tcp packet spoofing

[Mark Greene_1]

I would be interested in comments regarding this article that compares the relative ease of tcp packet spoofing among various OS's:

http://razor.bindview.com/publish/papers/tcpseq.html

Specifically, is HP-UX still as vunerable as was demonstrated? It is my understanding that this research is over a year old.

mark

[harry d brown jr]

Mark,

I read though the paper and I found the paper to lack specifications on the exact configuration used, ie what patches were applied. They had listed Solaris 7, but what about 8? 8 has been out for almost two years now, and 9 has shipped.

I wouldn't put much weight on it, unless you are able to get more specifics from the authors.

live free or die
harry

[harry d brown jr · Accepted solution]

Mark,

Here's a "sniplet" from CERT:

Hewlett-Packard Company

HP has been tracking tcp randomization issues over the years, and has to date implemented the following:

For 11.00 and 11.11 (11i):
_______________________________

For 11.00, if you want HP's solution for randomized ISN numbers then apply TRANSPORT patch PHNE_22397. Once you apply PHNE_22397, there's nothing more to do --- default is randomized ISNs.

(Note: PHNE_22397 has patch dependencies unrelated to ISN randomized ISN number modification listed in the dependency section, but they should still be also applied. One is a PHKL kernel patch dependency and the other STREAMS/UX minimum level patch dependency.)

The LR release of 11.11 (11i) has the same random ISN implementation as the patched 11.00.

For the the legacy 10.20 release:
__________________________________

HP created a tunable kernel parameter that can enable two levels of randomization. This randomization feature requires a TRANSPORT patch level of:


For S700 platform: PHNE_17096 or greater
For S800 platform: PHNE_17097 or greater

The tunable kernel parameter is set as follows using the "nettune" program:


tcp_random_seq set to 0 (Standard TCP sequencing)
tcp_random_seq set to 1 (Random TCP sequencing)
tcp_random_seq set to 2 (Increased Random TCP sequencing)


and requires a reboot.

http://www.cert.org/advisories/CA-2001-09.html

live free or die
harry

[Jason Deckard]

Mark,

I believe the author(s) of the paper said it best: "We can not prove, in a strict mathematical sense, that our algorithm will accurately guess ISN values. Nor have we done the statistical analysis that would be required to verify that our results are statistically significant and predictive of future results."

The published results are guesses that the author has not attempted to validate. However, some of the pictures were pretty.

[Mark Greene_1]

Jason,

The author disclaimed more than once that he cooked the starting data, including this bit:

"Note: Our test set of approximately 50,000 quadruples is not a true random sampling of real-life data. The quadruples are subsequent to each other and are subsequent to the data set used to reconstruct the attractor. For this reason, we must point out that our coverage rate can not be interpreted as being predictive of future success. It should be relatively straight forward to perform the requisite statistical analysis to be able to make statements about the accuracy of our initial trials, but this is beyond the scope of this paper. "

He also explained the parameters and assumptions used to derive the 50,000 packets of seed data. This paper was written more than a year ago. With a couple of today's 2.5ghz intel processors, beaowulf linux, and a broadband internet connection, gathering that sort of data to match the parameters given wouldn't be too much of a problem. I also would expect that the deviation of the graphs of the real data vs the graphs of the presumed data used in the article would not be substantial.

The real question is how secure are the OS's in question today.

mark

[Marcin Piwko]

Guys,

I'm suplying HPUX scan data for the new report update by same author.

We are suprised that results we got after paches installed doesn't show any improovement of the ISN randomness.

Please let us know if all we did is correct.

The CERT report quoted here says:

For 11.00, if you want HP's solution for randomized ISN numbers then apply TRANSPORT patch PHNE_22397. Once you apply PHNE_22397, there's nothing more to do --- default is randomized ISNs.

We have HPUX11 box. We installed standard
HP Quality Patch Bundle, then I went for
search of the PHNE_22397. This patch is
included as part of PHNE_26771 "cumulative ARPA Transport patch".

We installed a bundle of all patches required:

[ /root ] qqlka# swlist BUNDLE
# Initializing...
# Contacting target "qqlka"...
#
# Target: qqlka:/
#

# BUNDLE B.11.00 Patch Bundle
BUNDLE.PHCO_23651 1.0 fsck_vxfs(1M) cumulative patch
BUNDLE.PHKL_25525 1.0 Probe,IDDS,PM,VM,PA-8700,asyncio,T600,FS
BUNDLE.PHKL_25475 1.0 PM cumulative patch
BUNDLE.PHKL_22840 1.0 IDS/9000; syscalls related to file/socket
BUNDLE.PHNE_26771 1.0 cumulative ARPA Transport patch
BUNDLE.PHKL_24027 1.0 VxFS 3.1 comulative patch
BUNDLE.PHKL_20016 1.0 2nd CPU not recognized in G70/H70/I70
BUNDLE.PHKL_18543 1.0 PM/VM/UFS/async/scsi/io/DMAPI/JFS/perf patch

As you see the patch is installed.
Unfortunately there is no any significant improovement in comparisation to last year's results.

Please let us know if everything we did is correct.

If you want to discuss details in private
please reply to email address: tenox@tenox.tc

Thanks.