Faking the TCP handshake

Re:Faking the TCP handshake by barhun on Wednesday December 02, 2015 @01:10PM (#10664668)

i've been aware of this attack for about 10 years, how can it be a new finding? the following article was written in 1997.

http://www.citi.umich.edu/u/provos/papers/secnet-spoof.txt

[ Parent | on HN ]

Re:Faking the TCP handshake by lucb1e on Thursday December 03, 2015 @02:37AM (#10668328)

That involves "source routing" though (from what I get, that means controlling the route a packet will take, at least partially). I only see one ACK being returned, not multiple, so apparently the attacker is able to receive the SYN+ACK here. This means it's a different attack.

[ Parent | on HN ]

Re:Faking the TCP handshake by barhun on Wednesday December 02, 2015 @01:14PM (#10664688)

the boy is 21 years old, forget it.

[ Parent | on HN ]

Re:Faking the TCP handshake by lgommans on Thursday December 03, 2015 @02:40AM (#10668347)

Then again, I did read (parts of) the RFC from '81, some paper (from Morris iirc) about predicting the ISN from '85, lots of research in the 90's and early 00's regarding predictions and preventing it... but nothing actually just guessed the number, and people seemed to agree that "if the ISN is unpredictable then yeah it's secure right?" That's why I considered this a new thing.

[ Parent | on HN ]