🧵 UDP vs TCP tunneling, UDP IS NOT SAFE FOR VPNs
Anonymous at Mon, 11 Nov 2024 16:29:15 UTC No. 16470935
Availability Exploitation: UDP does not guarantee packet delivery, order, or integrity, leading to potential availability issues. A threat actor could deliberately induce packet loss or network instability, causing disruptions in the communication between IoT devices and their servers.
Integrity Manipulation: By studying the specific applications and their reliance on consistent data transmission, the attacker could exploit these availability issues to manipulate the data being transmitted. For instance, they could inject or alter packets during transmission, leading to data integrity problems. This could cause the applications to behave unpredictably or malfunction.
Confidentiality Breach: Once the integrity of the data is compromised, the attacker could further exploit this to gain access to sensitive information. For example, corrupted data could lead to the exposure of encryption keys or other confidential data, ultimately breaching the confidentiality of the communication.
Not yet rapist at Mon, 11 Nov 2024 16:52:42 UTC No. 16470976
If are staring at substance x on subject y
Are you really feeling anything
Anonymous at Mon, 11 Nov 2024 17:06:39 UTC No. 16471008
> UDP does not guarantee packet delivery, order, or integrity
Not true. VPN applications have their own logic on top of the transport protocol that ensures all of those things.
Anonymous at Mon, 11 Nov 2024 17:20:50 UTC No. 16471021
>>16470935
Not science & math, full of useless shit. Back to your containment board among other pajeets >>>/g/
Anonymous at Mon, 11 Nov 2024 17:31:57 UTC No. 16471041
>>16471021
are you retarded? how do you think you're communicating this right now? you use tcp everyday.
Anonymous at Mon, 11 Nov 2024 17:34:41 UTC No. 16471050
How is basic cryptography so hard for retards?
They ask for dumbed down explanations, as it is all they could handle, then try and come up with a way to "break" the dumbed down version.
All this to say: don't explain things to retards, they won't get it anyway.
Anonymous at Mon, 11 Nov 2024 17:36:12 UTC No. 16471053
>>16471008
Even with HMAC and Prodo-UDP it relies on the application say Firefox for example, to figure it out. If you send UDP over UDP it'll just get lost
HMAC simply makes sure someone isn't TAMPERING with the packets
I'm not talking out of my ass, I've been working on this for a long time, and have found potential solutions and have cryptography encryption based patents
Anonymous at Mon, 11 Nov 2024 17:37:58 UTC No. 16471057
>>16471053
>cryptography encryption based patents
don't out yourself so hard lil bro
Anonymous at Mon, 11 Nov 2024 17:40:51 UTC No. 16471060
>>16471053
Packet Loss and Network Instability: An attacker can exploit the lack of delivery guarantees by inducing packet loss or creating network instability. Techniques such as UDP flooding (sending a large number of UDP packets to overwhelm a target) can disrupt normal communication between IoT devices and their servers. This can lead to denial-of-service (DoS) conditions, where legitimate users cannot access the services they need.
Impact on Real-Time Applications: Many IoT applications rely on real-time data transmission (e.g., video streaming, sensor data). If an attacker can manipulate the availability of these packets, it can lead to degraded performance or complete service outages, affecting the functionality of critical systems.
Since the App in question FUCK let's Facebook or something isn't prepared for a availability losses, aka being disconnected, it behaves oddly, while most of the info comes through some is lost through corruption etc, this leads to strange behaviors, which is a sophisticated threat actor knew about could lead to vulnerabilities in confidentiality.
It is the idea of using UDP's availability issues to make it so apps only receive incomplete data, causing odd loading pages etc, leaving vulnerabilities open
Sure, maybe Firefox can handle being the inner TCP to the Outer UDP tunnel but unless you really trust an app and there are MANY they might not handle this well leading to confidentiality issues
Anonymous at Mon, 11 Nov 2024 17:41:52 UTC No. 16471063
>>16471057
I'm not, English is not my first language but I hate when people say Cryptography OMGG CRYPTOGURRENCY OMFG
I have to specify the encryption part, even intelligent people could think I mean cryptanalysis
Anonymous at Mon, 11 Nov 2024 17:43:15 UTC No. 16471068
>>16471057
Your DISA in the USA liked me a lot, I am bringing this up as it is commonly exploited in UDP based solutions, furthermore, TCP over TCP is not an issue as meltdown (TCP meltdown issues) have been resolved by adjusting timing of corrections
Anonymous at Mon, 11 Nov 2024 18:21:20 UTC No. 16471101
Availability Attacks: If a sophisticated threat actor targets the availability of OpenVPN's UDP traffic, they could employ techniques such as packet loss, flooding, or other denial-of-service (DoS) attacks. This could disrupt the normal flow of data, leading to applications not receiving the necessary packets to function correctly.
Integrity Issues: When the availability of packets is compromised, it can lead to integrity issues. For instance, if packets are dropped or arrive out of order, applications may not be able to reconstruct the data correctly. This can cause unexpected behavior, such as errors in processing or incorrect data being displayed to users.
Confidentiality Risks: If the integrity of the data is compromised, it opens the door for potential confidentiality breaches. For example, if an attacker can manipulate the data being sent or received, they might inject malicious payloads or extract sensitive information. This could lead to unauthorized access to confidential data, such as encryption keys or personal information.
At least two professors in this field have agreed, I won't doxx myself but it's seems to be an issue if a sophisticated
Anonymous at Tue, 12 Nov 2024 23:31:30 UTC No. 16472548
>>16470935
If UDP is so bad then why is QUIC, and by extension HTTP/3, built on top of UDP?
Anonymous at Wed, 13 Nov 2024 19:37:36 UTC No. 16473748
>>16471021
g does not care for actual computer science, like or not, the OP is at least on topic given the theory of networking which is more math than tech