TCP/IP Sequence Number Analysis

johnwbyrd writes "Upon connection via TCP/IP to a host, the host generates an Initial Sequence Number (ISN). It's important to design ISN generation sequences so remote attackers can't predict an ISN (this is called a "blind spoofing" attack). Using phase space analysis you can check the quality of ISNs generated on various OSes. Windows 98's graph is quite pretty."

Comments

the truth

[savbill]

nothing.

google cache

[Anonymous Coward]

http://216.239.39.100/search?q=cache:sJUlrsbgsJ4C: razor.bindview.com/publish/papers/tcpseq.html+&hl= en&ie=UTF-8&e=619

Re:google cache

[supermoose]

Karma whore here.

Already Slashdotted....

[cybermace5]

...at ~4 comments!

I think that's a new record low.

Re:Already Slashdotted....

[lostchicken]

Why doesn't Slashdot cache pages, images and linked pages (and their images) 1 level deep before posting a link?

I know this isn't really quite on (this) topic, and it has been said before, but the /. effect is getting stronger than ever. I just hope none of these sites pay for bandwidth.

This /.ing fix could be easily done, just put the code into slash, do it on the fly.

Re:Already Slashdotted....

[joshv]

Yeah, the bozos that created page put the entire report, with some 40-50 embedded images on one page. So everyone that hits the things tries to pull down many megs if image files all at once.

To summarized the report. Unpatched versions of NT4 and Windows 95/98SE are the most vunerable to spoofing attacks because of predictable patterns, or attractors, in the sequence produced by the random number generator used for ISNs. Linux,OpenBSD and FreeBSD scored near the top, though the report says there is room for improvement. Windows 2000, MacOSX, IRIX and BSDI were in the middle of the pack. HPUX and AIX were just as bad as windows 98.

So we have out prototypical 'windows less secure than linux' submission and the slashdotters are happy :)

-josh

Re:Already Slashdotted....

[56ker]

It's running Microsoft-IIS/4.0 on NT4/Windows 98 - so what do you expect?

Re:Already Slashdotted....

[moonbender]

Read the FAQ ...

Re:Already Slashdotted....

[Anonymous Coward]

it is running apache on sol according to netcraft

Re:Already Slashdotted....

[Anonymous Coward]

But the reasons in the FAQ are simply full of shit.

Re:Already Slashdotted....

[zulux]

There are two reasons why Slashdot doesen't cache liked pages:

1) I could very well be illegal without obtaing permission from a human. This would take too much time away from CmdrTaco adding spelling errors to my posts.

2) It would costs money in bandwidth costs. VA Software coporate officers love to roll naked in freshly minted $1 bills, and this would take away from their stash. Then only, one officer could roll at a time. Not a happy thing.

Re:Already Slashdotted....

[treat]

1) I could very well be illegal without obtaing permission from a human. This would take too much time away from CmdrTaco adding spelling errors to my posts.

Obviously this is not the case, or Google and other businesses that are caching web sites would be out of business by now. Caching web proxies would not be so common, instead we have never heard of a legal attack against a caching web proxy. This excuse is without merit.

The FAQ also gives this as a reason:

But what happens if I cache the site, and they update themselves? Once again, I'm transmitting data that I shouldn't be, only this time my cache is out of date!

But this is such an easily solved problem, this must also be a dishonest excuse. Even updating the cache once per minute would not unduly load the victim sites. Using standard proxy software like Squid would completely solve this problem.

So the quick answer is: "Sure, caching would be neat." It would make things a lot easier when servers go down, but it's a complicated issue that would need to be thought through in great detail before being implemented.
Answered by: CmdrTaco
Last Modified: 6/14/00

Surely in the 2 years since this question has been answered, CmdrTaco has had time to work on the solution to this. This is his full time job. Not much effort is being spent on the development of the software that runs the site, and certainly with the number of editors and how sloppily it is done, this can not be taking more than an hour per day per editor, if that. There is no original content, it is all submitted. As a LNUX shareholder, I wonder what these guys really do all day.

Re:Already Slashdotted....

[zulux]

I guess the end run around any preceived problems on CmdrTaco's part would be to just provide links to Google's cache.

A certainly agree with you..

Considering that there are several full-time people working (and being paid) on Slashdot, I find it rather odd that that hasen't been a solution forthcoming to this common problem.

