News for hackers. Stuff that matters.

A comment on Identifying Airtel middleboxes that censor HTTPS traffic. Parent comment

Re:Identifying Airtel middleboxes that censor HTTPS traffic by justDankin on Tuesday September 29, 2020 @09:21AM (#24627454)
Yes! That's a great observation

However, the reason I went for probing the entire path is because the TTL itself can be spoofed

[ Parent | on HN ]
Re:Identifying Airtel middleboxes that censor HTTPS traffic by galliher on Tuesday September 29, 2020 @09:31AM (#24627576)
Agreed, it's flimsy. Certainly a bit more effort for them spoof it correctly though. Would need to watch traffic on the path back per flow to isolate the number of prior decrements to the TTL leading up to MitM, and then store that value until such time that it sees an SNI it cares about / it's time to generate a reset.
[ Parent | on HN ]