Re: A new TCP/IP blind data injection technique?

[stanislav shalunov <shalunov () internet2 edu>]

Michael Wojcik <Michael.Wojcik () microfocus com> writes:

> > From: Valdis.Kletnieks () vt edu [mailto:Valdis.Kletnieks () vt edu] 
> > However, it's a trivial matter to take the original text, the 
> > replacement text, and compute an original such that the checksum
> > comes out "the same".
>
> True, but irrelevant to the problem at hand, where the attacker has neither
> the original checksum nor the original text.

There's clearly an attack here; the attacker can replace known bits in
some parts of the stream with bits of his choice.  This can be useful
to replace, e.g., a username here or there, or a predictable URL
(perhaps in a request for a news site to a proxy server).  It is a
weakness.

What mitigates the attack is that if pMTUd is used, it won't work
because all packets will have the DF bit set.  Practically all modern
OSes will use pMTUd.  Michal pointed out in private communication that
some broken firewalls will strip the DF bit off packets.  Some of
these same firewalls will also reduce MSS and do other things designed
to prevent fragmentation; it's not clear to me how frequently
fragmentation of TCP packets happens in practice.  But in any case,
``broken firewalls have negative net effect on security'' is not
exactly a newsflash; we knew that.  Broken firewalls can also hurt
performance badly and interfere with deployment of new features in the
IP protocol (think ECN) and new applications.

Now, UDP in its default state will not set DF and, in some cases,
systems and applications are intentionally (mis)configured to send
packets that will be fragmented.  NFS, with frequently used block size
of 4kB or 8kB, would be an important example.

P.S. Since IPv6 has no notion of en-route fragmentation, it is immune.
This is actually the first known to me example of a security issue
where IPv6 design actually improves security.

-- 
Stanislav Shalunov              http://www.internet2.edu/~shalunov/