the new protocol is a good thing before realizing its a hoax
Tequila: It's not just for breakfast anymore!
Actually I think somebody famous* established long time ago that sex, as strange as some of its involved rituals may seem to many at times, are a better alternative to war.
.gov extension has the eBit** set.
I propose that instead anything coming from or going to a
*note: Larry Flint. Watch the movie.
**I hereforth trademark this name.
My life in the land of the rising sun.
Note to self: Remember to set "evil" bit to 1 when launching world domination attempt.
Which makes me think: Will the cable company terminate my account if I forget to set the evil bit when I am DDoSing someone, as a TOS violation?
Tequila: It's not just for breakfast anymore!
I am betting 1% of the readers come back and think the new protocol is a good thing before realizing its a hoax
/. readers are releasing a collecting groan and muttering something along the lines of "Oh God...is it April 1st again...". I'm not being a spoilsport, but after a few years April Fools Day jokes start to seem a little formulaic and predictable.
I'd also put down that about 80% of
Actually, some of the humor in this RFC is that it mocks the futile 'consensus' basis of all the RFCs.
Take it just a little bit serious and you say to yourself 'Wait a minute, this isn't that funny. People really do believe a consensus-based network will scale well worldwide....'
Or not a secure system. Insecure systems can choose to ignore the flag (as per RFC).
My favorite quote of the RFC is:
" This document defines the behavior of security elements for the 0x0
and 0x1 values of this bit. Behavior for other values of the bit may
be defined only by IETF consensus [RFC2434]."
LedgerSMB: Open source Accounting/ERP
First this and now I noticed the W3C added an addendum to HTTP 1.1:
10.5.4.1 503.1 Slashdotted
The server is currently unable to handle the request due to a fucking slashdotting of the server. Visit slashdot.org for potential mirrors.
There may be some strange cosmic significance about April 1st, or just a series of amazing coincidences, but many RFCs published on April 1st are of amazing importance.
Potentially devastating Y10k problem
Lifesaving method to temporarily reroute ip in cause of equipment failure
Protocol to guarantee software engineer productivity and efficiency
Addressing ipv6 with incredible bandwidth savings
Planning ahead to Star Trek technology with current protocols and infrastructure
I don't even know what this one is about...
And many, many more. Any self-respecting network engineer should be especially familiar with all April 1st RFCs, in my opinion...
"This is Zombo Com, and welcome to you who have come to Zombo Com" - www.zombo.com
I'm not being a spoilsport, but after a few years April Fools Day jokes start to seem a little formulaic and predictable.
Well, ya they are predictable, they come every April 1....:)
Perhaps if they just did a few random hoaxes a year, at different times, it would be a little more fun. As it is, its kind of like acting suprised when you get socks for christmas. And just as gratifying.
Tequila: It's not just for breakfast anymore!
Our IT group must have contributed to this RFC! Now I know exactly what to think of it...
is competition good, or is duplication of effort bad?
Enough about the evil bit, where are the "naughty bits"?
I see even classic Slashdot is now pretty much unusable on dial up anymore.
I bet we could get the US Congress to pass a law making it illegal to set this bit incorrectly.
How would one go about setting the evil flag bit when you use the avian transport layer?
Fooled you - with my stupid bit~!
have we forgotten that evil people often masquerade in sheep's clothing????
stupid!
joshua
3514 translated into l337 sp34k is ESIA... Doesn't ring a bell, but Egoistic Scriptkiddy Ignoring Annihilation seems to fit...
Please direct all bug reports to
Actually, "today" (1 April) is also the 13th anniversary of RFC1149.
Check out its majesty: ftp://ftp.rfc-editor.org/in-notes/rfc1149.txt
People were so much more creative back in 1990. ;-)
Back to the RFCs: the list above doesn't seem exhaustive. I found some more: 12 networking truths RFC, telnet randomly lose option and Hyper Text Coffee Pot Control Protocol
somebody set this thing to "Evil."
In my timezone, it is currently 10:30 of March 31st. Shouldn't the Internet community wait until it is April 1st everywhere before trying to implement this suggestion?
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
Gates' Law: Every 18 months, the speed of software halves.
Enjoy! :-)
There now exists a patch for nmap which sets the evil bit on by default, available here
also, more discussion on when the evil bit should be set.
Network Working Group S. Bellovin
.
Request for Comments: 3514 AT&T Labs Research
Category: Informational 1 April 2003
The Security Flag in the IPv4 Header
Status of this Memo
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract
Firewalls, packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. We define a security flag in the IPv4 header as a means of distinguishing the two cases.
1. Introduction
Firewalls CBR03 , packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. The problem is that making such determinations is hard. To solve this problem, we define a security flag, known as the "evil" bit, in the IPv4 RFC791 header. Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.
1.1. Terminology
The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this document, are to be interpreted as described in RFC2119
2. Syntax
The high-order bit of the IP fragment offset field is the only unused bit in the IP header. Accordingly, the selection of the bit position is not left to IANA.
The bit field is laid out as follows:
0
+-+
|E|
+-+
Currently-assigned values are defined as follows:
0x0 If the bit is set to 0, the packet has no evil intent. Hosts, network elements, etc., SHOULD assume that the packet is harmless, and SHOULD NOT take any defensive measures. (We note
that this part of the spec is already implemented by many common desktop operating systems.)
0x1 If the bit is set to 1, the packet has evil intent. Secure systems SHOULD try to defend themselves against such packets. Insecure systems MAY chose to crash, be penetrated, etc.
3. Setting the Evil Bit
There are a number of ways in which the evil bit may be set. Attack applications may use a suitable API to request that it be set. Systems that do not have other mechanisms MUST provide such an API; attack programs MUST use it.
Multi-level insecure operating systems may have special levels for attack programs; the evil bit MUST be set by default on packets emanating from programs running at such levels. However, the system MAY provide an API to allow it to be cleared for non-malicious activity by users who normally engage in attack behavior.
Fragments that by themselves are dangerous MUST have the evil bit set. If a packet with the evil bit set is fragmented by an intermediate router and the fragments themselves are not dangerous, the evil bit MUST be cleared in the fragments, and MUST be turned back on in the reassembled packet.
Intermediate systems are sometimes used to launder attack connections. Packets to such systems that are intended to be relayed to a target SHOULD have the evil bit set.
Some applications hand-craft their own packets. If these packets are part of an attack, the application MUST set the evil bit by itself.
In networks protected by firewalls, it is axiomatic that all attackers are on the outside of the firewall. Therefore, hosts inside the firewall MUST NOT set the evil bit on any packets.
Because NAT RFC3022 boxes modify packets, they SHOULD set the evil bit on such packets. "Transparent" http and email proxies SHOULD set the evil bit on their reply packets to the innocent client host.
Some hosts scan other hosts in a fashion that can alert intrusion detection systems. If the scanning is part of a be
There used to be a "security" bit you could use to mark you packets as especially interesting (the do-not-route-thru-Iraq-bit) [rfc 791]. Is that feature obsoleted by this evil?
Ya know I was thinking about my original post, and it occured to me taht Hitchcock's "the birds" is really an archetype for evil avian transport DDoS.