4 ms·

This attack has been around forever and ever, I don't see anything new. In fact, it's the opposite, his method is naive (dumb bruteforcing). Moreover, a lot (t

This attack has been around forever and ever, I don't see anything new. In fact, it's the opposite, his method is naive (dumb bruteforcing). Moreover, a lot (the vast majority) of networks these days drop spoofed packets (egress). The phrack article describes a lot more sophisticated attack. Mitnick used it to hack Shimomura. http://wiki.cas.mcmaster.ca/index.php/The_Mitnick_attack http://wiki.cas.mcmaster.ca/index.php/The_Mitnick_attack More recent but still 9 years old: http://phrack.com/issues/64/13.html#article http://phrack.com/issues/64/13.html#article

tptacek 11y ago
I don't think probing the whole ISN space is new, but that's not how the tool Mitnick was given worked. At the time of the Mitnick attack, TCP ISNs were trivially predictable; you could connect to a host, note its ISN, and then know within a very tight range what the next ISN on the next connection --- from any host --- would be.
- armitron 11y ago
  The sequence number prediction specifics are different, but the attack is the same, blind TCP spoofing.
  - tptacek 11y ago
    I think it depends on how you read the article. The most charitable reading is that the authors couldn't find a source for probing the whole ISN space, and believe that variant of the attack is novel. I think you have to be a bit uncharitable to assume they're claiming the whole concept of blind TCP spoofing.
    - armitron 11y ago
      I would cut them a lot more slack if they mentioned that their method doesn't work in the vast majority of networks today (assuming one wants to cross networks with it), due to egress filtering. If one is already present locally, and can send spoofed packets, there are far better attacks to try than sending tens to hundreds of gigabytes of data for a single spoofed connection (that will be immediately terminated). Their method doesn't even attempt to keep the connection going. Anyone with network experience would see the bruteforcing method as elementary and common knowledge really, it's nothing new. In short, amateur hour.
      - tptacek 11y ago
        Since TCP spoofing is essentially an academic concept at this point --- even if you could do it in milliseconds, it wouldn't be very useful --- I'm not sure the practical baggage or refinements you're talking about are that important. Also, I think RPF filtering is a little less common than you're implying that it is.
        fulafel 11y ago
        Why not useful? In my experience setups involving IP ACLs for TCP services are pretty common in the wild. As well as risk-assesments talking about the relative rarity of on-path attackers, predicated on TCP security against off-path attackers.
        AnthonyMouse 11y ago
        Risk assessments making bad assumptions is not a new thing. People are always advocating egress filtering because "if only everybody would do it ...", but it's a classic tragedy of the commons. Egress filtering doesn't meaningfully help the network doing it and it may cause ugly problems with asymmetric routes and the like, so the number of networks that don't do it is large enough to be meaningful. And if you get close enough to the core of the internet it's basically impossible anyway because there is no practical way to keep track of which address ranges a particular interface should legitimately be sending traffic from when the list encompasses half the address ranges on the internet and can change at any time. The upshot being it's not at all difficult for an attacker to get hold of a connection that doesn't do egress filtering, and that isn't ever going to change.
      - deleted 11y ago
        [deleted]
  - zurn 11y ago
    It's different: The old was attacking weak randomness, this is showing easy brute forcing.
SFjulie1 11y ago
And it was easy because the PRNG had a small volume in the space phase http://lcamtuf.coredump.cx/newtcp/ http://lcamtuf.coredump.cx/newtcp/ What I don't understand is why the use of Taken's series are still not a standard for the analysis of the randomness... It resulted in this CVE http://www.cert.org/historical/advisories/CA-2001-09.cfm http://www.cert.org/historical/advisories/CA-2001-09.cfm And almost all the industry either switching to linux or as the licence authorized it they could have used BSD TCP stack since then, I guess. Here is an horrible implementation of Taken's visualization. https://gist.github.com/jul/0f16782ed01f18c2c72a https://gist.github.com/jul/0f16782ed01f18c2c72a

tptacek 11y ago

I don't think probing the whole ISN space is new, but that's not how the tool Mitnick was given worked. At the time of the Mitnick attack, TCP ISNs were trivially predictable; you could connect to a host, note its ISN, and then know within a very tight range what the next ISN on the next connection --- from any host --- would be.

armitron 11y ago
The sequence number prediction specifics are different, but the attack is the same, blind TCP spoofing.
- tptacek 11y ago
  I think it depends on how you read the article. The most charitable reading is that the authors couldn't find a source for probing the whole ISN space, and believe that variant of the attack is novel. I think you have to be a bit uncharitable to assume they're claiming the whole concept of blind TCP spoofing.
  - armitron 11y ago
    I would cut them a lot more slack if they mentioned that their method doesn't work in the vast majority of networks today (assuming one wants to cross networks with it), due to egress filtering. If one is already present locally, and can send spoofed packets, there are far better attacks to try than sending tens to hundreds of gigabytes of data for a single spoofed connection (that will be immediately terminated). Their method doesn't even attempt to keep the connection going. Anyone with network experience would see the bruteforcing method as elementary and common knowledge really, it's nothing new. In short, amateur hour.
    - tptacek 11y ago
      Since TCP spoofing is essentially an academic concept at this point --- even if you could do it in milliseconds, it wouldn't be very useful --- I'm not sure the practical baggage or refinements you're talking about are that important. Also, I think RPF filtering is a little less common than you're implying that it is.
      - fulafel 11y ago
        Why not useful? In my experience setups involving IP ACLs for TCP services are pretty common in the wild. As well as risk-assesments talking about the relative rarity of on-path attackers, predicated on TCP security against off-path attackers.
        AnthonyMouse 11y ago
        Risk assessments making bad assumptions is not a new thing. People are always advocating egress filtering because "if only everybody would do it ...", but it's a classic tragedy of the commons. Egress filtering doesn't meaningfully help the network doing it and it may cause ugly problems with asymmetric routes and the like, so the number of networks that don't do it is large enough to be meaningful. And if you get close enough to the core of the internet it's basically impossible anyway because there is no practical way to keep track of which address ranges a particular interface should legitimately be sending traffic from when the list encompasses half the address ranges on the internet and can change at any time. The upshot being it's not at all difficult for an attacker to get hold of a connection that doesn't do egress filtering, and that isn't ever going to change.
    - deleted 11y ago
      [deleted]
- zurn 11y ago
  It's different: The old was attacking weak randomness, this is showing easy brute forcing.

SFjulie1 11y ago

And it was easy because the PRNG had a small volume in the space phase http://lcamtuf.coredump.cx/newtcp/ http://lcamtuf.coredump.cx/newtcp/ What I don't understand is why the use of Taken's series are still not a standard for the analysis of the randomness... It resulted in this CVE http://www.cert.org/historical/advisories/CA-2001-09.cfm http://www.cert.org/historical/advisories/CA-2001-09.cfm And almost all the industry either switching to linux or as the licence authorized it they could have used BSD TCP stack since then, I guess. Here is an horrible implementation of Taken's visualization. https://gist.github.com/jul/0f16782ed01f18c2c72a https://gist.github.com/jul/0f16782ed01f18c2c72a