It could be a case of burn-out, but I suspect general lazyness.

Re:Already Slashdotted....

[Anonymous Coward]

several full-time people working

That only works for certain select defintions of the term 'working.'

Re:Already Slashdotted....

[xanthan]

And how many Win98 servers do you find in the wild? Not many... There are still a small handful of NT4 boxen, but most admins moved to at least SP3 if not SP6 by 1998. Windows 2000 and XP don't have the ISN problem. MacOS 8 and MacOS 9 were not meant to be server OS's and were never sold as such.

What's funny? All said and done, very few people are going to try an ISN attack when there are so many easier app level attacks against servers already available.

Re:Already Slashdotted....

[Jedi Binglebop]

Unfortuantely, this is pretty much the same attitude that an unnamed giant software corporation takes as well. If only a few people are going to, then won't they be the people who have the knowledge to take it further? Script kiddies aren't generally harmful (in a big way) because they can't do anything useful.

-JB

Google cache saves the day

[Jesus IS the Devil]

I can't get in and there's only like 6 comments! Can't believe this.

No worries. Google cache saves the day:

http://216.239.33.100/search?q=cache:sJUlrsbgsJ4 C: razor.bindview.com/publish/papers/tcpseq.html+&hl= en&ie=UTF-8

There are links in the article. Just change the url in the google cache address accordingly and voila!

Re:Google cache saves the day

[JanusFury]

You know you can't copy-and-paste google cache links, right? That one doesn't work, at least, and it's never worked for me.

Re:Google cache saves the day

[Jesus IS the Devil]

Oops didn't know that. My first time giving this advice. Well for everyone, just goto www.google.com and type in the address:

http://razor.bindview.com/publish/papers/tcpseq. ht ml

Then just click on the "Cached" link in the results page.

Re:Google cache saves the day

[Anonymous Coward]

You need to remove any spaces from where lines wrap and it will work. Works for me.

Tim

Re:Google cache saves the day

[autocracy]

You have to remove the spaces that slashdot puts in because some genious months ago figured out this thing called a "page-widening post." About the most annoying thing I've ever seen, really.

Re:Google cache saves the day

[GutBomb]

and even though they put in the spaces, there are still page widening posts. ever browse at -1?

Re:Google cache saves the day

[Anonymous Coward]

Yes, but the page widening posts now only affect people running Internet Explorer (95% of the Slashdot readership) so it's not considered a problem worth fixing. Plus, the page widening is now being done by Cowboy Neal, on those days when he can't find replacement batteries for his vibrating butt plug and is consequently in a sour mood.

Google cache of the page

[Anonymous Coward]

Click here. Of course, it won't have all the pretty pictures, but you'll get the idea.

Must be Sunday

[Anonymous Coward]

Let's see. Mitnick used this what, 8 years ago now? That's how he got into that guy's login session that was pre-existing between the two machines, or something to that effect.

Plus, various folks were using this on big IRC networks after that, but still many years ago.
That "emmanuel-" in #2600 that says he gave the subscription list to the FBI and ran over Walter was a spoof. So was billg in #windows95. That's just the tip of the iceberg.

Everything old is new again.

Re:Must be Sunday

[Anonymous Coward]

> Everything old is new again.

so they knew 8 years ago that windows nt tcp/ip sucks? wow

Re:Must be Sunday

[Anonymous Coward]

It looks like this is useful in routing maliscous traffic to a honeypot.

Re:why is it

[PsychoSlashDot]

Maybe because it's the OS family used by the vast majority of people, regardless of suckage?

slashdotted

[lethalwp]

that one appears to be already /.ted

you can get a copy in google's cache:

http://www.google.be/search?q=cache:sJUlrsbgsJ4C :r azor.bindview.com/publish/papers/tcpseq.html+&hl=e n&ie=UTF-8

Re:Google cache saves the day [ the correct link ]

[hyyx]

Here is the correct Google cache:

http://216.239.51.100/search?q=cache:pIKhdPlNqPYC: razor.bindview.com/publish/papers/tcpseq/print.htm l

old news

[Anonymous Coward]

wasn't this already posted here like a year ago?

Re:Old News

[Anonymous Coward]

While this publication is indeed old, I do not think it is just a restatement of the old problem. IMHO it is a decent and up-to-date analysis with an innovative approach.

duh

[Anonymous Coward]

Slashdot is pretty fast. When was it published and hit BUGTRAQ, one year ago?

