bugtraq - Re: A new TCP/IP blind data injection technique?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031211073701.GG12342@lt1.cleaton.net>
Date: Thu, 11 Dec 2003 07:37:02 +0000
From: Nick Cleaton <nick@...aton.net>
To: Michal Zalewski <lcamtuf@...ttot.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: A new TCP/IP blind data injection technique?

On Thu, Dec 11, 2003 at 12:28:28AM +0100, Michal Zalewski wrote:

[SNIP]

> Also, since it is possible to overwrite the checksum field with an
> overlapping IP fragment, and it is possible to control the packet payload,
> perhaps it is also trivial to come up with such an input to have the
> (trivial!) checksum depend less on the unknown part of the packet, and
> more on the known payload.

No, I don't think so, so long as at least one 16 bit word of the
sequence number is properly random and uncorrelated with anything else
in the packet.

As a thought experiment, let us pretend that 16 bits of the unknown
sequence number are added last when computing the 16 bit ones complement
checksum.  This won't change the outcome since ones complement addition
is both commutative and associative.

Even if the attacker knows or controls every other byte in the packet
and thus controls the checksum before the final 16 bits go in, the final
checksum is as unpredictable as those 16 bits.

--
Nick Cleaton
nick@...aton.net