Reflection Scan: an Off-Path Attack on TCP


This TCP session hijacking technique might be of interest to some of you.

The paper demonstrates how traffic load of a shared packet queue can
be exploited as a side channel through which protected information
leaks to an off-path attacker. The attacker sends to a victim a
sequence of identical spoofed segments. The victim responds to each
segment in the sequence (the sequence is reflected by the victim) if
the segments satisfy a certain condition tested by the attacker. The
responses do not reach the attacker directly, but induce extra load on
a routing queue shared between the victim and the attacker. Increased
processing time of packets traversing the queue reveal that the tested
condition was true. The paper concentrates on the TCP, but the
approach is generic and can be effective against other protocols that
allow to construct requests which are conditionally answered by the
victim. A proof of concept was created to asses applicability of the
method in real-life scenarios.

The paper in ps and pdf is available at and

Proof of concept:


Relevant Pages

  • [Full-disclosure] Reflection Scan: an Off-Path Attack on TCP
    ... The paper demonstrates how traffic load of a shared packet queue can ... leaks to an off-path attacker. ... The victim responds to each ...
  • Re: United 93 Brought Down by Gun Control Laws
    ... ATTACKER, EVEN IF THE ATTACKER HAS GUN IN HAND was done by ... The LEs that tested this over and over again, and found that indeed, they had a very high percentage, in the super majority, of the one drawing beating the one holding a gun on him to firing was discussed at length in this ng. ... "An example of what the Tennessee Handgun Permit Holders faced during their brief deadly encounter are almost all similar to this incident that occurred with Mr. Bobby Holland who was attempting to use a ATM at Union Planters Bank in Memphis, ... The average thug, criminal, or terrorist, does not think their victim is armed. ...
  • [TOOL] XSS-Proxy - Remotely Controlling XSS Attacks
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: ... Anton has combined common XSS exploitation techniques with Javascript ... create a remotely controlled, interactive, two-way attacker ... command/control channel to the victim. ...
  • Re: New gun thread... Home defense
    ... Memphis Police Sgt. Vince Higgins said. ... The attacker, chasing one victim into the store's parking lot, was ...
  • Re: [Full-disclosure] Seems like Coinbase Security Team doesnt know how their cookie works
    ... Attacker start a webserver on localhost which set the cookie grabbed ... Attacker start DNS poisoning trough ARP spoofing on the victim pointing ... login or before signing out this doesn't work but i think in most cases ...