Re: Questions about Version Negotiation Concerning Possible Handshake Interruption

[Lingmo Zhu <[e-mail]>]

IMHO we can see that such interference is pretty easy to be used and it 
could leading to aborted QUIC connection and probably a fallback to any 
old approach for higher level protocol. Even virus targeting home 
routers could do that, without gov involved. For what outcome, I think 
it's pretty simple: forcing higher level protocol fallback to other 
transport protocol. Since QUIC has been designed much more secure than 
older protocols, it could be hard to do some eavesdropping or hijacking. 
But if fallback happens, it would be another story. Considering DNS over 
QUIC, a virus-infected home router could interfere with QUIC handshake 
cause fallback to TLS, then RST may cause fallback to clear text, which 
is easy to be hijacked and leads client to some phishing site.


On 2018/02/09 19:56, Mikkel Fahnøe Jørgensen wrote:
> A realistic on-path attack involves a government body that taps optic 
> fiber at an internet distribution node. The original intention behind 
> the construct may be to trigger an alarm whenever the string “dirty 
> bomb” appears in a protocol RFC 821 message (such as this one), and 
> subsequently for logging purposes to monitor traffic directed towards 
> bulk fertiliser suppliers. It is not possible to drop packets both due 
> to the mechanical construct, due to legislation, and because it might 
> be too obvious. However, having a datacenter with optic fibre near 
> said access point gives excellent insights into early handshakes 
> including IP, port, connection ID, and possible even a profile of the 
> PRNG being used at some endpoint.
>
> This makes it very simple to spoof and inject packets into handshake 
> with a good chance of winning any race. More difficult, but possible, 
> it could also observe packets and inject packets closer to the 
> endpoint, for example using long distance point to point radio 
> communication to race the ordinary packet stream.
>
> Any argument about friendly gov is void because the internet travels 
> across multiple regions that each with near certainty have taps as 
> those described above making it a prime target in cyber warfare.
>
> The question is then to what extend such a position can be utilised to 
> interfere with the handshake and what the outcome of such interference 
> would be, rather than a discussion of how plausible such an attack is, 
> because it is probably a 99% given if feasible.