The paper
(http://www.trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_O
S_Predictable_IP_ID_Vulnerability.pdf)
describes how to predict IP ID of various (BSD style) operating systems.
This can be used for "blind TCP data injection" The latter term is a
technique described by Michal Zalewski, and the paper references 2
BugTraq submissions by Zalewski that nicely explain this concept. These
are (from the paper):
[27] ?A new TCP/IP blind data injection technique?? (BugTraq mailing
list post),
Michal Zalewski, December 10th, 2003
http://www.securityfocus.com/archive/1/347130
[28] ?Breaking the checksum (a new TCP/IP blind data injection technique)?
(BugTraq mailing list post), Michal Zalewski, December 14th, 2003
http://www.securityfocus.com/archive/1/347556
The idea is (pardon me for any simplification or inaccuracy) to use
fragmentation in TCP communication in order to inject a fragment (rather
than a complete TCP datagram). For this, you need to devise a fragment
with the same checksum as the one you replace (this is easy if you can
predict the content of the fragment you replace, as discussed in the
second item). But you also need to predict the IP ID used throughout the
datagram fragments. And this is where the paper findings come in handy.
HTH,
-Amit
> -----Original Message-----
> From: Tim Newsham [mailto:newsham (at) lava (dot) net [email concealed]]
> Sent: Wednesday, February 06, 2008 19:48
> To: Amit Klein
> Cc: bugtraq (at) securityfocus (dot) com [email concealed]
> Subject: Re: A paper by Amit Klein (Trusteer): "OpenBSD DNS
> Cache Poisoning and Multiple O/S Predictable IP ID Vulnerability"
>
> > Interestingly enough, OpenBSD uses a flavor of this PRNG
> for another
> > field, this time the IP fragmentation ID, part of the
> OpenBSD kernel
> > network stack. The analysis carries out quite similarly to
> show that
> > OpenBSD's IP ID is predictable as well, which gives way to O/S
> > fingerprinting, idle-scanning, host alias detection,
> traffic analysis,
> > and in some cases, even to TCP blind data injection.
>
> Can you expound upon the blind TCP injection allowed by IP ID
> prediction?
>
> > Amit Klein
> > CTO Trusteer
>
> Tim Newsham
> http://www.thenewsh.com/~newsham/
>
>
(http://www.trusteer.com/docs/OpenBSD_DNS_Cache_Poisoning_and_Multiple_O
S_Predictable_IP_ID_Vulnerability.pdf)
describes how to predict IP ID of various (BSD style) operating systems.
This can be used for "blind TCP data injection" The latter term is a
technique described by Michal Zalewski, and the paper references 2
BugTraq submissions by Zalewski that nicely explain this concept. These
are (from the paper):
[27] ?A new TCP/IP blind data injection technique?? (BugTraq mailing
list post),
Michal Zalewski, December 10th, 2003
http://www.securityfocus.com/archive/1/347130
[28] ?Breaking the checksum (a new TCP/IP blind data injection technique)?
(BugTraq mailing list post), Michal Zalewski, December 14th, 2003
http://www.securityfocus.com/archive/1/347556
The idea is (pardon me for any simplification or inaccuracy) to use
fragmentation in TCP communication in order to inject a fragment (rather
than a complete TCP datagram). For this, you need to devise a fragment
with the same checksum as the one you replace (this is easy if you can
predict the content of the fragment you replace, as discussed in the
second item). But you also need to predict the IP ID used throughout the
datagram fragments. And this is where the paper findings come in handy.
HTH,
-Amit
> -----Original Message-----
> From: Tim Newsham [mailto:newsham (at) lava (dot) net [email concealed]]
> Sent: Wednesday, February 06, 2008 19:48
> To: Amit Klein
> Cc: bugtraq (at) securityfocus (dot) com [email concealed]
> Subject: Re: A paper by Amit Klein (Trusteer): "OpenBSD DNS
> Cache Poisoning and Multiple O/S Predictable IP ID Vulnerability"
>
> > Interestingly enough, OpenBSD uses a flavor of this PRNG
> for another
> > field, this time the IP fragmentation ID, part of the
> OpenBSD kernel
> > network stack. The analysis carries out quite similarly to
> show that
> > OpenBSD's IP ID is predictable as well, which gives way to O/S
> > fingerprinting, idle-scanning, host alias detection,
> traffic analysis,
> > and in some cases, even to TCP blind data injection.
>
> Can you expound upon the blind TCP injection allowed by IP ID
> prediction?
>
> > Amit Klein
> > CTO Trusteer
>
> Tim Newsham
> http://www.thenewsh.com/~newsham/
>
>
[ reply ]