Re: IP Spoofing questions

From: Walter Roberson (roberson_at_ibd.nrc-cnrc.gc.ca)
Date: 03/08/04 

Date: 8 Mar 2004 22:28:39 GMT

In article <5f16df6b.0403080915.fa8a603@posting.google.com>,
David Schlecht <dschl@earthlink.net> wrote:
:However, I still wonder if IP spoofing is possible with a good random
:sequence? Doesn't spoofing (blind spoofing) require correctly guessing
:the right sequence number?

There's a big gap between "difficult" and "impossible". If the site
allows indefinite number of trials on forming connections, then a
well-equipped attacker can keep trying and trying. Most "good random
sequences" are not in fact random, only pseudo-random.

:Also, your comments regarding the futility of reporting hack attempts
:if they're automated seems odd. If my host is hacked and being used to
:pursue futher break-ins, I would hope that someone would let me know.
:Hence, I would think that most hostmasters would appreciate being
:informed of the problem. Or -- is this just foolish thinking on my
:part?

Not meaning to be at all rude, but it's naive thinking on your part.
The number of reports that the comcast's and rr.com's get per day
can only be appreciated in scientific notation. If you aren't writing
to a small-time site with an otherwise good reputation, then chances
are you are just adding to the noise level.

My network is now targetted by more than 1 million connection attempts
per day, and we're not an "attractive nuisance". Do you realize how
long it takes just to -read- a million connection attempt records?
That's like 100 Mb per day. At the standard "5 characters per word",
and if you read at 1000 words per minute (rather on the high side, but
perhaps you learn to ignore parts of it), then that's 20,000 minutes
of reading, which is 13 8/9 days of solid reading -- per day of system
logs.

As UTexas Super Startrek used to say,

   "Captain, in view of the alternatives, are you sure this is wise?" 

-- 
Inevitably, someone will flame me about this .signature.

Relevant Pages

  • Re: [PATCH] OpenBSD Networking-related randomization port
    ... did you read the existing Linux TCP ISN generation code? ... TCP is designed to work in an environment where packets are delayed. ... will have no effect on the current connection. ... how to choose the first sequence number ...
    (Linux-Kernel)
  • Re: newish style of formmail attempts
    ... Spoofing was my first thought, but formmail is a CGI script, ... to predict the TCP sequence numbers hundreds of times over a few hours. ... behaviour in order to be able to spoof the packets as an "inside job". ...
    (comp.security.misc)
  • Re: ISP Redundancy Configuration
    ... So I can establish the connection and when I try from the ... Ack sequence numbers do not and should not increment ... after that the end points will be send an ack packet with data, ... In line 2 of figure 7, TCP A begins by sending a SYN segment ...
    (comp.security.firewalls)
  • Re: Genetic evidence.....
    ... > Genetic relationships among native americans based on ß-globin gene ... > haplogroups A, C, and D. It is possible that, by an alternative route ... > has the Polynesian motif and is indicative of this type of sequence. ... "connection" with the Americas is back in time and via South/East ...
    (sci.archaeology)
  • Re: [PATCH]
    ... The choice of initial sequence numbers for a connection is not ... since what we're protecting any kind of secrecy of the ... we just need to prevent the attacker from guessing the initial ...
    (Linux-Kernel)