TCP/IP Sequence Number Analysis

[Anonymous Coward]

This is the main reason Dept of Defense said windows cannot be secured.It's a sad story. Maybe people will not be so open minded about windows anymore and realize they don't understand security, or if they do they work for the hackers/crackers. At least by action.

Re:TCP/IP Sequence Number Analysis

[Bastian]

More than that, this is a good reason why having only one major OS cannot be secure. If you can write an extremely good sequence number predictor for Windows 2000 sessions and get yourself a few nice deer stands on the periphery of the backbone (or heck, in the backbone - I'm not sure how feasible that is), you can 0wn the majority of corporations you're interested in attacking.

Personally, I think Bush's Department of Homeland Defense is going to be a complete crock if nothing is done about this and other computer security issues. I can't figure out if none of Dubya's advisors understand computers or if they are so full of it as to actually think, for whatever reason, that nobody would ever attack the US electronically. I have a feeling it's the latter being caused by the former, though. . .

Re:TCP/IP Sequence Number Analysis

[treat]

More than that, this is a good reason why having only one major OS cannot be secure. If you can write an extremely good sequence number predictor for Windows 2000 sessions and get yourself a few nice deer stands on the periphery of the backbone (or heck, in the backbone - I'm not sure how feasible that is), you can 0wn the majority of corporations you're interested in attacking.

This is not true. Your location on the network does not matter if you are worried about sequence number prediction. If you are positioned so that you can see the traffic both ways, you do not need to predict sequence numbers. And, all but the most insecure networks are vulnerable to attacks from the internet solely based on a spoofed IP address. No major US corporation is going to have a hole like that these days - they at least realize that securing the outside of the firewall is important. If there were such a hole, the intelligence necessary to find out about its existance and the address to use would take about the same effort to obtain as other more practical ways into the network.

Everybody realized to be afraid of IP-address based authentication after the widely publicized IP spoofing attacks.

Personally, I think Bush's Department of Homeland Defense is going to be a complete crock if nothing is done about this and other computer security issues.

The US government actively attacks computer securitiy. This is a problem that can be totally solved with strong encryption. Who is the biggest opponent in the world to ubiquitous strong encryption?

Re:TCP/IP Sequence Number Analysis

[einhverfr]

Well, I agree to a large extent. But ISN attacks are not really all that common (though from a DoD perspective, they REALLY need to be prevented).

Of course, in general, SSL should prevent these sorts of attacks because the incoming payload would be expected to be encrypted and so it would be non-trivial to input packets into the stream and have them do anything other than DoS. Still a problem but not as much as other issues.

Again, I see this as an issue where competent attackers may be heavily targetting a given system, but it is unlikely to be used by the casual crowd. So the Win 95 and 98 crowd should be relatively safe, while the DoD NEEDS additional protection. Corporate infrastructures are in the middle, and it is probably a good idea to protect them against this sort of attack.

However, it is also a pretty serious refutation of "open source is insecure."

Re:TCP/IP Sequence Number Analysis

[wadetemp]

Personally, I think Bush's Department of Homeland Defense is going to be a complete crock if nothing is done about this and other computer security issues.

What are you talking about? It's already a complete crock anyway, and is well on its way to becoming two complete crocks.

Re:TCP/IP Sequence Number Analysis

[Anonymous Coward]

I think limiting the scope of this to the DoD misses the point. If any institution wants to have trusted laptops hooking into their network, it's clear that even with Windows machines, there's always a hole that can be exploited.

Re:TCP/IP Sequence Number Analysis

[Anonymous Coward]

Don't all of Dubbya's technology advisors work for Microsoft during the day?

Re:Google cache saves the day [ the correct link ]

[Anonymous Coward]

Pictures are bettererer.

http://web.archive.org/web/20020124085843/http://r azor.bindview.com/publish/papers/tcpseq.html

Grumble....

[Admiral Llama]

Its too farkin' slow. I wanna see the pretty pictures!

Hmm.

[mindstrm]

Keep in mind it's still remarkably hard to spoof with each successive packet, even if you can predict sequence numbers.

The first is easy, the second likey, the third less likely, and so on. Spoofing a long conversation would be very difficult, if not practically impossible.

Re:Hmm.

