Misplaced Pages

This article may rely excessively on sources too closely associated with the subject, potentially preventing the article from being verifiable and neutral. Please help improve it by replacing them with more appropriate citations to reliable, independent, third-party sources. (August 2015) (Learn how and when to remove this message)

The evil bit is a fictional IPv4 packet header field proposed in a humorous April Fools' Day RFC from 2003, authored by Steve Bellovin. The Request for Comments recommended that the last remaining unused bit, the "Reserved Bit" in the IPv4 packet header, be used to indicate whether a packet had been sent with malicious intent, thus making computer security engineering an easy problem – simply ignore any messages with the evil bit set and trust the rest.

Impact

A 2015 research done by network engineer Ben Cartwright-Cox revealed that a number of popular websites (436 websites out of Alexa 20k at the time), such as those belonging to several universities and banks, to antivirus provider Kaspersky and to remote desktop software provider Teamviewer respect the "evil bit" by dropping the inbound request, making them compliant with RFC 3514.

Influence

The evil bit has become a synonym for all attempts to seek simple technical solutions for difficult human social problems which require the willing participation of malicious actors, in particular efforts to implement Internet censorship using simple technical solutions.

As a joke, FreeBSD implemented support for the evil bit that day, but removed the changes the next day. A Linux patch implementing the iptables module "ipt_evil" was posted the next year. Furthermore, a patch for FreeBSD 7 is available, and is kept up-to-date.

There is an extension for XMPP protocol, inspired by evil bit.

This RFC has also been quoted in the otherwise completely serious RFC 3675, ".sex Considered Dangerous", which may have caused the proponents of .xxx to wonder whether the Internet Engineering Task Force (IETF) was commenting on their application for a top-level domain (TLD) – the document was not related to their application.

For April Fool's 2010, Google added an &evil=true parameter to requests through the Ajax APIs.

A patch to add compatibility for RFC 3514 in Wireshark was proposed but never implemented.

See also

• Technological fix
• Do Not Track
• HTTP 451

References

1. S. Bellovin (April 1, 2003). The Security Flag in the IPv4 Header. Network Working Group. doi:10.17487/RFC3514. RFC 3514. Informational. This is an April Fools' Day Request for Comments.
2. Rocha, Luis (April 1, 2013). "The Evil Bit". Count Upon Security. Retrieved May 9, 2016.
3. "I may be the only evil (bit) user on the internet". blog.benjojo.co.uk. Retrieved September 13, 2024.
4. Implementation, removal
5. "ipt_evil, kernel part". Archived from the original on February 2, 2011. Retrieved January 1, 2011.
6. "RFC3514 for FreeBSD7". Archived from the original on February 18, 2009. Retrieved December 26, 2013.
7. Saint-Andre, Peter; Hildebrand, Joe (April 1, 2003). "XEP-0076: Malicious Stanzas". Archived from the original on April 16, 2013.
8. "Adult-Related TLDs Considered Dangerous". Retrieved July 6, 2017.
9. "Helping you help us help you". googleajaxsearchapi.blogspot.co.uk. Retrieved February 19, 2017.
10. "Wireshark · Ethereal-dev: [Ethereal-dev] Patch: RFC 3514 support". Wireshark. Retrieved May 15, 2024.

• 2003 in computing
• April Fools' Day jokes
• Computer network security
• Computer humour
• Censorship
• 2003 hoaxes