bugtraq - re:Breaking the checksum (a new TCP/IP blind data injection technique

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 15 Dec 2003 20:07:19 +0100 (CET)
From: Michal Zalewski <lcamtuf@...ttot.org>
To: LARSJ@...l.gov
Cc: bugtraq@...urityfocus.com
Subject: re:Breaking the checksum (a new TCP/IP blind data injection technique

On Mon, 15 Dec 2003 LARSJ@...l.gov wrote:

> This is a good line of thought that needs to be re-addressed every now
> and then, but I can remember discussing this exact attack ten years ago.
> There's even an RFC on it. RFC 1858 if memory serves.

Lars,

Nope. The set of attacks discussed in RFC1858 is indeed old, but has
nothing to do with the TCP/IP injection vector I have described. The
RFC1858 attacks describe firewall-bypassing attacks: "tiny fragment
attack", where a malicious TCP or UDP packet is sent in chunks too small
to be properly analyzed by the device; and "source porting", where the
header of a previously analyzed packet is modified by an overlapping
chunk.

Both techniques are old, well known and easy to prevent (and, indeed,
prevented by all modern implementations). The attack I described, for a
change, is not aimed at bypassing a firewall, and seems to be pretty damn
impossible to fix without breaking some functionality.

Cheers,
-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-12-15 20:02 --

   http://lcamtuf.coredump.cx/photo/current/