Port Knocking

Libra Monkee · Post by **Libra Monkee** » Wed Feb 20, 2008 3:47 pm

Anybody know anything about it?

found internets

Post by **complacent** » Wed Feb 20, 2008 4:03 pm

yup. it's cool enough I guess...

schvin · Post by **schvin** » Wed Feb 20, 2008 4:10 pm

makes me cross. i guess the obfuscation and neat factors are high, but doesn't seem scalable or usable from an enterprise perspective, so that makes me cross. i seem to be getting crotchety in my old age.

Post by **Sabre** » Wed Feb 20, 2008 4:18 pm

I used it a long time ago for a project I had. Feel free to ask questions

Libra Monkee · Post by **Libra Monkee** » Wed Feb 20, 2008 5:35 pm

By knocking on certain sequence of closed firewall ports you could open a port for your connection. Does that sound right?

avriette · Post by **avriette** » Wed Feb 20, 2008 5:43 pm

Libra Monkee wrote:By knocking on certain sequence of closed firewall ports you could open a port for your connection. Does that sound right?

"open a port" is too specific. "information could be transmitted" is more appropriate. Consider the case of two prisoners communicating by tapping a mutual wall.

Post by **complacent** » Wed Feb 20, 2008 6:07 pm

schvin wrote:makes me cross. i guess the obfuscation and neat factors are high, but doesn't seem scalable or usable from an enterprise perspective, so that makes me cross. i seem to be getting crotchety in my old age.

wow, you might be a little crotchety...

I think it's "cool enough" for say a warez box or that one box that you keep some tools on.

But I agree, it would not be easily deployed amongst the enterprise.

Post by **ElZorro** » Wed Feb 20, 2008 10:51 pm

Nothing says it couldn't be deployed across an enterprise - think of it like a key, with the ports being the tumblers. Hit the tumblers right and the lock opens. You can encode this into software (great in client server applications). The problem is it is near worthless against a replay attack - if someone can sniff the traffic between the just play the sequence back and get in. If approach the server without sniffing they won't be able to get in.

Post by **complacent** » Thu Feb 21, 2008 9:50 am

ElZorro wrote:Nothing says it couldn't be deployed across an enterprise - think of it like a key, with the ports being the tumblers. Hit the tumblers right and the lock opens. You can encode this into software (great in client server applications). The problem is it is near worthless against a replay attack - if someone can sniff the traffic between the just play the sequence back and get in. If approach the server without sniffing they won't be able to get in.

Agreed, the obfuscation is out teh window when you start coding it into software...

If you look at it as a one trick pony that only "works" as a one trick pony, you start to get a better idea of how it can be implemented and still remain "cool".

schvin · Post by **schvin** » Thu Feb 21, 2008 9:54 am

yeah - agree with comments.

Post by **Sabre** » Thu Feb 21, 2008 10:41 am

ElZorro wrote:The problem is it is near worthless against a replay attack - if someone can sniff the traffic between the just play the sequence back and get in. If approach the server without sniffing they won't be able to get in.

Ah, now that isn't true! Take your key analogy (which was great!) one step further. Knowing that you are on a computer, you can now establish a out-of-band sequence that the ports should be knocked on. There are 65536 ports available (technically), so if you have a function that generates the next sequence psuedo-randomly, it doesn't matter if you sniff the traffic of the previous connection sequence, as the next time it will be a different port combination. If you knock on 5 ports before the right one opens, you have a VERY small chance that you will ever guess the right sequence (think 1 in a billion). Now if you can find the sequence, you're in with no problem... but let's hope the person that designed the system did something better than cos(x)*100

schvin · Post by **schvin** » Thu Feb 21, 2008 10:55 am

that's a good point... it would be pretty swank as an OPIE transport.

Post by **Sabre** » Thu Feb 21, 2008 11:07 am

Now you're thinking in the right direction

Post by **ElZorro** » Thu Feb 21, 2008 12:12 pm

Sabre wrote:so if you have a function that generates the next sequence psuedo-randomly, it doesn't matter if you sniff the traffic of the previous connection sequence, as the next time it will be a different port combination.

Excellent.