Posted by NewCzech 12 hours ago
My brain has issues with this kind of form. It prevents me from reading words in a fifo manner. I now need to backtrack, because the 'no' negates the word before.
"This is how you negate a verb" -> "This is not how you negate a verb" ('is' can be negated, the negation goes after)
"This confuses the duke" -> "This does not confuse the duke" ('confuses' wants do-support to negate it, and the negation goes after 'do'.)
doesn't need privileges > needs zero privileges > needs no privileges
"Give me a 4 apples."
"Give me a 999 apples."
"Give me a 0 apples."
If it's in a script then that might be difficult, but a racy approximation could be to loop e.g. listening socat with different ports for finding the free port. (Or maybe: parse output of ss.) But if the port use is separate from the port binding, then it might still be busy once the time to rebind it comes.
Same as anything else, an explicit flag to achieve the same "just give me a port" functionality as this "magic number" does without resulting in the documented unpredictable behavior around a technically legitimate port number.
As the article points out, most if not all of the services exposed on port 0 seem to be accidental and likely resulted from people assuming this magic behavior applies everywhere instead of just to one specific API.
Yeah, obviously I'm a programmer so I'm well aware it's technically possible, it was a bit of an exaggeration to explain how much value I feel I get from it.
> most if not all of the services exposed on port 0 seem to be accidental
No program actually end up "exposed on port 0", if it's not supported it won't be able to create a listener on that port, AFAIK. Most yeah, all no. P2P software commonly leverage port 0, and other "discover<>connect" types of software. But I'd agree that it's most likely accidental if outside of those niches.
Clearly you didn't read the article, plenty of stuff is in fact exposed on actual port 0 because it's a real thing and not just a way to get whatever ephemeral port like you're using.
joker@joker:~$ ssh localhost -D 127.0.0.1:0
Bad dynamic forwarding specification '127.0.0.1:0'
joker@joker:~$ ssh localhost -D 127.0.0.1:9999
ssh: connect to host localhost port 22: Connection refused
joker@joker:~$ ssh localhost -L 127.0.0.1:0:localhost:8080
Bad local forwarding specification '127.0.0.1:0:localhost:8080'
joker@joker:~$ ssh localhost -L 127.0.0.1:9999:localhost:8080
ssh: connect to host localhost port 22: Connection refused
I was using Harmonic for Hacker News (https://play.google.com/store/apps/details?id=com.simon.harm...), so it's possible the issue was with the app rather than HN itself.
I later found a separate submission (https://news.ycombinator.com/item?id=50399587) in New that had received some votes but hadn't generated any discussion.
Regardless, this isn't the first time researchers have explored TCP port 0, and it certainly won't be the last.
A few examples from a quick Google search:
* https://www.cyber-threat-intelligence.com/publications/IFIPN...
* https://z3r0trust.medium.com/socket-programming-the-bizarre-...
* https://arxiv.org/pdf/2004.03653
None of these earlier publications diminish the value of the current research. If anything, they highlight how easily lessons involving obscure protocol behaviors and edge cases can be overlooked or forgotten.
Personally, I find network stack manipulation a particularly interesting area of security research, and one that doesn't always receive the attention it deserves. There's understandably significant focus on application-layer vulnerabilities, but that emphasis can lead us to take the behavior and security of the underlying network stack for granted.
The TCP/IP stack is mature, but maturity shouldn't be confused with an absence of exploitable behavior. Between implementation differences, ambiguous specifications, legacy protocol assumptions, and unexpected interactions across layers, there are undoubtedly more edge cases, vulnerabilities, and attack surfaces worth investigating.