This strongly reminds me that Silence on the wire by Michal Zalewski, really is an excellent read.
A TCP weakness in Linux systems allows network traffic hijack
21–25 of 25 posts
Re: A TCP weakness in Linux systems allows network traffic hijack
#22Earlier quoted context omitted.
If your comment is true, then the title is misleading. It's not just Linux that is vulnerable, right?
Of major operating systems Linux is the only one that implements that part of the RFC
I still think the title is misleading. Compare:
“A TCP weakness in Linux systems allows ...” vs “A TCP weakness allows ... on Linux systems”
Technically, it's not just Linux that's affected - it's the TCP protocol itself. The “on Linux systems” part is sort of redundant, and only serves to point out that other operating systems are unaffected as they don't implement that part of the RFC.
Re: A TCP weakness in Linux systems allows network traffic hijack
#23Earlier quoted context omitted.
Of major operating systems Linux is the only one that implements that part of the RFC
I still think the title is misleading. Compare: “A TCP weakness in Linux systems allows ...” vs “A TCP weakness allows ... on Linux systems” Technically, it's not just Linux that's affected - it's the TCP protocol itself. The “on Linux systems” part is sort of redundant, and only serves to point out that other operating systems are unaffected as they don't implement that part of the RFC.
Not quite -- the RFC recommended rate limiting challenge ACKs, but it didn't say to do it with a per-system global variable that would leak shared state. From the paper:
> Therefore, the Linux kernel has faithfully implemented this feature by storing the challenge ACK counter in a global variable shared by all TCP connections. This approach, unfortunately, creates an undesirable side channel, as will be elaborated.
I think it's reasonable to call it a Linux bug. You can certainly criticize the RFC as failing to disclose (or more likely, failing to realize) the risk of an insecure implementation with side channels.
Re: A TCP weakness in Linux systems allows network traffic hijack
#24Probably affects Android too since it uses the Linux kernel. Personally I consider this to be a mild to moderate vulnerability since under no circumstances should you ever trust a non-encrypted non-authenticated channel to be safe. TCP offers in-order delivery and decent integrity checking but otherwise offers absolutely no security guarantees at all. From a crypto point of view an authentication method like TCP sequ…
> Personally I consider this to be a mild to moderate vulnerability since under no circumstances should you ever trust a non-encrypted non-authenticated channel to be safe.
So you're saying you.. don't use TCP? That seems unlikely.
Someone using this vulnerability can prevent you from opening the encrypted authenticated channel you're trying to be safe with (by injecting RST). I don't see how you can call it mild.
Re: A TCP weakness in Linux systems allows network traffic hijack
#25Earlier today I had an issue where, for some reason, my IP address was wrong. Like I was being sent through a VPN. Google and IRC were treating me as if I had a spammer's IP address.
I know this is a common virus issue on Windows but couldn't find any explanation for why that would happen on Linux and, after turning on my actual VPN, it went away.
So could someone explain if this is related to me? I was seriously freaked out by it, and still don't really have an explanation.