On the detection of quantum insert | Hacker News Reader

On the detection of quantum insert

tedunangst.com

35 pointsingve6 comments

Well, who actually does packet-level analysis of every connection they make? Maybe some troubled/paranoid individuals are constantly running tcpdump and analyzing all the traffic to/from their computer but that can't be a large subset. This sort of discussion is also hard to come by - people/organizations rarely, if ever, actually advertise what kind of traffic analysis / security systems they're running, yet it's extremely interesting (at least to me) and I've always wondered.

To detect (and actually analyze) some sort of unknown zero-day you probably need to have entire network packets/connection streams stored so you can see what sort of traffic and data was incoming? Who does that and what sort of system can do that at large enough scale?

The topic of moving beyond protection (firewalls etc.) and into actual detection (log analysis, traffic analysis etc.) seems to be rarely discussed.

All the author is showing is that no-one who he tried to scam spotted his fake duplicate packets. At best, none of the people were running any QI-detecting code, and if they were, no-one reported the incident to a forum that he read. It's not a very conclusive result, really.

Maybe detecting QI is actually hard? You need a buffer of TCP data, that was possibly already passed to application.

1) Is there a kernel patch yet?

2) "HoneyBadger is a passive TCP protocol analyzer whose only purpose in life is to detect and optionally record TCP injection attacks." https://github.com/david415/HoneyBadger_docs/blob/hackpad1/s...

I wrote a script a while ago in Go to detect quantum insert attacks. It's not perfect but its well commented. I noticed quite a few detections when I ran it for a few days but they seemed to be benign, probably retransmissions.

https://gist.github.com/hkparker/97548b2c0c79a9149f50

... I can only churn out so much linkbait, even for the sake of science.

As a consolation, I offer the idea that the sum of linkbait in the universe is constant. And since the days of Max Planck & Erwin Schrödinger, no-one can know the contents of a link until you klick it.

If we produce enough quantum haze, the NSA might just get confused.

If you detected a Quantum Insert attack against you, would you even say anything? Why alert your adversary?

Reply on news.ycombinator.com