1

Source: http://lgms.nl/blog-2

Hey guys,

I've been reading through the research paper but didn't understand the purpose of the attack.

What the attacker will want to exploit here ?

1 Answer 1

4

The idea here is to open a TCP connection with a spoofed address (i.e. the IP address seen by the server is not the real IP address of the client), thus bypassing any IP black- or white-listing. It has severe restrictions on what can be done: only one packet can be sent, and it should not depend on anything coming from the server.

Practically, it could for example be used to send a HTTP request.

Now, I don't think this is really new, IP spoofing with TCP has always been about guessing the sequence number sent by the server in the SYN-ACK packet. In the past, it was mostly done by using weaknesses in the generation of this number, here it is a simple brute force attack.

It doesn't avoid the usual difficulties faced when spoofing a connection neither, the real host using the spoofed IP still need to be unable to respond, and there is no way to see what the server sends back. It is also limited to a single packet.

1
  • 1
    I also doubt that it's really new and since it takes so much bandwith and time for just one packet it's a quite inefficient attack.
    – Skyküff
    Dec 2, 2015 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .