Full Disclosure mailing list archives
Reflection Scan: an Off-Path Attack on TCP
From: Jan Wrobel <wrr () mixedbit org>
Date: Tue, 17 Jan 2012 23:45:25 +0100
Hi, This TCP session hijacking technique might be of interest to some of you. Abstract: The paper demonstrates how traffic load of a shared packet queue can be exploited as a side channel through which protected information leaks to an off-path attacker. The attacker sends to a victim a sequence of identical spoofed segments. The victim responds to each segment in the sequence (the sequence is reflected by the victim) if the segments satisfy a certain condition tested by the attacker. The responses do not reach the attacker directly, but induce extra load on a routing queue shared between the victim and the attacker. Increased processing time of packets traversing the queue reveal that the tested condition was true. The paper concentrates on the TCP, but the approach is generic and can be effective against other protocols that allow to construct requests which are conditionally answered by the victim. A proof of concept was created to asses applicability of the method in real-life scenarios. The paper in ps and pdf is available at http://mixedbit.org and http://arxiv.org/abs/1201.2074 Proof of concept: https://github.com/wrr/reflection_scan Thanks, Jan _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Reflection Scan: an Off-Path Attack on TCP Jan Wrobel (Jan 18)
- Re: Reflection Scan: an Off-Path Attack on TCP xD 0x41 (Jan 18)
- Re: Reflection Scan: an Off-Path Attack on TCP Robert Kim App and Facebook Marketing (Jan 18)
- Re: Reflection Scan: an Off-Path Attack on TCP xD 0x41 (Jan 18)
- Re: Reflection Scan: an Off-Path Attack on TCP Jason Hellenthal (Jan 19)
- Re: Reflection Scan: an Off-Path Attack on TCP Robert Kim App and Facebook Marketing (Jan 18)
- Re: Reflection Scan: an Off-Path Attack on TCP Marsh Ray (Jan 19)
- Re: Reflection Scan: an Off-Path Attack on TCP xD 0x41 (Jan 18)