[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-Disclosure] Re: A new TCP/IP blind data injection technique?
- To: Kris Kennaway <kris@FreeBSD.org>
- Subject: [Full-Disclosure] Re: A new TCP/IP blind data injection technique?
- From: Casper Dik <casper@holland.sun.com>
- Date: Thu, 11 Dec 2003 18:17:41 +0100
>On Thu, Dec 11, 2003 at 12:28:28AM +0100, Michal Zalewski wrote:
>
>> 2. Random IP ID numbers, a feature of some systems (OpenBSD?), although
>> also
>> risky (increasing reassembly collission probability), make the attack
>> more difficult.
>
>FreeBSD also has the option of randomizing the IP ID.
Solaris uses a different IP ID sequence for each system it
communicates with; you'll need to be able to see the packets
go by (in which case TCP splicing is child's play).
Casper
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html