Bugtraq mailing list archives
Re: A new TCP/IP blind data injection technique?
From: Nick Cleaton <nick () cleaton net>
Date: Thu, 11 Dec 2003 07:37:02 +0000
On Thu, Dec 11, 2003 at 12:28:28AM +0100, Michal Zalewski wrote: [SNIP]
Also, since it is possible to overwrite the checksum field with an overlapping IP fragment, and it is possible to control the packet payload, perhaps it is also trivial to come up with such an input to have the (trivial!) checksum depend less on the unknown part of the packet, and more on the known payload.
No, I don't think so, so long as at least one 16 bit word of the sequence number is properly random and uncorrelated with anything else in the packet. As a thought experiment, let us pretend that 16 bits of the unknown sequence number are added last when computing the 16 bit ones complement checksum. This won't change the outcome since ones complement addition is both commutative and associative. Even if the attacker knows or controls every other byte in the packet and thus controls the checksum before the final 16 bits go in, the final checksum is as unpredictable as those 16 bits. -- Nick Cleaton nick () cleaton net
Current thread:
- A new TCP/IP blind data injection technique? Michal Zalewski (Dec 10)
- Re: A new TCP/IP blind data injection technique? Nick Cleaton (Dec 11)
- Re: A new TCP/IP blind data injection technique? Valdis . Kletnieks (Dec 11)
- Re[2]: A new TCP/IP blind data injection technique? Marius Huse Jacobsen (Dec 13)
- Breaking the checksum (a new TCP/IP blind data injection technique) Michal Zalewski (Dec 15)
- Re: A new TCP/IP blind data injection technique? Valdis . Kletnieks (Dec 11)
- Re: A new TCP/IP blind data injection technique? Kris Kennaway (Dec 11)
- Re: A new TCP/IP blind data injection technique? Casper Dik (Dec 11)
- RE: A new TCP/IP blind data injection technique? David Gillett (Dec 11)
- Message not available
- Message not available
- Re: A new TCP/IP blind data injection technique? Michal Zalewski (Dec 12)
- Re: A new TCP/IP blind data injection technique? Barney Wolff (Dec 12)
- Re: A new TCP/IP blind data injection technique? Michal Zalewski (Dec 12)
- Re: A new TCP/IP blind data injection technique? Stephen Frost (Dec 12)
- Message not available
- Re: A new TCP/IP blind data injection technique? Nick Cleaton (Dec 11)