1

Multitun is a tunnel that encrypts connections and sends them bulk over a web socket, which is a web standard. So firewalls that ensure the expected protocol is running on the allowed port, will just pass it through as being compliant with HTML. Is there anything a firewall or filtering system can do to detect this kind of tunnel, that adheres to standards and utilizes a protocol generally allowed through by the organization? Is detecting such a thing feasible?

2

The detection of such type of tunnels is little bit difficult since they are using well known protocol which is generally allowed through the firewalls. Detection of such type of tunnels requires machine learning techniques but there is a chance of getting FPs.

Tool Fingerprinting:

There are various tool that tunnels data over well known protocols like iodine, dnscat, ptunnel. Fingerprinting these tool is an idea to detect the tunnel. Detecting these tools requires the knowledge of protocols for that refers RFCs, learn every aspect of the protocol and apply it to detect the tunnel. Now create a environment with this tool and capture the traffic using any ethereal tools(wireshark, tcpdump etc) and analyze the traffic. You will definitely find some patterns which will be unique to the tool. I'm telling this because I've detected above mentioned tools and more using this method because writing machine learning code requires more efforts.

The drawback of detecting tunnel using pattern is, you must have to check the updates when there is any for the tool but what I've seen the pattern is always same for all the tools.

  • Do you suppose there are a large number of organizations who try to employ such filtering? – horse hair Nov 16 '14 at 14:53
  • Yes there are many organizations. Currently it's a hot topic in current market and also there are various research papers that talks about it. – P4cK3tHuNt3R Nov 16 '14 at 15:06
  • It's not part of the question but, if you could give a couple links to papers, that would be really cool – horse hair Nov 16 '14 at 15:11
  • Refer sans reading room or Google Scholar to get more on this. – P4cK3tHuNt3R Nov 17 '14 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.