full-disclosure - Port randomization paper

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 11 Feb 2007 11:42:16 -0300
From: "Fernando Gont" <fernando.gont@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Port randomization paper

Folks,

During the last few years a couple of vulnerability advisories were
published about a number of blind attacks against TCP.

These attacks required the attacker to guess or know the four-tuple
that identifies the TCP connection to be attacked.

Clearly, of the IP addresses and port numbers in use, the (client
side) ephemeral port can be obfuscated, thus requiring much more
effort from an off-path attacker.

While attack-specific counter-measures have been implemented in most
stacks, there are still stacks that do not implement the general
counter-measure of obfuscation of the client port number.

Also, interoperability problems that result from some port
randomization techniques have been publicly discussed. However, there
has not been much advance in this respect.

We have published an internet-draft (i.e., a document aimed at the
IETF) that discussess the topic of port randomization, and proposes a
number of approaches that I don't think had been documented before.

The document is available in PDF format at:
http://www.gont.com.ar/drafts/port-randomization/draft-larsen-tsvwg-port-randomization-01.pdf
. Additionally, you can get it in other fancy formats at:
http://www.gont.com.ar/drafts/port-randomization/ .

We would like to get feedback from the community on this document.
Wether it is that there are drawbacks with our approaches that we
missed, or whether you can think of better alternatives, or whether
you think the proposed approaches are a good idea.

Feel free to post your comments/questions on-list or send them
off-list to : fernando@...t.com.ar

Thanks,
-- 
Fernando Gont
e-mail: fernando@...t.com.ar || fgont@....org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/