Re: session-hijacking is still available?

From: crawford charles (biv0uac17@hotmail.com)
Date: 04/09/03

  • Next message: Tomasz Onyszko: "Re: Automated analysis of logs?" 
    From: "crawford charles" <biv0uac17@hotmail.com>
To: dina@synergyct.com
Date: Wed, 09 Apr 2003 18:42:32 +0000

    Forgive my presumption, but I believe the original concept of TCP
    session-hijacking was that an attacker could INFER the starting
    sequence numbers for a victim TCP session, most likely by attempting
    his own Telnet sessions, and observing the session numbers.
    When a new (targeted) victim logged in, the attacker would note
    the victim's IP and port, and then start hammering the victim session
    with data-packets starting from the inferred sequence number range,
    and all without being able to observe the victim session -- all he needed
    to do was craft packets which set the password and logout -- in effect,
    a priviledge escalation attack. In fact, the attacker need not even
    observe the replies to his packets. This all presumed a time when
    TCP sessions were few and far between.

    Granted, if you can sit on the line, or manipulate the packet routing,
    the whole issue of predictable sequence numbers (and therefore the
    subject of this thread) becomes moot.

    ---------

    From: Dina Kamal [mailto:dina@synergyct.com]
    Sent: Tuesday, April 08, 2003 12:16 PM
    To: security-basics@securityfocus.com

    Hi,

    Well, in order to do session hijacking from the internet , the
    outside user must be capable of doing rerouting for the session
    that's already been established so that he can be able to sniff
    the tcp packet for the seq number and other information required
    to do a successful hijacking .. so we need source routing enabled
    on the routers but then what ?? Does anybody has an idea about
    this issue?

    Thanks in advance
    Dina

    >-----Original Message-----

    From: SB CH [mailto:chulmin2@hotmail.com]
    Sent: Thursday, April 03, 2003 8:44 PM
    To: security-basics@securityfocus.com
    Subject: session-hijacking is still available?

    Hello, all.

    if attacker can do session hijacking, he can know the seq number change,
    ack seq number change something like that.
    But I have heard that modern system like linux kernel 2.4.x or openbsd
    produce almost random seq number, so session hijacking is almost impossible
    thesedays.

    is it true or not?
    anyone still can session hijacking using session hijacking program like
    hunt?

    Thanks in advance.

    _________________________________________________________________
    Protect your PC - get McAfee.com VirusScan Online
    http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

    -------------------------------------------------------------------
    Is SPAM over-loading your e-mail server, disk space or bandwidth?
    SurfControl E-Mail Filter is flexible, intelligent and policy-driven
    protection.
    http://www.securityfocus.com/SurfControl-security-basics2
    Download your free fully functional trial, complete with 30-days of free technical support.
    Stop SPAM before it stops you.
    -------------------------------------------------------------------

  • Next message: Tomasz Onyszko: "Re: Automated analysis of logs?"

    Relevant Pages

    • Re: just an idea for packet protocol using ECB
      ... >> packets may be lost. ... the system would never shutdown if attackers kept ... The damage an attacker ... So each file transmission gets a session number. ...
      (sci.crypt)
    • CommuniGatePro 4.0.6 [EXPLOIT]
      ... Session ID used in CGP WebMail to track sessions is ... Attacker can send HTML message with img src ... hijack current user session - read mailbox, ...
      (Bugtraq)
    • Re: Re: Cookie Security
      ... With XSS available to an attacker, whatever means I use to manage the session will be weak. ... this method would leave the application open to denial of service if an attacker can sniff session ID's. ... I can't imagine any session system will be safe with XSS available to an attacker, so perhaps the best thing to do is go ahead with the suggested method, and take extra care around XSS holes. ...
      (Security-Basics)
    • RE: Proof of Concept Tool on Web Application Security
      ... Links to the presentation, the "iDefense Session ... >Inspect, Spike Proxy etc. ... Web Sleuth than he can perform attacks. ... >This manipulation can also be achieved if an Attacker can put ...
      (Pen-Test)
    • [NEWS] NetDynamics Session ID is Reusable
      ... NetDynamics Session ID is Reusable ... it is possible for an attacker with understanding of the web ... An attacker visits the web application's login page where ndcgi.exe ...
      (Securiteam)