Re: A new TCP/IP blind data injection technique?

From: Nick Cleaton (nick_at_cleaton.net)
Date: 12/11/03

  • Next message: Core Security Technologies: "[CORE-2003-12-05] DCE RPC Vulnerabilities New Attack Vectors Analysis"
    Date: Thu, 11 Dec 2003 07:37:02 +0000
    To: Michal Zalewski <lcamtuf@ghettot.org>
    
    

    On Thu, Dec 11, 2003 at 12:28:28AM +0100, Michal Zalewski wrote:

    [SNIP]

    > Also, since it is possible to overwrite the checksum field with an
    > overlapping IP fragment, and it is possible to control the packet payload,
    > perhaps it is also trivial to come up with such an input to have the
    > (trivial!) checksum depend less on the unknown part of the packet, and
    > more on the known payload.

    No, I don't think so, so long as at least one 16 bit word of the
    sequence number is properly random and uncorrelated with anything else
    in the packet.

    As a thought experiment, let us pretend that 16 bits of the unknown
    sequence number are added last when computing the 16 bit ones complement
    checksum. This won't change the outcome since ones complement addition
    is both commutative and associative.

    Even if the attacker knows or controls every other byte in the packet
    and thus controls the checksum before the final 16 bits go in, the final
    checksum is as unpredictable as those 16 bits.

    --
    Nick Cleaton
    nick@cleaton.net
    

  • Next message: Core Security Technologies: "[CORE-2003-12-05] DCE RPC Vulnerabilities New Attack Vectors Analysis"

    Relevant Pages

    • Entirely ignoring TCP and UDP checksum in kernel level
      ... - We have an old network concentrator device in our WAN, ... TCP SYN ACK reply from 192.168.1.1 ... The client from which we send telnet requests to the device gets a packet ... The network concentrator computes the TCP checksum with the source address ...
      (Linux-Kernel)
    • RE: Strange kernel happenings
      ... > packet has arrived intact. ... the ip header check sum covers the ip header only. ... The checksum in the IP header covers the ip header only, ... ICMP has a checksum, which covers the entire ICMP message. ...
      (Incidents)
    • Re: Entirely ignoring TCP and UDP checksum in kernel level
      ... > TCP SYN ACK reply from 192.168.1.1 ... > The client from which we send telnet requests to the device gets a packet ... > The network concentrator computes the TCP checksum with the source address ... > I also investigated terms such as CRC checksum offloading and such, ...
      (Linux-Kernel)
    • Re: RX checksum offloading problem
      ... to have a correct checksum. ... the packet has a correct checksum. ... not only for UDP and TCP packets. ... Change all drivers to set CSUM_DATA_VALID only in case of UDP or TCP packets, ...
      (freebsd-net)
    • Re: RX checksum offloading problem
      ... to have a correct checksum. ... the packet has a correct checksum. ... not only for UDP and TCP packets. ... Change all drivers to set CSUM_DATA_VALID only in case of UDP or TCP packets, ...
      (freebsd-net)