Hack Security Pro.pdf - Index of

C) The attack
Description
We will try to establish a spoofed connection on a network machine by usurping existing IP confidence
relations:
• First, a machine must be found that the target machine trusts.
• Then, the authentication of the machine is done from its address.
• Once this information is obtained, the authenticated machine must be made “mute” (to prevent it
from answering the target machine)
• Then the sequence number, which is expected by the target machine, has to be determined.
Once that is done, we can start sending packets with the IP address of the machine that we have
“withdrawn” from the discussion.
The main problem with spoofing is that it is a so-called “blind” attack. It is not the machine itself that is
authenticated but the packets that the victim machine receives. This means that the packets emitted
by the target machine are not recovered by the attacker but are quite simply lost (as the destination
machine is “not able to answer”).
This means that the attacker does not have the information sent back by the target and so does not
have the sequence numbers corresponding to the packets that have been sent back by this same
machine. That is why this is called a “blind” attack, which is also why it is in fact impossible to carry
out.
Why is that?
To pass as the authorised machine for the target machine, packets have to be “forged” (using
Excalibur Packet, for example); and these packets must of course present, instead of the attacking
machine's IP address, the address of the authorised machine now made “mute”. But the packets must
also present sequence numbers corresponding to the exchange that the target machine believes to be
having with a trusted machine.
As the packets emitted by the target machine are not recovered by the attacker, the latter has no way
of determining the sequence number sent by the target machine and therefore the sequence number
that this machine will expect in response to the last packet it has sent.
This would be possible if packets were generated in a foreseeable manner, however that is not the
case, at least concerning systems such as BSD, SUN, Linux, or more generally UNIX.
These various OS have a sequence number generation system that make these numbers totally
unforeseeable (because they are far too random).
In the case of Microsoft, the latest studies of the problem pointed to the fact that the sequence
numbers generated by Windows are linear and thus easily predictable, and so making the machines
using them particularly vulnerable to this type of attack.
Example
As seen previously, blind spoofing is of no interest because it is almost impossible to carry out. The
only solution is therefore to use Non Blind Spoofing (NBS).
To do this, the attacker first has to recover a router or a local network machine using HUBs (switches
only give information to the machines concerned and so we would find ourselves in a blind spoofing
situation again).
The Hackademy DMP -72/209- SYSDREAM