[GigsVT]

echo r00t::0:0:0wned:/root:/bin/bash fits in one packet.

Food for thought.

Re:Hmm.

[treat]

Keep in mind it's still remarkably hard to spoof with each successive packet, even if you can predict sequence numbers.

No. You are completely and totally wrong. The only hard part is predicting the initial sequence number. For each successive packet, the only problem is guessing how much data was sent so that you can ack it and not end up closing the window. In practice, this is easy, as the amount of data that was sent should be predictable within a narrow range, and it is safe to send multiple guesses.

Re:Hmm.

[kemikalzen]

echo r00t::0:0:0wned:/root:/bin/bash fits in one packet.

Indeed. However, no sane people are using telnet anyways, and if you try to spoof ssh you will have to spoof the crypto as well, which is not feasible (unless it's SSLv1). There are quite a few tools out there you can use for testing your vulnerability to this; dsniff, hunt, ettercap etc. etc. mind you need to be on the same subnet.

Re:Hmm.

[treat]

Indeed. However, no sane people are using telnet anyways,

He was not talking about telnet. He was clearly talking about rsh, as that is a protocol that uses the source IP address for authentication and allows a command to be run. Telnet does not authenticate based on source IP address.

, and if you try to spoof ssh you will have to spoof the crypto as well, which is not feasible (unless it's SSLv1).

This is irrelevant, as he was demonstrating the fact that any obstacles to carrying on a long spoofed connection in no way lessen the risks.

Your response, while containing some minimal level of technical accuracy, is a complete non sequitur.

Re:Hmm.

[mindstrm]

Well..
that's why you don't run any services that depend on the IP layer for authentication.

Re:Hmm.

[pyite]

To add to that, layer 3 (OSI numbering) or lower. This is why WEP and things like it fail. Security is meant to be implemented in layers 4 - 7.

Re:Hmm.

[Anonymous Coward]

Am I missing something?

How is echoing text a security risk?

Surely one would be better off doing something more creative like writing to /etc/passwd?

Re:Hmm.

[GigsVT]

Just append &gt /etc/passwd to what I said.

I left it out so as to not help any would be script kiddies. I figured that people worried about TCP/IP sequence numbers would get the drift.

I want purty picatures!

[spammeister]

I guess the pix don't work cuz they wern't cached. Oh well. I bet it looks nice regardless. What we need a a DL so we can see if there is any "Ghost in the Machine" in our comp when it gets analyzed.

For those wondering how insecure Microsoft is ...

[NASAKnight]

Windows NT4 SP3
Attack feasibility: 97.00%

Operating system: Windows 98 SE
Attack feasibility: 100.00%

Operating system: Windows 95
Attack feasibility: 100.00%

Old News

[Anonymous Coward]

This is terribly old news. Most people in a security role have aware of sequence number prediction and attacks based on them for years, if not decades.

Re:why is it

[marienf]

Now what does that tell us about the majority of people.. but you already knew that..

Comment removed

[account_deleted]

Comment removed based on user account deletion

mirror

[iamroot]

Ok, I've mirrored the HTML and most of the images(still downloading) HERE. Please only download this to mirror it! My bandwidth is limited!

Re:mirror

[iamroot]

STUPID NAMEZERO!!
The mess up the URLS too much.
http://galacticroot.dyndns.org/mirrors/tcpseq/tcps eq.html is the actual address of the mirror, not http://galacticroot.dyndns.org//mirrors/tcpseq/tcp seq.html. That one should actually work.

Re:mirror

[epsalon]

I have setup Another mirror here

That's strange

[gazbo]

When I read it they appear to have published the results to more recent Windows versions as well. You know, the more up to date NT versions, and 2k.

I wonder how it came to be that you didn't publish the only meaningful indications of Microsoft's security? Oh, I know. It's because they are about 1/6th as bad as the outdated versions you impartially decided to cite.

Re:That's strange

[Arthur Dent 75]

This could be because the linked report is dated "19 March - 21 April, 2001". This is not news, it's olds.

Re:That's strange

[gazbo]

No, rtfa. There are entries for 2k and for more up-to-date NT versons. That is what makes the OP such a wanker - he deliberately ignored the pertinent information in order to demonstrate how insecure Microsoft is.

Re:That's strange

[Arthur Dent 75]

Sorry, I did not notice that you have replied to a posting. I thought you made a general statement about the article.

