3 ms·

Spoofing UDP is easy. Spoofing TCP is useless - you actually need to receive all the packets sent to the original TCP, which means either you are already on th

Spoofing UDP is easy. Spoofing TCP is useless - you actually need to receive all the packets sent to the original TCP, which means either you are already on the receiving path, or managed to put yourself on it e.g. through a BGP route advertisement - either way, it leaves some trail and much harder to carry out. (And even so, the attacker still has to go through SSH authentication or an SSH vulnerability)

EvanAnderson 2y ago
> Spoofing TCP is useless... See: https://en.wikipedia.org/wiki/TCP_sequence_prediction_attack https://en.wikipedia.org/wiki/TCP_sequence_prediction_attack It's not practical but it is possible. It was more effective in the past when operating systems had more predictable initial sequence numbers. Famously this is how Kevin Mitnick (allegedly?) attacked Tsutomu Shimomura.
- beagle3 2y ago
  It’s been more than 20 years since any mainstream operating system was vulnerable. IIRC even SYN cookies are older than 20 years at this point.
  - o11c 2y ago
    It is absolutely still a vulnerability; there's no way to protect yourself against someone who can read the sequence numbers anywhere in the middle of the network. Crypto can help you detect this but not prevent it. RST attacks in particular are common enough to make TCP completely unsuitable for reliable long-term connections. And since TCP is also unsuitable for short-term connections, that leaves UDP the only option.
    - beagle3 2y ago
      Which is exactly what I said two posts up. https://news.ycombinator.com/item?id=41329065 https://news.ycombinator.com/item?id=41329065 Now, RST attacks are still a thing, but mostly irrelevant to this port knocking alternative.
Thorrez 2y ago
>Spoofing TCP is useless - you actually need to receive all the packets sent to the original TCP What do you mean "original TCP"? I'm talking about an attacker creating a new TCP connection with a spoofed source address. > which means either you are already on the receiving path Yes, I believe that's the threat model under discussion here. Tepix mentioned an attacker who can intercept a packet, which I believe means the attacker is already on the receiving path.

EvanAnderson 2y ago

> Spoofing TCP is useless... See: https://en.wikipedia.org/wiki/TCP_sequence_prediction_attack https://en.wikipedia.org/wiki/TCP_sequence_prediction_attack It's not practical but it is possible. It was more effective in the past when operating systems had more predictable initial sequence numbers. Famously this is how Kevin Mitnick (allegedly?) attacked Tsutomu Shimomura.

beagle3 2y ago
It’s been more than 20 years since any mainstream operating system was vulnerable. IIRC even SYN cookies are older than 20 years at this point.
- o11c 2y ago
  It is absolutely still a vulnerability; there's no way to protect yourself against someone who can read the sequence numbers anywhere in the middle of the network. Crypto can help you detect this but not prevent it. RST attacks in particular are common enough to make TCP completely unsuitable for reliable long-term connections. And since TCP is also unsuitable for short-term connections, that leaves UDP the only option.
  - beagle3 2y ago
    Which is exactly what I said two posts up. https://news.ycombinator.com/item?id=41329065 https://news.ycombinator.com/item?id=41329065 Now, RST attacks are still a thing, but mostly irrelevant to this port knocking alternative.

Thorrez 2y ago

>Spoofing TCP is useless - you actually need to receive all the packets sent to the original TCP What do you mean "original TCP"? I'm talking about an attacker creating a new TCP connection with a spoofed source address. > which means either you are already on the receiving path Yes, I believe that's the threat model under discussion here. Tepix mentioned an attacker who can intercept a packet, which I believe means the attacker is already on the receiving path.