Does an attacker need to guess or brute-force a password for TCP spoofing?

Question

From my understanding, TCP spoofing can be carried out if the attacker can correctly guess the sequence numbers from the response packets (to mimic the real client). The attacker may even obtain this sequence of numbers via sniffing. Furthermore, a trusted connection must already exist between the target client and the server in order for the attacker to intercept/spoof

However, I was a bit unclear as to whether the attacker would need to gain initial access to the system or network (by guessing or brute-forcing their password). In order to send the sequence numbers from response packets to the server, does the attacker need to have access to it? I am not sure whether this attacker can just send the SYN packets to the server without any access to the system/network. My concept of these things is a bit blurry right now and I would greatly appreciate some advice.

Thank you!

Answer 1

TCP Spoofing is a technique used by attackers to mimic your source connection to any target host.

Whether the attacker would need to gain initial access to the system or network...

Yes, the attacker would need to gain access either to your network or your system to initiate the attack. The attack carried out over WAN can the the IP Spoofing attack, but that too has limitations.

The attacker, once infiltrated into your network, can sniff down the traffic and (apparently) your device's connections to the external hosts and can yield down sequence numbers of your TCP endpoint.

Sequence numbers can have lower entropy, thus they can be bruteforced easily. The attacker can spoof down your TCP endpoint if the sequence numbers are predictable. Many Operating Systems have tried to patch this and make the sequence numbers as random as possible, but still the threat remains of getting TCP-Spoofed despite this randomization.

LAN routers can have Source Routing enabled, which can enable traffic to route from one local device to another local device inside the network. This can be the main reason for the attack to accomplish. If source routing is disabled, the attack would not succeed.

How TCP Spoofing works?

Let's say I'm an attacker X, my victim is Y and the target host is Z. The attack mostly initiates in the in.rshd daemon in the destination header Z. Systems accept the socket options via getsockopt(), and can drop any malicious requests on the socket with setsockopt().

• If I want to request to Z by the source address of Y, I will need to first feed the destination header request with the sequence numbers of Y. (which I can fetch from requests beforehand)

• I will send the SYN packets to the destination header and the server will initiate the second handshake and send SYN-ACK packets to Y. The server Z will initiate a PCB(Protocol Control Block) to handle the connection.

• I again will spoof the packets pretending to be Y to the destination server using the sequence numbers. This time, source routing isn't required on this step. Sometimes, I'll need to flood down ports of Y inorder to send a large amount of data, to prevent Y from responding with an RST(Unavailable or Unreachable).

• After sending the ACK packets to the destination header, now the accept() call completes and the destination header (Z) checks for the IP options associated and if the connection is source-routed, it disables the connection and now Y is connected to Z without any interference of X.

Now if I know the next sequence number of Y, I can request other destination headers again from the sequence numbers.

The impact of the attack can be the execution of arbitrary code in a request as root depending on the configuration of the target system. It is necessary that the TCP endpoint and the destination header involves trust, either by using .rhosts files or hosts.equiv files.

To prevent TCP Spoofing to occur,

• Prevent any suspicious IP Address to lure around in your network other than the devices connected. This can be done by monitoring the network's activity often.

• Disable Source Routing from your admin panel so no rogue requests could be made/routed across the network.

For any further reference, check out this presentation by CasoDiStudio.

Hope this helps!

Answer 2

No password guessing or network compromise is required to perform a TCP spoof.

However it's necessary to understand what is TCP spoofing.

At its simplest, TCP spoofing is a Denial of Service (DoS) attack.

You send a custom formed packet containing an arbitrary FROM IP as an initial SYN connection to some server. The receiving server dutifully responds to the arbitrary FROM IP and you never see it because it didn't come back to you, it went to arbitrary FROM IP. All you can do is repeat the the SYNs over and over as a DoS attack, you can't establish a connection.

If you are actually in the path of traffic of arbitrary FROM IP, then full hijacking may be possible but this is above and beyond TCP Spoofing.