Hot answers tagged

76

To send data to an application using TCP, you first have to establish a connection. Until the connection is established, packets only get to the OS layer, not the application. Establishing a connection requires that you receive packets back to the initiating end. If you wanted to forge an IP address not on your own network and establish a TCP connection, ...


61

TLS requires a reliable transport. On the internet, this leaves only TCP, as UDP does not offer reliability. TLS does require a reliable transport because (in compliance with the layered architecture of the ISO/OSI reference model) it does not handle transport errors, lost packets or other disturbances that may occur with IP. TLS is designed to offer a ...


49

While this isn't strictly a security question, I'm unsure if the Stack Exchanges for Super User or Networking would take this, so I'll just answer it quickly: Depending on your options, nmap will return different results for ports because different steps for service reconnaissance are taken. Since you seem to use a GUI to nmap and are asking a security ...


41

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


34

TLS does not require TCP, it only requires a reliable transport. There is even a standard for TLS over SCTP which is another reliable transport protocol. But, if you take today's internet then you usually only have UDP and TCP as transport protocols on top of IP and from these two TCP is the only reliable one. Which means, if you have only this limited ...


33

So my question is, is this a "man in the middle" type interception at the TCP/IP level? Yes, this is a man in the middle type interception which is easy for the access point because it is actually in the middle of your connection to the internet. Such redirects to the capture portal are easily done with a packet filter. The usual way is that once you've ...


31

A word on BGP BGP is the routing protocol that makes the internet work. The current revision is BGP v4, and has been in use since 1995. Internet Service Providers (ISPs) are in control of one or many networks, and they use BGP to advertise their networks to their peers by exchanging routing information (internet routes) about the network they control. Those ...


29

The common, low-level attackers (i.e. people in their home) cannot efficiently spoof their IP address for TCP connection because they will not receive answers. Remember that IP routes packets based on the destination address, so if you send a packet with a fake source address, it may still reach the destination. Some routers may be offended at seeing a ...


29

I don't believe you (or anyone else) is targeted by the US Department of Defense. More plausibly, AT&T screwed up something on their server. A very quick research on the number 1111301000 returns this article which seemingly sent by AT&T. Regarding the number 6.216.198.5, it's a coincidence that a substring of AT&T's IP address pointed to the ...


27

Plain UDP does not keep state, have handshakes etc. This mean an attacker could easily send a spoofed packet unless there are protections at other layers. On the other hand, sending a spoofed TCP packet requires the attacker to guess the sequence number and client's port of an established connection.


21

TCP isn’t more secure than UDP, it is more “reliable” as it is stateful and requires acknowledgment of each segment. UDP is stateless and just sends segments without knowing of the client gets them or not. Neither have any bespoke security features that other doesn’t, differences are mealy down to the different requirements of each protocol, any perceived ...


20

Short answer: no. Longer answer: yes, if you control a router device close to the target device (it has to be on the path between the the real source IP address and the target, and on the path between the faked IP address and the target) or if the target network/host accepts source-routed packets.


19

If there was a communication protocol that encrypts at the very low-level, There is: IPSec this would solve the problem of wiretapping entirely and for all. It doesn't.


17

Short answer: Yes, but not as possible as it used to be, and dependent upon how literally one takes your question. Long answer: I notice that you did not ask "Is it possible to carry on a TCP conversation with a spoofed IP address" - that question was ably answered by @symcbean. You specifically asked "Is it possible to pass TCP handshake with spoofed IP ...


17

If you expose this service to the internet, everybody can query this information without having to authenticate. It can be useful to attackers to know what you have running. Also, the RPC service has a history of security vulnerabilities. So don't expose it to the world unless you have to.


17

... but what is the issue with providing a socket API to allow interacting with existing protocols? This is not a restriction of the language itself but of it's use inside the sandbox within the browser. Just imagine that a script somewhere on the internet gets loaded into the browser and could from inside the browser access every computer reachable by the ...


