I brought up this question recently at Brent's Dallas class... he thought
the list might find it interesting:
Has anyone ever attempted to intercept and forge the data channel to an
ftp client? The situation I envision would be a machine on the path between
client and server sniffing packets; the machine would detect an ftp session
in progress and wait for the client to issue the data channel's port number.
At this point, the forger would inject packets to open the connection to
the waiting client, hopefully timed correctly to reach the client before
the real packets from the server arrive. The server's open would fail
(I am assuming ftp only listens for one connection), causing an error on
the command channel I guess. I suppose this may tip off the client to drop
the connection that succeeded, but I'm not sure. If not, couldn't the forger
feed the client whatever? Say a trojaned version of what they were really
looking for?
cheers,
______/ Jeff LaCoursiere FastLane Communications
/ Network security/services mail info @
flc .
uprc .
com
___/ lacoursj @
uprc .
com
/
__/ ASTLANE Communications! Connecting America to the Internet...
|
|
