TCP Spoofing is a technique used by attackers to mimic your source connection to any target host.
Whether the attacker would need to gain initial access to the system or network...
Yes, the attacker would need to gain access either to your network or your system to initiate the attack. The attack carried out over WAN can the the IP Spoofing attack, but that too has limitations.
The attacker, once infiltrated into your network, can sniff down the traffic and (apparently) your device's connections to the external hosts and can yield down sequence numbers of your TCP endpoint.
Sequence numbers can have lower entropy, thus they can be bruteforced easily. The attacker can spoof down your TCP endpoint if the sequence numbers are predictable. Many Operating Systems have tried to patch this and make the sequence numbers as random as possible, but still the threat remains of getting TCP-Spoofed despite this randomization.
LAN routers can have Source Routing enabled, which can enable traffic to route from one local device to another local device inside the network. This can be the main reason for the attack to accomplish. If source routing is disabled, the attack would not succeed.
How TCP Spoofing works?
Let's say I'm an attacker X, my victim is Y and the target host is Z. The attack mostly initiates in the
in.rshd daemon in the destination header Z. Systems accept the socket options via
getsockopt(), and can drop any malicious requests on the socket with
If I want to request to Z by the source address of Y, I will need to first feed the destination header request with the sequence numbers of Y. (which I can fetch from requests beforehand)
I will send the SYN packets to the destination header and the server will initiate the second handshake and send SYN-ACK packets to Y. The server Z will initiate a PCB(Protocol Control Block) to handle the connection.
I again will spoof the packets pretending to be Y to the destination server using the sequence numbers. This time, source routing isn't required on this step. Sometimes, I'll need to flood down ports of Y inorder to send a large amount of data, to prevent Y from responding with an RST(Unavailable or Unreachable).
After sending the ACK packets to the destination header, now the
accept() call completes and the destination header (Z) checks for the IP options associated and if the connection is source-routed, it disables the connection and now Y is connected to Z without any interference of X.
Now if I know the next sequence number of Y, I can request other destination headers again from the sequence numbers.
The impact of the attack can be the execution of arbitrary code in a request as root depending on the configuration of the target system. It is necessary that the TCP endpoint and the destination header involves trust, either by using
.rhosts files or
To prevent TCP Spoofing to occur,
Prevent any suspicious IP Address to lure around in your network other than the devices connected. This can be done by monitoring the network's activity often.
Disable Source Routing from your admin panel so no rogue requests could be made/routed across the network.
For any further reference, check out this presentation by CasoDiStudio.
Hope this helps!