Techno Security 2007 Talk on Single Packet Authorization
31 March, 2007
At the Techno Security 2007
conference (June 3-6, Myrtle Beach, South Carolina) I will be giving a talk
entitled "Zero-day Attack Prevention via Single Packet Authorization".
My intention for this talk is to illustrate practical usages of
fwknop with an emphasis on live demonstrations of
the technology. There have also been some interesting developments in the Single
Packet Authorization world since I last gave a talk on the topic at
ShmooCon, 2006. In particular,
Sebastien Jeanquier wrote a Master's Thesis
on SPA entitled "An Analysis of Port Knocking and Single Packet Authorization"
at the Information Security Group (ISG) at
Royal Holloway College, University of London.
His thesis is an excellent evaluation of the port knocking and SPA concepts,
and is a must-read for anyone who would like to explore an authoritative
treatment of the two security mechanisms. Sebastien uses a quote from
Bruce Schneier's
Applied Cryptography to help explain away the perception that some
people have that SPA suffers from security through obscurity (which it
thoroughly does not):
"...If I take a letter, lock it in a safe, hide the safe somewhere in New York, then tell you to read the letter, that's not security. That's obscurity. On the other hand, if I take a letter and lock it in a safe, and then give you the safe along with the design specifications of the safe and a hundred identical safes with their combinations so that you and the worlds best safecrackers can study the locking mechanism - and you still can't open the safe and read the letter - that's security..."
Also, additional SPA projects have sprung up, such as an in-kernel implementation that is built entirely within the Netfilter framework. I will discuss these implementations, and make the case that SPA is maturing as a valuable protective mechanism against unknown zero-day exploits in server software.