16

Leaving a connection in syn_rcvd state will raise flags as well as this is a common denial of service attack. If you don't send a RST, the server will remain in a syn_rcv state for up to 60 seconds and retransmit the SYN ACK up to 5x. This will waste resources on the network you're scanning and cause a bunch of (depending on the speed and success of your ...


14

Does the GET request for this cross-site request pass on the URL for the encrypted page I am visiting to the unencrypted ysite.com's server No. ysite.com will not know the URL for the page you are visiting. xsite.com will not show up on any requests you make to ysite.com. if I block such a cross-site request using a browser add-on like RequestPolicy, I ...


14

These are the golden rule of computer security: "It is impossible to hide anything from a competent user with system administrator privilege" and "any competent user with physical access to the device can always elevate himself to system administrator". You cannot hide any information from someone with physical control of the machine. If the secret you are ...


14

Is it possible to spoof the IP once a TCP handshake was performed successfully? No. A TCP session is defined by four items: Source IP address Source IP port Destination IP address Destination port This comes from RFC 793: To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port identifier to ...


14

Is TCP more secure than UDP? Yes, but we have to be very clear about what we are talking about when we are talking about "security" and not generalize this statement to upper layer protocols. Currently, security is often associated to the CIA triad: Confidentiality. Integrity. Availability. The version 4 of the IP protocol, which is still the most ...


13

The normal TCP three-way handshake consists in a SYN from client to server, then a ACK+SYN from server to client, then an ACK from client to server. However, TCP has been designed to provide reliable data transport over a medium which is not reliable: stand-alone IP packets can get lost, damaged, duplicated, or transmitted out-of-order. That's why TCP is ...


13

In addition to what others have already said, TLS requires a reliable transport layer protocol because it requires that all of the data packets be received, be received in order, and be received uncorrupted. There are several reasons for this: If a packet were dropped or corrupted, TLS would have no way of recovering the data from that packet to present to ...


12

SYN Flood can be mitigated by enabling SYN Cookies. SYN Cookies prevent an attacker from filling up your SYN queues and make your services unreachable to the legitimate user. On Linux, those are some settings you can use to enable and set up SYN Cookies efficiently: echo 1 > /proc/sys/net/ipv4/tcp_syncookies echo 2048 > /proc/sys/net/ipv4/...


12

You are correct: technically, fuzzing is usually regarded as sending invalid or random requests/data, it's implied that you know what you're testing in order to "break" the input. In some terminology (PDF) white-box fuzzing is the close to former (generated input) and black-box fuzzing (random input) is the latter. What you're attempting is better described ...


11

This is technically false: Nmap does not send a RST at any point in the half-open SYN scan. Instead, it relies on the scanning machine's OS to send RST packets in response to what the kernel views as unsolicited SYN-ACK packets. This is the same mechanism that is probed by Nmap's ACK scan (-sA) to map out firewall rules. Of course, this means that if your ...


11

Not really. Neither protocol has any built-in features which are meant to provide confidentiality. Any security is supposed to be provided by the protocol layers above (or below). TCP is a more complex protocol than UDP which makes it a tad bit harder to spoof, but these complications are rarely a serious obstacle. When people say that TCP is "more ...


10

There are three main ways a SYN flood can work against a home router: If the router is performing NAT and has a port forwarded to a server, a SYN flood can fill up the router's NAT table, causing it to drop connections. The SYN flood can act as a simple bandwidth-starvation attack. A typical home router is on an asymmetric connection with limited upstream ...


10

... leads to the injection The flaw does not lead to the injection but it allows an attacker to inject data. I.e no inadvertently data corruption but a targeted modification by an attacker. How does the attack vector work? Since you've referenced the paper I would expect that you've read it. Which parts you did not understand exactly? But to summarize ...


9

TCP sequence prediction was a hot topic around 2001, but most vendors have patched their OS quite quickly around that time. See this CERT advisory from September 2001, which includes statements from various vendors. Basically, if the TCP sequence prediction attack works against a system, then that system was not updated with security fixes from more than a ...


Only top voted, non community-wiki answers of a minimum length are eligible