View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001879 | unreal | ircd | public | 2004-06-17 18:19 | 2004-06-20 12:28 |
| Reporter | Gilou | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | always |
| Status | closed | Resolution | open | ||
| Product Version | 3.2 | ||||
| Summary | 0001879: Use Hiddenhost prefix instead of "IP" in cloaked unresolved IPs | ||||
| Description | I thought more "fun" to add the hidden host at the end of the IP instead of "IP", so modify it, but if it was added in the original version, it won't be that bad ;) | ||||
| Additional Information | cloak.c 211,212c211,212 < ircsprintf(cloaked, "%lx:%lx:%lx:IP", < l[2], l[1], l[0]); --- > ircsprintf(cloaked, "%lx:%lx:%lx:%s", > l[2], l[1], l[0], hidden_host); 242c242 < snprintf(cloaked, sizeof cloaked, "%lX.%lX.%lX.IP", l[2], l[1], l[0]); --- > snprintf(cloaked, sizeof cloaked, "%lX.%lX.%lX.%s", l[2], l[1], l[0], hidden_host); | ||||
| 3rd party modules | |||||
|
|
snprintf(cloaked, sizeof cloaked, "%lX.%lX.%lX.%s", l[2], l[1], l[0], hidden_host); From what I can understand, hidden_host is the hostname of the user, which would be shown at the end of the cloaking mechanism, therefore masking the first three octets of the IP address. The last octet of the IP should be masked, not the others. The reason being, to allow others to see the network/subnet the user is on, but to hide the actual user's address. IP addresses are split into three pieces. Let's take the IP 255.255.255.255 for example, which is a reserved IP. 255.255. <--Network address 255. <--Subnetwork address 255 <--Host address The point of masking an IP address is to prevent people from knowing the "Host" part of the address (which is the end-user's IP address), while allowing people to see which "Network" and which "Sub-network" (commonly called "subnet") the user is on. edited on: 2004-06-17 20:03 |
|
|
More, "fun" maybe, however we're not designing the system to be "fun," we designing it to be "functional." Having .IP makes sure the client is aware it is an IP. Using the host prefix (note, prefix means 'placed before', not 'placed after'), would not allow clients to know this. I have no intention of changing this as all it can do is break things in the name of "fun." And al5001, you couldn't be more wrong there. hidden_host is the prefix used when a hostname is +x'ed. As in, "mynet-12345.test.com" "mynet" is the hidden_host. Not a single word of your post made even the slightest bit of sense to me. |
|
|
If it does not make sense, try http://searchnetworking.techtarget.com/sDefinition/0,,sid7_gci213065,00.html It will explain all about subnets. |
|
|
I understand subnets just fine, it still doesn't change the fact that your analysis of how the algorithm works is 100% wrong. Unreal displays NONE of the IP. It doesn't just hide D, it hides the ENTIRE IP. |
|
|
Okay, well so I was wrong about hidden_host. I did not spend the time checking to see what value it returns. Perhaps it is another function that returns the first three octets of the IP. Anyhow, I'm not saying for anyone to run out and change how IPs are masked on the ircd, however, the way I described would just make it look better. |
|
|
>I understand subnets just fine, it still doesn't change the fact that your >analysis of how the algorithm works is 100% wrong. Unreal displays NONE of >the IP. It doesn't just hide D, it hides the ENTIRE IP. Yet, it only hides the bottom-level part of a hostname? That never made any sense to me :S . |
|
|
I just want to say I don't find reasonable to let people use a different suffix in cloaked IPs. In my opinion, that just make people able to easily (and needlessly) advertise their network by including its name in the suffix. I guess al5001 wants that, or just for fun. It's already enough to see the network name in cloaked hostnames. set::hiddenhost-prefix should only inform users that a cloaked hostname is not a real one. In addition, the longer you set the hidden IP suffix, the uglier it becomes. And ".IP" is fairly short. edited on: 2004-06-19 17:01 |
|
|
Well, I don't like using a different suffix either, IMO it should just stay .IP. Anyway, cloaking got modulized 5 weeks ago, so with current CVS / 3.2.1 you can just make your own cloaking module that uses whatever algorithm / whatever way of cloaking :P. |
|
|
I think people are misinterpreting what I mean. My idea is to cloak only the last octet of the IP. Take 192.168.0.1 for example. No cloaking: 192.168.0.1 With cloaking: 192.168.0.mn-A5C8E3 (192.168.0.prefix-algorithm This example above uses hidden host prefix "mn") My reasoning for this - With the last octet of the IP cloaked, the user still has security, meanwhile I can check the IP on arin.net/whois as well by searching "192.168.0.255" for example, by replacing the cloaked part with either 255 or 0.. And I can find both the ISP that the IP belongs to, as well as the full CIDR. If all I see is 53gflkhs065.lkjhg0745306.sdgfj092543.IP, there is no way for me to search it on arin.net/whois. edited on: 2004-06-19 21:13 edited on: 2004-06-19 21:20 |
