Skip to main content

The return of the Evil bit?

RFC3514 specifies that

Firewalls, packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. We define a security flag in the IPv4 header as a means of distinguishing the two cases.

How is this achieved?

To solve this problem, we define a security flag, known as the "evil" bit, in the IPv4 [RFC791] header. Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.

But what happens if an evil application refuses to co-operate and leaves the evil bit reset on packets generated by it?

RFC3514 has a submission date of 01 April 2003, but this does not:

Microsoft Office 2003 introduced Information Rights Management (IRM) that provides a way to help restrict recipients from copying, printing, or forwarding e-mail messages.

[...]

Opening the message with other e-mail applications or even using different types of accounts might result in recipients having full permissions to forward or reply all to a message.

D’oh? I’ve heard of security by obscurity, but what do you call this? Security by divine fiat? Security by Redmond insists?

Comments

Post a Comment

Popular posts from this blog

An Open and Shut response to Darl McBride

Hi, Darl. I see you’re being dishonest again . It’d be really nice if you could shoot straight for a change, but I think Kerry’s Dad will be selling snowplows in Hell first. Three years ago, when I first joined The SCO Group, we focused the company on the area that was most profitable and provided the most benefit to customers, investors, resellers, developers and employees: UNIX No, you focused the company on suing people, which was most profitable to lawyers and provided some golden parachutes for your buddies. People thought we were crazy. They were right. But since SCO owns the UNIX operating system The SCO Group does not own UNIX® in any sense of the word. The Open Group owns the UNIX trademark, definition and other rights , The SCO Group does not. The SCO Group doesn’t even own the UnixWare® or OpenServer® code, the rights to those are held by Novell and TSG use them only by permission and under certain conditions — which they have violate...
5 comments
Read more

5x7 text dot-matrix in five minutes...

This is a fairly primitive toy I threw together today for a specific purpose, published in case it’s any use to others... feed it a list of words as command arguments, which it will then display as a 5x7 ASCII dotmatrix with ‘#’ as a dot & ‘_’ as a blank. /* * display text using a 5x7 bitmap font in ASCII letters */ static unsigned char font [] [5] = { { 0x00,0x00,0x00,0x00,0x00 }, // 0x20 32 { 0x00,0x00,0x6f,0x00,0x00 }, // ! 0x21 33 { 0x00,0x07,0x00,0x07,0x00 }, // " 0x22 34 { 0x14,0x7f,0x14,0x7f,0x14 }, // # 0x23 35 { 0x00,0x07,0x04,0x1e,0x00 }, // $ 0x24 36 { 0x23,0x13,0x08,0x64,0x62 }, // % 0x25 37 { 0x36,0x49,0x56,0x20,0x50 }, // & 0x26 38 { 0x00,0x00,0x07,0x00,0x00 }, // ' 0x27 39 { 0x00,0x1c,0x22,0x41,0x00 }, // ( 0x28 40 { 0x00,0x41,0x22,0x1c,0x00 }, // ) 0x29 41 { 0x14,0x08,0x3e,0x08,0x14 }, // * 0x2a 42 { 0x08,0x08,0x3e,0x08,0x08 }, ...
5 comments
Read more

Citizens Augmenting Government Waste

So here we have Microsoft-funded “ Citizens Against Government Waste ” (CAGW) heavily criticising Massachusetts’s switch to an internationally accepted and open document standard (not open source, open standard — but I seem to remember a large monopolist who frequently confuses the two when it suits them). I remember CAGW, they were the organisation who had dead people writing in to support Microsoft in court a few years ago — thanks to sbergman27 for the link — is this “the dead hand of CAGW” at work again? Let’s follow the money and find out. Who stands to lose the most money and control if Massachusetts switches to an unencumbered document format? Big surprise, it’s CAGW sponsor Microsoft, through their dominant MS-Office suite. Why did CAGW list Microsoft’s suite last, after two other much-less-dominant examples which are waning anyway? If you’re inclined to wallow in additional irony, consider that at leas...
Post a Comment
Read more