full-disclosure - RE: A new TCP/IP blind data injection technique?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <08cc01c3c005$2471c0b0$6e811299@HURON>
From: gillettdavid at fhda.edu (David Gillett)
Subject: RE: A new TCP/IP blind data injection technique?

> -----Original Message-----
> From: Michal Zalewski [mailto:lcamtuf@...ttot.org]
> 
<snip>
>   1. Path MTU discovery (DF set) prevents fragmentation [*]; some modern
>      systems (Linux) default to this mode - although PMTU discovery is
>      also known to cause problems in certain setups, so it is not always
>      the best way to stop the attack.
> 
>      [*] Also note that certain types of routers or tunnels tend to
>      ignore DF flag, possibly opening this vector again.
<snip> 
> Note that this has nothing to do with old firewall bypassing techniques
> and other tricks that used fragmentation to fool IDSes and so on -
> mandatory defragmentation of incoming traffic on perimeter devices will
> not solve the problem.

  I concluded some time back -- coming at it from an entirely different
angle from either of these -- that IP-layer fragmentation and reassembly 
was fatally flawed.  All sane implementations should set DF, and all but
the most secure of tunnels should honour it.

David Gillett