News for hackers. Stuff that matters.

A comment on Some thoughts on OpenSSH 9.8's PerSourcePenalties feature. Parent comment

Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by spogbiper on Wednesday August 14, 2024 @03:50PM (#41249820)
reminds me of using the old MIRROR target in iptables back in the day. before it was removed because its ridiculous. we used to watch script kiddies trying to brute force their own hosts but even then we knew it was ripe for abuse.

https://www.linuxtopia.org/Linux_Firewall_iptables/x4448.htm...

[ Parent | on HN ]
Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by Terr_ on Wednesday August 14, 2024 @04:58PM (#41250431)
Probably for the best, since it sounds like that could be used for DDoS amplification and/or reflection.

For example, if an attack could spoof traffic to get two different reflectors hall-of-mirror-ing each other, or using a botnet that spoofs traffic to get one collection of dupes to slam a single victim in response, etc.

[ Parent | on HN ]
Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by metadat on Wednesday August 14, 2024 @08:17PM (#41252063)
How would you spoof multiple valid packets in a TCP-based protocol requiring a sequence of interactions when you can't receive any of the ACKs (because they'll be sent to not-your-IP)?
[ Parent | on HN ]
Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by katzinsky on Wednesday August 14, 2024 @10:36PM (#41252668)
Depending on the protocol you can probably do reflection attacks over tcp with TFO.
[ Parent | on HN ]
Re:Some thoughts on OpenSSH 9.8's PerSourcePenalties feature by snvzz on Wednesday August 14, 2024 @09:54PM (#41252481)
It was beautiful to see people nuke themselves in winnuke era.
[ Parent | on HN ]