Faking the TCP handshake

#1

Post by citizenk » Tue, Dec 01, 2015, 9:07 AM UTC

Faking the TCP handshake
lgms.nl

Re: Faking the TCP handshake

#2

Post by arpa » Wed, Dec 02, 2015, 1:42 PM UTC

well AFAIR TCP RST attack works exactly like that...

https://en.wikipedia.org/wiki/TCP_reset_attack

So I doubt this is a new finding.

Re: Faking the TCP handshake

#3

Post by tptacek » Wed, Dec 02, 2015, 1:42 PM UTC

I'm not sure this is new. The technique of suppressing responses from the spoof source is as old as TCP sequencing, and was a prerequisite for Laurent Joncheray's "Simple Active Attack Against TCP" that introduced session hijacking.

Also see:

http://phrack.org/issues/64/13.html

Re: Faking the TCP handshake

#4

Post by armitron » Wed, Dec 02, 2015, 1:43 PM UTC

This attack has been around forever and ever, I don't see anything new. In fact, it's the opposite, his method is naive (dumb bruteforcing). Moreover, a lot (the vast majority) of networks these days drop spoofed packets (egress).

The phrack article describes a lot more sophisticated attack.

Mitnick used it to hack Shimomura.

http://wiki.cas.mcmaster.ca/index.php/The_Mitnick_attack

More recent but still 9 years old: http://phrack.com/issues/64/13.html#article

Re: Faking the TCP handshake

#5

Post by ikeboy » Wed, Dec 02, 2015, 1:46 PM UTC

http://lcamtuf.coredump.cx/oldtcp/tcpseq.html

> However, guessing the right ISN from the entire 32-bit space (4,294,967,296 possibilities) is not feasible due to the excessive amount of bandwidth and time required. That is why a good TCP sequence number generator implementation currently provides enough security to protect against spoofing attacks, at least for the present time and in typical conditions. But increasing bandwidth and processor speed will eventually make brute force guessing of 32-bit ISNs feasible for the average attacker.

Re: Faking the TCP handshake

#6

Post by wtbob » Wed, Dec 02, 2015, 1:49 PM UTC

tptacek wrote: post #3

I'm not sure this is new. The technique of suppressing responses from the spoof source is as old as TCP sequencing, and was a prerequisite for Laurent Joncheray's "Simple Active Attack Against TCP" that introduced session hijacking. Also see: http://phrack.org/issues/64/13.html

Perhaps what's new is that it is so easily exploitable?

I remember when 32 bits seemed huuuge, and now … not so much.

Re: Faking the TCP handshake

#7

Post by armitron » Wed, Dec 02, 2015, 1:52 PM UTC

wtbob wrote: post #6

tptacek wrote: post #3

I'm not sure this is new. The technique of suppressing responses from the spoof source is as old as TCP sequencing, and was a prerequisite for Laurent Joncheray's "Simple Active Attack Against TCP" that introduced session hijacking. Also see: http://phrack.org/issues/64/13.html

Perhaps what's new is that it is so easily exploitable? I remember when 32 bits seemed huuuge, and now … not so much.

No it's not, the author "failed" to mention that the vast majority of networks drop spoofed packets. It may be exploitable inside a target network, locally, but one usually has a lot better options if he has a foothold there, than bruteforcing sequence numbers with gigabytes of traffic for a single connection.

It's dumb is what it is.

Re: Faking the TCP handshake

#8

Post by tptacek » Wed, Dec 02, 2015, 1:53 PM UTC

armitron wrote: post #4

This attack has been around forever and ever, I don't see anything new. In fact, it's the opposite, his method is naive (dumb bruteforcing). Moreover, a lot (the vast majority) of networks these days drop spoofed packets (egress). The phrack article describes a lot more sophisticated attack. Mitnick used it to hack Shimomura. http://wiki.cas.mcmaster.ca/index.php/The_Mitnick_attack More recent but still 9 years old:…

I don't think probing the whole ISN space is new, but that's not how the tool Mitnick was given worked. At the time of the Mitnick attack, TCP ISNs were trivially predictable; you could connect to a host, note its ISN, and then know within a very tight range what the next ISN on the next connection --- from any host --- would be.

Re: Faking the TCP handshake

#9

Post by armitron » Wed, Dec 02, 2015, 1:54 PM UTC

tptacek wrote: post #8

armitron wrote: post #4

This attack has been around forever and ever, I don't see anything new. In fact, it's the opposite, his method is naive (dumb bruteforcing). Moreover, a lot (the vast majority) of networks these days drop spoofed packets (egress). The phrack article describes a lot more sophisticated attack. Mitnick used it to hack Shimomura. http://wiki.cas.mcmaster.ca/index.php/The_Mitnick_attack More recent but still 9 years old:…

I don't think probing the whole ISN space is new, but that's not how the tool Mitnick was given worked. At the time of the Mitnick attack, TCP ISNs were trivially predictable; you could connect to a host, note its ISN, and then know within a very tight range what the next ISN on the next connection --- from any host --- would be.

The sequence number prediction specifics are different, but the attack is the same, blind TCP spoofing.

Re: Faking the TCP handshake

#10

Post by tptacek » Wed, Dec 02, 2015, 1:56 PM UTC

armitron wrote: post #9

tptacek wrote: post #8

Earlier quoted context omitted.

I don't think probing the whole ISN space is new, but that's not how the tool Mitnick was given worked. At the time of the Mitnick attack, TCP ISNs were trivially predictable; you could connect to a host, note its ISN, and then know within a very tight range what the next ISN on the next connection --- from any host --- would be.

The sequence number prediction specifics are different, but the attack is the same, blind TCP spoofing.

I think it depends on how you read the article. The most charitable reading is that the authors couldn't find a source for probing the whole ISN space, and believe that variant of the attack is novel. I think you have to be a bit uncharitable to assume they're claiming the whole concept of blind TCP spoofing.