Hacker News Reader

Comment by MuffinFlavored | Hacker News Reader

I've used this before and it's great as a "reverse tunnel" when you have a VM in the cloud that does allow configurable port forwarding/firewall rules but need to connect "peer to peer" to a customer in a workshop who has the typical "my router blocks everything and we aren't going to spend the time supporting every workshop's possible inbound network connection setup".

It helps for "flipping" the "server connects to client".

But... it gets detected as malware really easily haha

View on HN

> But... it gets detected as malware really easily haha

It's a common tool in the red teamer's toolbox.

Just search "chisel" on https://ippsec.rocks to see how often it's utilised in a pentest type of scenario.

It is used by red teamers because it is used by attackers.

https://malpedia.caad.fkie.fraunhofer.de/details/win.chisel

Well it's used by both because it's pretty useful in attack-like situations.

Tomato tomahto

Tomatoe, tomato. The E at the end of the word generally reflects hardening/lengthening the preceding morpheme (rid, ride; cloth, clothe).

This is a good example of how language evolves because tomahto has not ever been a correct spelling of tomato, and tomatoe is an incorrect spelling derived from making tomato plural into tomatoes and then (incorrectly) dropping just the s to make tomatoes singular again. A mistake based off of a mistake. So while intelligible if incorrect, who's to say if it's wrong?

I was tempted to play the cat and mouse AV detection game though decided against it. It’s open source and with effort, one can make it avoid detection, but I’ll leave that up the reader

That makes it kinda useless.

What we need is a self-updating mechanism. See for instance yt-dlp, which breaks every now and then but a simple update almost always puts you back in action. We need something similar for tunnels.

What benefit would a self-updating mechanism provide?

Assuming they mean a cat and mouse game like ytdl where the software is updated once it starts getting detected by the enemy.

How will it self update after it's been deleted by the AV? Also, there are many AVs with different detection strategies. It's not always static analysis that can easily be defeated by slightly changing some lines of code.

I was thinking more about it being filtered by firewalls.

I don't think Chisel has a goal of evading AV detection.

by that you mean, the traffic is suspicious or the binary?

Both the protocol tunneling activity and the binary would likely be flagged by most enterprise security software.

Having used this as a part of a solution we were delivering to corporate customers, the traffic wasn't causing problems (we were tunneling over secure WebSockets, though, not plain text ones). It's only those overzealous "malware detection" tools that caused us to have to drop it and come up with a different way of encrypting our traffic.

The protocol is http(s) so it looks quite generic, are you transiting the GFW? Probably shouldn't be.

Reply on news.ycombinator.com