I am reading a research paper which seems to claim that the answer is yes:
many browsers seem to always assign a random local port number for different web pages which makes [source] port prediction very difficult. To overcome the challenge, we design a simple strategy to intentionally occupy as many local ports as possible so that the next port used is selected from a much smaller pool.
Is this right? Does this attack work?
If the attack works, I have some questions about how/why the attack works:
Do browsers manage a pool of local ports themselves, or do they ask the OS to allocate a local port for them? What pool is getting exhausted here?
If the OS is allocating the source port, isn't the source port specific to the destination server? (I can open many connections to evil.com and exhaust all available local ports to evil.com, but I'd expect that a new connection to www.amazon.com could use any source port, even one that is currently being used with www.evil.com or has recently been used with www.evil.com. Am I misunderstanding something?)
Or is the browser somehow manually managing a pool of local ports it is prepared to use for connections? If so, what strategy does it use? Is this browser-dependent?
How does the attacker predict what the source port number will be used for the connection to www.amazon.com?
I was hoping someone might be able to help me understand what's going on here, and fill in the missing details.