RFC 3514: New Bit Defined for IPv4 Headers

RFC 3514 was just released, with a new bit definition for use in the headers of IP packets. Because there are important security implications, anyone coding internet services (on either the client or server end) should probably take a look.

Comments

It's about time!

[Motherfucking Shit]

Finally, the scriptkiddie bit! Now we'll be able to drop all that pesky DDoS traffic with ease!

I can see it now.

[Renraku]

The bit set to 1 indicates a pr0n site, the bit set to 0 indicates a non-pr0n site.

you are 2 hours early...

[MarvinMouse]

This is such an amazingly important invention, but you are 2 hours early on the release. No one was supposed to know that.

Darn! You have already thwarted my evil plans yet again.

Re:you are 2 hours early...

[Plug]

Not all the world runs on your time clock. It's been April Fools Day for almost 16 hours at my time of posting...

In other news....

[VC]

Microsoft have released a beowulf distro.
Linus has joined redhat.
Slackware is closing down.
Linux now runs on single entangled electrons at MIT
etc etc etc

Re:In other news....

[Pseudonym]

...BSD is not dying.

...and so it begins

[stevens]

I love April fool's day.

Perl programmers may want to check out their beloved cpan.org site today, too. :-)

A couple of mirrors

[Motherfucking Shit]

Mirror 1

Mirror 2

To lighten the load.

Patch for Cisco IOS needed

[Degrees]

Now, best practices will include setting this bit for all interfaces connected to Microsoft servers and AOL users.

It'll be the Router Admin Full Employment Act of 2003!

;-)

Chomping at the bit

[Brett Glass]

Does the DMCA impose penalties for modifying the bit?

100% Correct Spam Filters Now Possible

[Persnickity]

Please, please, please take this wonderful advance in technology and extend it to email. Then Spam can have a new header called "Evil: Yes". Then we can leverage the same technology to do perfect Spam filtering.

Must remember

[the_other_one]

Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.

Note to self: Remember to set "evil" bit to 1 when launching world domination attempt.

Why computers crash, by Dr. Seuss

[Mattygfunk1]

If a packet hits a pocket on a socket on a port, and the bus is interrupted at a very last resort, and the access of the memory makes your floppy disk abort, then the socket packet pocket has an error to report.

If your cursor finds a menu item followed by a dash, and the double-clicking icon puts your Window in the trash, and your data is corrupted 'cause the index doesn't hash, then your situation's hopeless and your system's gonna crash!!

If the label on the cable on the table at your house says the network is connected to the button on your mouse, but your packets want to tunnel to another protocol that's repeatedly rejected by the printer down the hall, and your screen is all distorted by the side effects of gauss, so your icons in the window are as wavy as a souse; then you may as well reboot and go out with a bang, 'cuz sure as I'm a poet, the sucker's gonna hang!

When the copy of your floppy's getting sloppy in the disk, and the macro code instructions cause unnecessary risk, then you'll have to flash the memory and you'll want to RAM your ROM. Quick, turn off the computer and be sure to tell your Mom!

Blatently pinched from - Twisted Monkey Entertainment

_________________
Cheap Web Site Hosting - recommended by some worker posting on slashdot!

Re:Why computers crash, by Dr. Seuss

[sinnergy]

Please attribute properly :)

http://people.cornell.edu/pages/elz1/clocktower/Dr Seuss.html

The whole thing was created by Gene Ziegler. He gives a pretty good history of the poem as well as the full thing, which most people don't post.

The 128-bit strength indicator levels!

[EvilNTUser]

Unfortunately the RFC neglects to define what levels of evil the values of the 128-bit strength indicator maps to.

Therefore I, on behalf of the United Corp^H^H^H^H^H States government, submit that the top values should be reserved for the following:

2^127-n
4: Unpatriotic activity.
3: Terrorism. For up to date definition, see www.dhs.gov
2: Attempt to secure personal communication by encryption
1: Circumvention of copy protection mechanisms for purposes of piracy
0: Circumvention of copy protection mechanisms for purposes of "fair use"

Note that the last bit is reserved to indicate whether the packet originates from a foreign country.

I have security.

[rice_burners_suck]

Security implications? Bah, humbug. I have the most secure network anywhere. First of all, I use 100% wireless networking with no encryption whatsoever. I am using Windows operating systems, which are unbreakable in terms of security because nobody other than Microsoft, the most respectable organization in the world, has access to the source code, which is flawless in every way. Sharing is turned on for all drives with no passwords. As a matter of fact, there are no passwords on anything. And the computers are being kept on all the time. Private documents are stored on these computers, as are diaries, pictures, videos and other proofs of the illegal crimes my organization commits (see fine print below). As such, I firmly believe that no update to any aspect of my network needs to take place, as I am 100% safe from evil hackers and from those evil people who do not agree 100% with the viewpoints of Microsoft, the RIAA, the MPAA, AOL Time Warner, The Walt Disney Company and Saddam Hussein.

The fine print: Aforementioned crimes are only illegal in Afghanistan and include, but are limited to, allowing women to walk around without being entirely concealed under a table cloth, teaching children how to read and write, and singing nursery rhymes.

A potential hole...

[russotto]

An attacker can take advantage of the quantum nature of reality to set this bit to an indeterminate/combined value influenced by the nature of the observer of the packet. An observer who knows the evil nature of the sender of the packet will see the "evil" bit set to one, as it should be. However, unsuspecting observers, including firewalls and potential victims, will see the bit set to zero and be fooled.

The inherent subtlety of this attack is revealed by considering what happens when a security expert attempts to analyze the attack. As soon as he recognizes the evil nature of the attacker, the packets appear to have the 'evil' bit set, and his firewalls start dropping the packets, depriving him of further packets for analysis. The attack is thus even more precisely targeted towards the naive than an attack on Microsoft IIS.

Evil

[NickisGod.com]

Is it time to bring out the April Fools Day Tree yet?

Should I start opening the April Fools Day gifts?

Serious question: Will this bit work over Carrier Pigeon?

And one other thought, will Windows2003Server recognize it? Oh...they'll have to release the Service Pack because anything set to 0 won't get through because of a buffer overflow extension illegal operation segfault doo-hickey.

Any other cliches missed?

Oh geez...

[sfe_software]

...it's 4/1 already...

I liked this bit (emphasis mine):

0x0 If the bit is set to 0, the packet has no evil intent. Hosts,
network elements, etc., SHOULD assume that the packet is
harmless, and SHOULD NOT take any defensive measures. (We note
that this part of the spec is already implemented by many common
desktop operating systems.)

0x1 If the bit is set to 1, the packet has evil intent. Secure
systems SHOULD try to defend themselves against such packets.
Insecure systems MAY chose to crash, be penetrated, etc.

Re:Nasty!

[stevens]

Is there a link explaining why they chose that theme?

No link necessary. Matt's Script archive is well-known among Perl programmers as one of the densest collections of hole-ridden crappy code on the net.

There's even a project to write secure, well-written clones of his scripts so the poor bastards stuck with his can drop-in something that won't allow remote exploits on their machine. :-)

Re:4/1/03

[Pharmboy]

jumping the gun on April Fools Day a bit, aren't we?

Thanks for the reminder.

I am sitting here, reading the article before the replys here (yes, some of us really do before we post ;) and thinking "wtf is an evil bit?"

I mean, the whole protocol thing is over my head, but I read anyway to maybe learn something. It took about 3 minutes of head scratching before I really looked at the url, return here suspicious and decide that I had been had.

I am betting 1% of the readers come back and think the new protocol is a good thing before realizing its a hoax ;)

sex or war

[lingqi]

Actually I think somebody famous* established long time ago that sex, as strange as some of its involved rituals may seem to many at times, are a better alternative to war.

I propose that instead anything coming from or going to a .gov extension has the eBit** set.

*note: Larry Flint. Watch the movie.

**I hereforth trademark this name.

Re:4/1/03

[ergo98]

I am betting 1% of the readers come back and think the new protocol is a good thing before realizing its a hoax

I'd also put down that about 80% of /. readers are releasing a collecting groan and muttering something along the lines of "Oh God...is it April 1st again...". I'm not being a spoilsport, but after a few years April Fools Day jokes start to seem a little formulaic and predictable.

Re:First evil comment

[einhverfr]

Or not a secure system. Insecure systems can choose to ignore the flag (as per RFC).

My favorite quote of the RFC is:
" This document defines the behavior of security elements for the 0x0
and 0x1 values of this bit. Behavior for other values of the bit may
be defined only by IETF consensus [RFC2434]."

What a day!

[Ridge]

First this and now I noticed the W3C added an addendum to HTTP 1.1:

10.5.4.1 503.1 Slashdotted

The server is currently unable to handle the request due to a fucking slashdotting of the server. Visit slashdot.org for potential mirrors.

April 1st RFCs are always the most important...

[Bradee-oh!]

There may be some strange cosmic significance about April 1st, or just a series of amazing coincidences, but many RFCs published on April 1st are of amazing importance.

Potentially devastating Y10k problem

Lifesaving method to temporarily reroute ip in cause of equipment failure

Protocol to guarantee software engineer productivity and efficiency

Addressing ipv6 with incredible bandwidth savings

Planning ahead to Star Trek technology with current protocols and infrastructure

I don't even know what this one is about...

And many, many more. Any self-respecting network engineer should be especially familiar with all April 1st RFCs, in my opinion...

Re:4/1/03

[Pharmboy]

I'm not being a spoilsport, but after a few years April Fools Day jokes start to seem a little formulaic and predictable.

Well, ya they are predictable, they come every April 1....:)

Perhaps if they just did a few random hoaxes a year, at different times, it would be a little more fun. As it is, its kind of like acting suprised when you get socks for christmas. And just as gratifying.

Perspiring minds want to know....

[unitron]

Enough about the evil bit, where are the "naughty bits"?

Re:Perspiring minds want to know....

[ZorMonkey]

Enough about the evil bit, where are the "naughty bits"?

Oog. Dont sniff those packets...

Re:ROFL

[MrLint]

How would one go about setting the evil flag bit when you use the avian transport layer?

Previous April 1 RFCs

[arvindn]

There's a list here. I guess the most famous of them is the IP over avian carriers thing. On the subject of avians, google came out with a cool pigeonrank joke last year.

Back to the RFCs: the list above doesn't seem exhaustive. I found some more: 12 networking truths RFC, telnet randomly lose option and Hyper Text Coffee Pot Control Protocol

Here's yer problem...

[jose c rivera]

somebody set this thing to "Evil."