3 ms·
Nothing in this post says that the data wasn't authenticated; in fact, the symptom they saw (the client is kicked off because the server doesn't understand the
by cesarb 7y ago
Nothing in this post says that the data wasn't authenticated; in fact, the symptom they saw (the client is kicked off because the server doesn't understand the message) is exactly what would happen if the data was authenticated.
- Majromax 7y agoThe data's authenticated, but the authentication is accidentally broken. SYN(seq_num) and SYN(seq_num+3) can both generate the same cookie using a different (but still valid) maximum segment size. To lump this into an existing category of bugs, syn cookies are a kind of HMAC, only the implementation is custom and nonstandard. It isn't a surprise that a bespoke HMAC leaks, but to the credit of kernel developers syn cookies the initial 1996 specification pre-dates the common understanding. (But to its demerit, it looks like the DJB spec (http://cr.yp.to/syncookies.html http://cr.yp.to/syncookies.html) would have not had this issue, since the MSS was encoded in the top bits of the cookie and not the bottom bits.)
- im3w1l 7y agoA malicious client could make sure that you get valid but different data depending on whether noticed something was up. Maybe fool a logging/firewalling middlebox.