|
|
Well, as Syzop said, you can make your own cloak algorithm to do this. :P |
|
|
192.168.0.mn-A5C8E3 How does that provide security? I could crack it in a matter of minutes. How you ask? Lets say I have 123.123.123.mn-123ABC Step 1.) I take 123.123.123.0 and plug it into an IP whois database. This gives me a CIDR of 123.123.123/25 (123.123.123.0-123.123.123.127) Step 2.) I begin to PING those 128 IPs. Step 3.) Of the IPs that responded to a PING (or indicated a blocked port), I then portscan 113 (ident) and 59 (DCC server). About 50% of the time, that process will get me the IP. Most IRC users do not run firewalls, and so they will respond to a PING. And many IRC users have either ident or DCC server enabled. But even when that doesn't work. In this example, I have 128 input strings. Doing a brute force on that wouldn't take too long at all. In fact, when Unreal did use an algorithm like that, you could get any IP in about 15 minutes. To you, that might seem like a "nicer" looking method, but it removes all security. If we were going to do it this way, we might as well remove +x altogether as it would just provide false security. Furthermore, why would you need to look in ARIN? The IP masking already lets you ban based on subnet. If you have 14A5968D.8945014C.3AA0BBD3.IP. If I ban, 14A5968D.8945014C.*.IP It's like doing 123.123.123.*. Therefore, there really is no reason to need to query ARIN. Furthermore, being able to query ARIN is yet another reason it's bad! The security isn't just to prevent attacks, it's also to hide who you are. I took my IP, and I replaced the D class with 0. I then plugged it into ARIN. I was able to pinpoint my location to within 15mi. I then plugged my IP but with a 1 at the end, and I managed to find it to within 5mi! Your method would allow someone to have a 5mi radius of where I live. I don't feel too secure knowing that. This will NOT be implemented. |
|
|
Wouldn't it be *.8945014C.3AA0BBD3.IP? |
|
|
Err yes, you are correct. |
|
|
Thank you for the explanation. I must also note on the fact that most ISPs only delegate dynamic IP addresses from an IP pool, where locations can be extremely inaccurate, especially if you live in Toronto, and your IP address belongs to a server in Calgary. I agree. 254 IP addresses (or /24) aren't very many to scan for port 113. To note another, IRC Operators can also get peoples IP addresses, and almost every small network has more opers than users except for the servers with 200+ users, which are usually bots anyways. Edit: What if you made hostmasking mandatory and not able to be removed? How about not allowing any oper to view the IP as well - as soon as they kline the masked address, the ircd can convert it to the real IP and ban it instead of the actual cloaked IP. This way, you'll have 100% security because _noone_ can see the real IP. edited on: 2004-06-20 01:57 |
|
|
> What if you made hostmasking mandatory and not able to be removed? If you want that, use set::modes-on-connect and set::restrict-user-modes. > How about not allowing any oper to view the IP as well I definitely disagree with this, once because IRCOps should not be a security issue, and once because sometimes it's important to see the real IP#, or meaningless to hide it. For example in "IP# Mismatch" notices. There might be better reasons, thought. (Like firewall issues?) |
|
|
I think we can cut off this 'thread'. changable cloakedip suffix has been discussed and rejected, plus alternatives have been offered. why we don't cloak only abc in a.b.c.d but whole abcd has been discussed too. And the last thingy - making it impossible for opers to see IPs - will not be implemented for 234823679342 reasons :P. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2004-06-17 18:19 | Gilou | New Issue | |
| 2004-06-17 20:01 | al5001 | Note Added: 0006686 | |
| 2004-06-17 20:03 | al5001 | Note Edited: 0006686 | |
| 2004-06-17 23:36 |
|
Note Added: 0006690 | |
| 2004-06-17 23:45 | al5001 | Note Added: 0006691 | |
| 2004-06-18 11:56 |
|
Note Added: 0006698 | |
| 2004-06-18 16:17 | al5001 | Note Added: 0006700 | |
| 2004-06-18 16:37 | aquanight | Note Added: 0006702 | |
| 2004-06-19 16:59 | AngryWolf | Note Added: 0006711 | |
| 2004-06-19 17:01 | AngryWolf | Note Edited: 0006711 | |
| 2004-06-19 18:53 | syzop | Note Added: 0006713 | |
| 2004-06-19 21:10 | al5001 | Note Added: 0006724 | |
| 2004-06-19 21:13 | al5001 | Note Edited: 0006724 | |
| 2004-06-19 21:15 | al5001 | Note Edited: 0006724 | |
| 2004-06-19 21:20 | al5001 | Note Edited: 0006724 | |
| 2004-06-19 21:55 | aquanight | Note Added: 0006726 | |
| 2004-06-20 00:34 |
|
Note Added: 0006729 | |
| 2004-06-20 00:41 | aquanight | Note Added: 0006730 | |
| 2004-06-20 00:53 |
|
Note Added: 0006731 | |
| 2004-06-20 01:21 | al5001 | Note Added: 0006732 | |
| 2004-06-20 01:57 | al5001 | Note Edited: 0006732 | |
| 2004-06-20 06:44 | AngryWolf | Note Added: 0006736 | |
| 2004-06-20 12:28 | syzop | Status | new => closed |
| 2004-06-20 12:28 | syzop | Note Added: 0006737 |
