

On the detection of quantum insert - ingve
http://www.tedunangst.com/flak/post/on-the-detection-of-quantum-insert

======
noinsight
Well, who actually does packet-level analysis of every connection they make?
Maybe some troubled/paranoid individuals are constantly running tcpdump and
analyzing all the traffic to/from their computer but that can't be a large
subset. This sort of discussion is also hard to come by - people/organizations
rarely, if ever, actually advertise what kind of traffic analysis / security
systems they're running, yet it's extremely interesting (at least to me) and
I've always wondered.

To detect (and actually analyze) some sort of unknown zero-day you probably
need to have entire network packets/connection streams stored so you can see
what sort of traffic and data was incoming? Who does that and what sort of
system can do that at large enough scale?

The topic of moving beyond protection (firewalls etc.) and into actual
detection (log analysis, traffic analysis etc.) seems to be rarely discussed.

------
joosters
All the author is showing is that no-one who he tried to scam spotted his fake
duplicate packets. At best, none of the people were running any QI-detecting
code, and if they were, no-one reported the incident to a forum that he read.
It's not a very conclusive result, really.

------
majke
Maybe detecting QI is actually hard? You need a buffer of TCP data, that was
possibly already passed to application.

1) Is there a kernel patch yet?

2) "HoneyBadger is a passive TCP protocol analyzer whose only purpose in life
is to detect and optionally record TCP injection attacks."
[https://github.com/david415/HoneyBadger_docs/blob/hackpad1/s...](https://github.com/david415/HoneyBadger_docs/blob/hackpad1/source/how-
to-badger-the-puppet-masters.rst#tcp-injection-attack-categories)

------
hkparker
I wrote a script a while ago in Go to detect quantum insert attacks. It's not
perfect but its well commented. I noticed quite a few detections when I ran it
for a few days but they seemed to be benign, probably retransmissions.

[https://gist.github.com/hkparker/97548b2c0c79a9149f50](https://gist.github.com/hkparker/97548b2c0c79a9149f50)

------
tempodox
_... I can only churn out so much linkbait, even for the sake of science._

As a consolation, I offer the idea that the sum of linkbait in the universe is
constant. And since the days of Max Planck & Erwin Schrödinger, no-one can
know the contents of a link until you klick it.

If we produce enough quantum haze, the NSA might just get confused.

------
agd
If you detected a Quantum Insert attack against you, would you even say
anything? Why alert your adversary?