However, Microsoft OS's (even the more recent ones like Win2K) rank significantly lower than Open Source OS's.

Images at the Wayback Machine.

[ahaning]

http://web.archive.org/web/20010605064202/http://r azor.bindview.com/publish/papers/tcpseq/funct.jpg
http://web.archive.org/web/20010605044549/http:// r azor.bindview.com/publish/papers/tcpseq/mix.jpg
h ttp://web.archive.org/web/20010605045958/http://r azor.bindview.com/publish/papers/tcpseq/mix2.jpg
http://web.archive.org/web/20010605035655/http://r azor.bindview.com/publish/papers/tcpseq/linux.jpg
http://web.archive.org/web/20010605064823/http:// r azor.bindview.com/publish/papers/tcpseq/win2k.jpg
http://web.archive.org/web/20010605040907/http:// r azor.bindview.com/publish/papers/tcpseq/winnt.jpg
http://web.archive.org/web/20010605070134/http:// r azor.bindview.com/publish/papers/tcpseq/win95.jpg
http://web.archive.org/web/20010824220456/http:// r azor.bindview.com/publish/papers/tcpseq/win98.jpg
http://web.archive.org/web/20010605051434/http:// r azor.bindview.com/publish/papers/tcpseq/cisco2.jpg
http://web.archive.org/web/20010828165152/http:/ /r azor.bindview.com/publish/papers/tcpseq/cisco.jpg
http://web.archive.org/web/20010604211355/http:// r azor.bindview.com/publish/papers/tcpseq/aix.jpg
h ttp://web.archive.org/web/20010605063344/http://r azor.bindview.com/publish/papers/tcpseq/freebsd.jp g
http://web.archive.org/web/20010605052241/http: //r azor.bindview.com/publish/papers/tcpseq/openbsd.jp g
http://web.archive.org/web/20010605050747/http: //r azor.bindview.com/publish/papers/tcpseq/obsdnew.jp g
http://web.archive.org/web/20010605064736/http: //r azor.bindview.com/publish/papers/tcpseq/hpux11.jpg
http://web.archive.org/web/20010605061712/http:/ /r azor.bindview.com/publish/papers/tcpseq/sol7.jpg
http://web.archive.org/web/20010605062854/http://r azor.bindview.com/publish/papers/tcpseq/sol8.jpg
http://web.archive.org/web/20010605055059/http://r azor.bindview.com/publish/papers/tcpseq/sol2.jpg
http://web.archive.org/web/20010605060640/http://r azor.bindview.com/publish/papers/tcpseq/sol2ip.jpg
http://web.archive.org/web/20010605044904/http:/ /r azor.bindview.com/publish/papers/tcpseq/bsdi.jpg
http://web.archive.org/web/20010605070105/http://r azor.bindview.com/publish/papers/tcpseq/irix.jpg
http://web.archive.org/web/20010605042650/http://r azor.bindview.com/publish/papers/tcpseq/macos1.jpg
http://web.archive.org/web/20010605041254/http:/ /r azor.bindview.com/publish/papers/tcpseq/macos.jpg
http://web.archive.org/web/20010605054335/http:// r azor.bindview.com/publish/papers/tcpseq/dnslibc.jp g
http://web.archive.org/web/20010605061755/http: //r azor.bindview.com/publish/papers/tcpseq/dnswin.jpg
http://web.archive.org/web/20010605060741/http:/ /r azor.bindview.com/publish/papers/tcpseq/dnssol.jpg
http://web.archive.org/web/20010605051819/http:/ /r azor.bindview.com/publish/papers/tcpseq/comp.jpg
http://web.archive.org/web/20010605053816/http://r azor.bindview.com/publish/papers/tcpseq/random.jpg
http://web.archive.org/web/20010605053140/http:/ /r azor.bindview.com/publish/papers/tcpseq/data.jpg
http://web.archive.org/web/20010605044549/http://r azor.bindview.com/publish/papers/tcpseq/mix.jpg
h ttp://web.archive.org/web/20010824145421/http://r azor.bindview.com/publish/papers/tcpseq/linc.jpg
http://web.archive.org/web/20010605064500/http://r azor.bindview.com/publish/papers/tcpseq/ttime.jpg

Remove the spaces, copy-and-paste. We don't want to take the Internet Archive down, as well.

