Dear Ormonde,
Rodrigo Ormonde wrote:
> Not only this. The attacker must discover what inicial sequence number the
> attacked host has chosen to establish the connection. Since this number has 2^32
> possible values it's nearly impossible to guess it. This is what makes this
> kind of attack very difficult to be sucessfull.
> In some early implementations of TCP/IP for *nix (and for some X Terminals)
> the inicial sequence number wasn't a random number, but simply a number that
> was incremented by 1 on every connection. In this case it's trivial to guess
> what the next number will be.
A nice description of this attack is in "SECURITY PROBLEMS IN THE TCP/IP
PROTOCOL SUITE", by S.M. Bellovin.
http://www.raptor.com/library/ipext.ps.Z
Cheers,
- Fernando Cima
Via Internet Informatica
References:
|
|
