2 ms·
I'm not sure why the comments here are focused on how the attack, as that is not the news and was well known for quite some time. This article is about how to t
by lawnchair_larry 12y ago
I'm not sure why the comments here are focused on how the attack, as that is not the news and was well known for quite some time. This article is about how to thwart the attack.
tl;dr Watch for the site to appear to respond twice with the same sequence number. One of those is the NSA trying to get in ahead of the real site.
- pekk 12y agoIf the attack exists in the wild, its use isn't in any way limited to the NSA.
- tptacek 12y agoThis attack has existed in the wild since the mid-1990s; it is literally the reason SSH exists. We didn't call our TCP hijacking tools "quantum inserts" back then, but that's exactly what they were. The only reason we didn't redirect HTTP connections to malicious sites is that in the 1990s, that would have been a waste of time; the r-commands were much lower hanging fruit.
- tedunangst 12y agoTIL the NSA invented rlogin.
- schoen 12y agoAn important example from that timeframe publicly documenting the risk you're referring to: https://www.usenix.org/legacy/publications/library/proceedings/security95/full_papers/joncheray.pdf https://www.usenix.org/legacy/publications/library/proceedin...
- tptacek 12y agoIn fact, Joncheray "invented" this attack.
- csears 12y agoTrue, but state actors are much more likely to have ISP/backbone fiber taps and DPI equipment in place to make the attack really effective at scale.
- InclinedPlane 12y agoChina has started using similar techniques, I believe.