Re:Images at the Wayback Machine.

[bcaulf]

Copy-and-paste!? Whatever happened to laziness, impatience and hubris?
funct.jpg mix.jpg mix2.jpg linux.jpg win2k.jpg winnt.jpg win95.jpg win98.jpg cisco2.jpg cisco.jpg aix.jpg openbsd.jpg obsdnew.jpg hpux11.jpg sol7.jpg sol8.jpg sol2ip.jpg bsdi.jpg irix.jpg macos1.jpg macos.jpg dnslibc.jpg dnssol.jpg comp.jpg random.jpg data.jpg mix.jpg linc.jpg ttime.jpg

Thank you vi!

:%s/ //g
:%s#.*/\([^/]*\)#<a href="&">\1</a>

Re:Images at the Wayback Machine.

[ahaning]

Well, you see.. at the time, I was thinking two things:

1) I like the Internet Archive, and don't want to hurt them by sending the Slashdrones there just to see some dumb pictures.

2) Holy CRAP! This is going to give me SO MUCH KARMA!!!

So, between those two things, I only had time to put up those text links. Besides, it meant that the people that downloaded them were only the ones who really wanted to.

But thank you for your nifty script. You deserve the karma more than I do (except that you're just a little too late).

Good luck next time! ;-)

Re:Images at the Wayback Machine.

[Anonymous Coward]

Dude, where did you learn how to use vi so damn well?

Re:Images at the Wayback Machine.

[bcaulf]

I read Ultimate Guide to the VI and EX Text Editors and UNIX Power Tools, and I took a college course in intro to theoretical computer science that covered regular expressions, and I learned Perl regexes pretty well. This tutorial series at was pretty cool also.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:For those wondering how insecure Microsoft is .

[mindstrm]

Yeah.
Only a use of this attack is to get around IP filters, or to hide the origin of a communication.
And you can't receive data.

So attack is feasible.. but not that useful.

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

yah because none of us know how easy it is to hack a windows box.

Thanks for pointing out something NONE of us realized already.

"For those wondering how insecure Microsoft is," please thank the troll above.

Here's the first bit

[56ker]

This is the first section:

Table of Contents:


0. Abstract
1. Introduction
1.1 TCP Sequence generation and PRNGs
1.2 Spoofing Sets
2. Phase Space Analysis, Attractors and ISN Guessing
2.1 Introduction to Phase Space Analysis
2.2 Using Attractors for Spoofing Set Construction
2.3 Real-Life Attack Algorithms
3. Review of Operating Systems
3.1 Linux
3.2 Windows
3.3 Cisco IOS
3.4 AIX
3.5 FreeBSD and NetBSD
3.6 OpenBSD
3.7 HP/UX
3.8 Solaris
3.9 BSDI
3.10 IRIX
3.11 MacOS
3.12 Multiple Network Devices
3.13 Other PRNG issues
4. Risk Analysis
5. Conclusions
6. References
7. Credits


Appendix A: Phase Space Images of Known Generating Functions

Hopefully now only people who want to read it will click on the link!

Re:Here's the first bit

[Shanep]

Funny I agree,

This is propellor head stuff, but it is not overly technical.

This guy is basically plotting pseudo random number sequences so that a human could look for patterns. Computers can not be trusted to find patterns in all circumstances, whereas a visual pattern can easily stand out to human eyes. Of course, there would be patterns that a human could not detect that would require a computer to find (witness MP3). The question is, how do you plot 32bit numbers which pretty much represent 1 dimensional data of very wide proportions between low and high values?

Break the 32bit numbers up into smaller parts to be viewed as points in 3D space!

I have been interested in LFSR (Linear Feedback Shift Register) PRNG's for a few years, starting out designing them in hardware and then finding out through reading Bruce Schneiers "Applied Cryptography", that I was actually onto something.

I wanted to view my streams broken up into 2D dots as postscript to find patterns that showed weak (and thus the possibly strong) LFSR designs in the hope that I may find some high quality designs that have astronomical stream lengths before repetition.

Though I wonder if 2D would be as good as 3D for finding patterns. It seems being able to rotate the sampled data in real time would be better for finding a pattern that can be missed with a single 2D picture. Or is this the authors way to simply represent very high resolution numbers on relatively low resolution screens?

