bugtraq - Re: A paper by Amit Klein (Trusteer): "OpenBSD DNS Cache Poisoning and Multiple O/S Predictable IP ID Vulnerability"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.BSI.4.64.0802060747180.18100@malasada.lava.net>
Date: Wed, 6 Feb 2008 07:48:10 -1000 (HST)
From: Tim Newsham <newsham@...a.net>
To: Amit Klein <amit.klein@...steer.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: A paper by Amit Klein (Trusteer): "OpenBSD DNS Cache Poisoning
 and Multiple O/S Predictable IP ID Vulnerability"

> Interestingly enough, OpenBSD uses a flavor of this PRNG for
> another field, this time the IP fragmentation ID, part of the
> OpenBSD kernel network stack. The analysis carries out quite
> similarly to show that OpenBSD's IP ID is predictable as well,
> which gives way to O/S fingerprinting, idle-scanning, host alias
> detection, traffic analysis, and in some cases, even to TCP blind
> data injection.

Can you expound upon the blind TCP injection allowed by IP ID
prediction?

> Amit Klein
> CTO Trusteer

Tim Newsham
http://www.thenewsh.com/~newsham/