Port randomization paper


During the last few years a couple of vulnerability advisories were
published about a number of blind attacks against TCP (.

These attacks required the attacker to guess or know the four-tuple
that identifies the TCP connection to be attacked.

Clearly, of the IP addresses and port numbers in use, the (client
side) ephemeral port can be obfuscated, thus requiring much more
effort from an off-path attacker.

While attack-specific counter-measures have been implemented in most
stacks, there are still stacks that do not implement the general
counter-measure of obfuscation of the client port number.

Also, interoperability problems that result from some port
randomization techniques have been publicly discussed. However, there
has not been much advance in this respect.

We have published an internet-draft (i.e., a document aimed at the
IETF) that discussess the topic of port randomization, and proposes a
number of approaches that I don't think had been documented before.

The document is available in PDF format at:
. Additionally, you can get it in other fancy formats at:
http://www.gont.com.ar/drafts/port-randomization/ .

We would like to get feedback from the community on this document.
Wether it is that there are drawbacks with our approaches that we
missed, or whether you can think of better alternatives, or whether
you think the proposed approaches are a good idea.

Feel free to post your comments/questions on-list or privately at:

Fernando Gont
e-mail: fernando@xxxxxxxxxxx || fgont@xxxxxxx
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

Relevant Pages

  • RE: autoblocking many ssh failed logins from the same IP....
    ... Defending Against Attacks ... ports can be bombarded with login attempts using common ID/PW ... To the firewall these all look like legitimate packets. ... The simplest defense is to change the port numbers these services ...
  • Re: Blocking attacks from spoofed IP addresses
    ... cause a _Self_ Denial Of Service attack. ... Defeating Denial of Service Attacks ... of our DMZ servers, and had source IPs from our public DNS servers. ... Web services are on your port 80 and/or 443, ...
  • Re: Re: Concepts: Security and Obscurity
    ... server was on port 22 I received about 50-100 false logins per day. ... Subject: Concepts: Security and Obscurity ... TCP 2967 ... Put a server on any other port, and your number of attacks is going to be demonstrably lower than the numbers above. ...
  • RE: Specification-based Anomaly Detection
    ... >Or highly polimorph attacks, yes. ... >defines a listening application, so we can profile ... What about apps that all tunnel over a single port? ... >actionable anomaly detection result. ...
  • Re: Grafting a SSH auto-drop chain onto Arnos 1.8.3-RC1
    ... > hammering my machine with multiple attacks per second. ... to block those certain places from ever touching your ssh port (if you don't ... the patchomatic-ng and add alot of neat options to iptables. ... have not seen one single ssh attack since I moved my sshd off port 22. ...