I have also been thinking of plotting streams to 2D images which I would then blur to greyscale to search for patches of light and dark to show low quality designs and save designs that show the best uniform shade of grey as possible candidates to be considered strong and thus used in designs that make up multiple hashed LFSR designs that provide stream lengths greater than the bit depth of the output itself.

It's not technical if you are really into it. ; )

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

it is not the only use. read carefully.

Not a new problem

[scotfl]

The idea of predicting Initial Sequence Numbers isn't exactly new, RFC1948: Defending Against Sequence Number Attacks was issued in 1996. Heck, even RFC793: Transmission Control Protocol from 1981 states:

When new connections are created, an initial sequence number (ISN) generator is employed which selects a new 32 bit ISN. The generator is bound to a (possibly fictitious) 32 bit clock whose low order bit is incremented roughly every 4 microseconds.

Which would provide somewhat random ISNs. What we are seeing here is the fact that compuers today are faster than they where twenty years ago, and thus better random (or psuedo-random) ISN generators are needed. Still it's nice to see vendors getting called out on bad implementations.

Re:Not a new problem

[Anonymous Coward]

Quote:

"As early as 1985 there was speculation that by being able to guess the next ISN, an attacker could forge a one-way connection to a host by spoofing the source IP address of a trusted host, as well as the ISN which would normally be sent back to the trusted host via an acknowledgement packet. It was determined that to help ensure the integrity of TCP/IP connections, every stream should be assigned a unique, random sequence number. The TCP sequence number field is able to hold a 32-bit value, and 31-bit is recommended for use by RFC specifications. An attacker wanting to establish connection originating from a fake address, or to compromise existing TCP connection integrity by inserting malicious data into the stream [1] would have to know the ISN. Because of the open nature of the Internet, and because of large number of protocols that are not using cryptographic mechanisms to protect data integrity, it is important to design TCP/IP implementations in a way that does not allow remote attackers to predict an ISN (this is called a "blind spoofing" attack)."

You won the redundant statement prize!

Re:Not a new problem

[XNormal]

The solution proposed in RFC1948 is to bias the sequence number by a hash of a secret value and the source IP address and port numbers.

This means that even if the underlying random number generator is very poor or not random at all an attacker will not be able to guess your sequence numbers for spoofing attacks. You will still be able to easily guess *your own* ISNs for subsequent connections so the system will appear to be vulnerable in tests like the one in this article. Some of the systems with poor 'attack feasibility' ratings in the article may in fact implement this mechanism.

Re:Not a new problem

[Anonymous Coward]

they do covered the case of rfc1948. fun to reply w/o reading

Re:Not a new problem

[rew]

Some of the systems with poor 'attack feasibility' ratings in the article may in fact implement this mechanism.

Ehmm. No. They found exactly that in Solaris, and reported the issue.

Roger.

old news!

[zdzichu]

it was here.

Re:old news!

[Anonymous Coward]

Tag him funny...it's really very amusing...

Re:old news!

[Anonymous Coward]

What the fuck are you talking about? That's the same fucking article you twit.

Re:old news!

[Anonymous Coward]

That was the funny bit...
/me makes an expansive gesture

Re:old news!

[Anonymous Coward]

OMG you are stupid

How did mac classic score?

[Anonymous Coward]

--I'm intered in this, although this sort of tech is not my forte, I just had such SUPER good fortune with mac classic over the years as regards "security" in general. As in "never got hacked or any virus never ever in many years on the net with a default install" of mac classic.

caveat, ONE time I got a virus that was easy to get rid of. It was my fault, I stuck in a floppy with some small progs on it that someone gave me. prog included some virus. duh, my bad for l7m3n355 But that's IT. years and years.

Re:How did mac classic score?

[GutBomb]

the reason you had a relatively easy time with the mac is not because of it's security. it 's because of it's relative obscurity. people don't find it worthwhile to hack a mac, don't know how, and don't care to... etc. Things might change now that the hacking methods are a little closer than they used to be (now 30 years of unix hacking knowledge may be applied) however, MacOS classic wasn't even included in teh final score (the little rainbow graphic) for some reason, however they do state in the text that MacOS X scored a little higher than it. Take that as you will.

What about NAT?

[Anonymous Coward]

EG. I have an OpenBSD firewall behind nat and I'm using "modulate state" on tcp packets. One would then assume that the sequence numbers would be rewriten by the NAT gateway. Comments?

