Explore the security implications of complexity and ambiguity in RFC implementations through a 36-minute Black Hat conference talk. Analyze the vulnerabilities arising from different interpretations of RFC 1035's message compression in TCP/IP stacks. Delve into the 20-year history of compression vulnerabilities, examine newly discovered issues, and discuss affected devices. Learn about anti-patterns, supply chain impacts, and potential solutions including improved documentation, static analysis, device fingerprinting, and intrusion detection. Gain insights from speakers Daniel dos Santos and Shlomi Oberman on the critical intersection of protocol complexity and cybersecurity.
The Cost of Complexity - Different Vulnerabilities While Implementing the Same RFC