Subject: Re: TCP sequence numbers

From: der Mouse <[email-masked]>
Date: Wed, 20 Sep 2000 17:35:15 -0400 (EDT)

> Why is guessing the sequence number of the first packet before it
> arrives such a big deal?

Because it allows you to impersonate an arbitrary IP address, provided
you don't care about seeing what the victim sends back, and provided
that the host you're impersonating doesn't RST the connection before
your evil deeds can be done.

The way it works:

(1) You send a SYN, with a forged ip_src and whatever ISN you feel
    like.  Except for the forged ip_src, this is a perfectly normal SYN.

(2) Victim responds, to the address you're pretending to be, ACKing
    your SYN and sending its own SYN, with its own ISN.

(3) If this were a normal connection, you'd ACK its SYN.  But since the
    reply goes off towards the machine you're impersonating, rather
    than to you, you have to guess the ISN in order to ACK it
    acceptably.

(4) Once you've guessed the ISN, you can send data and it will be
    accepted as coming from the IP you're pretending to be.

I've just noticed something that's a bit disturbing, though it doesn't
really sound like much of a practical problem (and of course it will
now turn out to have been discussed to death back before I started
reading the list :-).

If you know the victim's ISN to within a few guesses (where "a few" can
mean as many as several thousand, depending on factors such as the
bandwidth available), you can just flood it with SYN-ACKs using all
possible sequence numbers.  You won't know which one worked, but one of
them will.  (The rest will be dropped as out-of-window - are there any
known TCPs that will generate any kind of alert upon seeing a flood of
out-of-sequence packets?)  Since you don't know which one worked, you
have to also flood all further data on all possible sequence numbers,
and special care has to be taken if two or more possible sequence
numbers are close together...but, to an extent, bandwidth can make up
for imperfect knowledge.

Of course, as someone (vjs I think?) said, anyone who depends on peer
IPs for authentication these days is probably being sufficiently
foolish to deserve everything sie gets, so being able to forge someone
else's IP is perhaps not as big a deal as it was back when everyone
used .rhosts and hosts.equiv.

					der Mouse

			       [email-masked]
		     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: venkat venkatsubra <[email-masked]>
Date: Wed, 20 Sep 2000 18:02:56 -0500

venkat venkatsubra wrote:

> > out-of-sequence packets?)
>
> If you are meaning flood with ACKs, the one that
> doesn't ACK the SYN-ACK will result in connection
> getting reset. The segment is not  simply thrown away.
>
> Venkat

Correction. Looks like only RST is sent.
And the connection continues to remain
in SYN_RECEIVED state.

Venkat

---

From: venkat venkatsubra <[email-masked]>
Date: Wed, 20 Sep 2000 17:57:04 -0500

Venkat

---

From: venkat venkatsubra <[email-masked]>
Date: Wed, 20 Sep 2000 18:16:09 -0500

> And the connection continues to remain

And der you are right if  it is outside the
window it will be dropped after sending
an ACK. If within the window a RST is
sent.

Venkat