TCP Spoofing
Table 3-13 shows the summary information for the TCP spoofing attack.
|
Attack name |
|
|
Class/subclass |
Spoof/transport spoofing |
|
Sample implementations |
Any attack able to access the raw packet driver in a system |
|
Prerequisites |
IP spoofing |
|
Pertinent vulnerability |
None |
|
Typical use |
Inject unauthorized data into an application that uses TCP as its means of transport |
|
Attack result |
Corruption and disclosure of information |
|
Likely follow-up attack |
Variable |
|
OSI layers |
4 |
|
Detection |
None (must stop IP spoofing) |
|
Protection |
Stop IP spoofing ability |
|
Detection difficulty |
5 |
|
Ease of use |
1 |
|
Frequency |
1 |
|
Impact |
5 |
|
Overall rating |
30 |
The TCP header is 20 bytes long (excluding options) and is shown in Figure 3-8.
Figure 3-8. TCP Header
Figure 3-8. TCP Header
At first glance, it is easy to see why TCP is regarded as the protocol that is more difficult to spoof. It is by far a more complicated protocol than UDP. The biggest security benefit TCP offers is its connection-oriented nature. The 32-bit sequence number is connection specific and, in modern operating systems, pseudorandom. It is incredibly difficult to predict the sequence number of an established connection (without direct access to the stream of data through a sniffing attack). To insert believable communications into the stream, the attacker would have to guess the sequence number the server will use and, at the same time, stop the legitimate client from accessing the server.
The difficulty numbers in Table 3-13 assume the attacker does not have direct access to the stream of data coming over the wire. The location of attack is characterized in Figure 3-9.
Continue reading here: Note Cqr
Was this article helpful?