RE: session-hijacking is still available?

[Michael Cunningham <crayola () optonline net>]

> if attacker can do session hijacking, he can know the seq number change, 
> ack seq number change something like that.
> But I have heard that modern system like linux kernel 2.4.x or openbsd 
> produce almost random seq number, so session hijacking is almost 
> impossible 
> thesedays.

While the initial sequence number choosen these days is random
it must be incremented for each packet transmitted. The sequence 
number is used to reassemble the packets back into a message. 
If an attacker can sniff your connection they can sample the 
current sequence number and inject a packet into the stream. 

> anyone still can session hijacking using session hijacking program like 
> hunt?

Yes... Your best defense against hunt is to use SSH and limit the 
possiblities for an attacker to sniff your lan. 

Mike
--
Michael Cunningham (CISSP, SCNA, SCSA, CCSA)
 

-------------------------------------------------------------------
SurfControl E-mail Filter puts the brakes on spam,
viruses and malicious code. Safeguard your business
critical communications. Download a free 30-day trial:
http://www.securityfocus.com/SurfControl-security-basics