Faking the TCP handshake

Re:Faking the TCP handshake by tptacek on Wednesday December 02, 2015 @08:42AM (#10662838)

I'm not sure this is new. The technique of suppressing responses from the spoof source is as old as TCP sequencing, and was a prerequisite for Laurent Joncheray's "Simple Active Attack Against TCP" that introduced session hijacking.

Also see:

http://phrack.org/issues/64/13.html

[ Parent | on HN ]

Re:Faking the TCP handshake by wtbob on Wednesday December 02, 2015 @08:49AM (#10662867)

Perhaps what's new is that it is so easily exploitable?

I remember when 32 bits seemed huuuge, and now … not so much.

[ Parent | on HN ]

Re:Faking the TCP handshake by armitron on Wednesday December 02, 2015 @08:52AM (#10662888)

No it's not, the author "failed" to mention that the vast majority of networks drop spoofed packets. It may be exploitable inside a target network, locally, but one usually has a lot better options if he has a foothold there, than bruteforcing sequence numbers with gigabytes of traffic for a single connection.

It's dumb is what it is.

[ Parent | on HN ]

Re:Faking the TCP handshake by laumars on Wednesday December 02, 2015 @09:13AM (#10662994)

> It's dumb is what it is.

Steady on there. The author has clearly done a lot of work on this and while your points are valid, that this method of attack isn't new nor practical, he has still learned a very genuine potential vector for attack. Thus it deserves a mature discussion since there will certainly be others who might learn from the author's research.

I'm all for constructive criticisms, but calling his article "dumb" is just unnecessary language. It doesn't contribute anything and yet could discourage authors from publishing future work.

[ Parent | on HN ]

Re:Faking the TCP handshake by jacquesm on Wednesday December 02, 2015 @09:28AM (#10663083)

Anti-spoof measures are really only effective close to the edge, further in packets are routed with abandon because of overhead and difficulty in verifying the origin.

[ Parent | on HN ]

Re:Faking the TCP handshake by fulafel on Thursday December 03, 2015 @08:00AM (#10669306)

Counting on the attacker's own network to have egress filtering stopping his attacks, isn't that a bit like discounting spam because most networks filter outbound SMTP?

If your defenses are predicated on the assumption that you aren't going to encounter bad stuff due to filtering at the source, you are in for a bad time.

[ Parent | on HN ]