Cisco Sequence Numbers Bug.(600 Series)

This could then make the random sequence numbers mute.

Re:What about NAT?

[moogla]

Absolutely. It seems that's the only reliable way of doing it anyway. If two nodes behind the firewall both open connections to a web server with the same ISN, whats the firewall to do? Actually, since it's the firewall that opens the connections on the behalf of the nodes behind it, surely code reuse dictates the packet headers have OpenBSD ISNs. Finally, the FAQ on the Netcraft Survey talks about this to explain why some webservers are "Microsoft IIS" running on Linux; what it's really seeing is the ISN characteristics of a linux firewall or load balancer in front of the webserver.

So I think you're safe :-D

Re:For those wondering how insecure Microsoft is .

[fyonn]

And also, I happened notice how you specifically failed to mention the reasonable improvements made in recent versions of Windows - specifically how its around ~10% attack feasability compared to 100% with older versions.

well, to be honest, it's not the most uptodate thing in the world. the freebsd tested was 4.2. and there have been significant improvements in tcp sequencing since then (being as we're at 4.6 now) and there is even a kernel compilation flag for random sequences.

so it's probably a year out of date, don't feel so singled out

dave

More recent results?

[Westacular]

This report was published over a year ago, examining vulnerabilities that have been well-understood for >6 years. How is this news?

It might be useful if it was up to date, however as it stands most of the OSes listed there have had non-trivial revisions and new releases since then: WinXP isn't mentioned; Linux testing is limited to some version of 2.2, with no mention of 2.4; it refers to OpenBSD 2.9 coming out "soon" (3.1 is now available); OS X has had many major improvements since its first release; etc.

Re:More recent results?

[Wanker]

This report was published over a year ago, examining vulnerabilities that have been well-understood for >6 years. How is this news?

For me, although the problem is very old, anyone without a good understanding of statistical analysis won't understand why some semi-random ISN generators are better than other semi-random ISN generators.

By applying this particular visualization scheme, they help to make it clearer. If you're lucky enough to find one of the mirrors where the images are visible, the difference between Linux 2.2 and IRIX is phenomenal. The "nodes" (areas of high spot density) on the IRIX plot clearly show places where guessing ISNs will be more productive. The Linux 2.2 plot just looks like a big fuzzy cloud, slightly more dense in the center. Some of the other plots show interesting patterns like dense squares-within-a-cloud or a small number of very dense nodes.

Possibly the most interesting part, however, is how something like Cisco IOS looks kind of like Windows 98. They "look" similar even though the statistics given (attack feasibility, etc.) are vastly different.

I think the news is in the visualization methods, not in the problem or the solution. As you noted, those are nothing new.

Re:More recent results?

[ansible]

Unfortunately, even though this paper is somewhat old, many of the operating systems mentioned in it are still running and connected to the Internet.

Besides, if the engineers at some company (SGI, MS, IBM) didn't previous think ISN prediction was a problem a couple years ago, they it is not likely they think it is a problem today.

The BSD's

[Foxman98]

I'll be the first to admit that some of that articale was a little beyond me at this time. However, for anyone running a server, it would seem that OpenBSD still is the best choice for anything on the 'net. OpenBSD had the best TCP/IP random number generation (recently re-written). It has also been developed with security in mind. After about 4 years of linux experience it took me an hour to get an openbsd machine running, natting, and pf'ing. It was really that simple - as long as you have the experience. Want httpd installed? "make install" in the ports directory.

What really suprised me in this article is that some of the commercial unices were so poor in their implementation. Solaris was only secured after tweaking, Mac OS X, while not 100% attackable, still wasn't much better. Same for IRIX and AIX. I didn't notice version numbers however, does anyone know if the state has changed for newer version of IRIX? It was also disappointing the the 2.2 series kernel was used - have things changed in 2.4? If not, is there work being done in 2.5/6 ?

And if anyone has ANY insight as to why Window98 is much worse than windows95 I'd love to hear it.

Re:The BSD's

[Anonymous Coward]

Apache is installed on OpenBSD by default. No need for a make install in ports at all. Just configure in /var/www/conf/ and enable in /etc/rc.conf

Re:The BSD's

[treat]

However, for anyone running a server, it would seem that OpenBSD still is the best choice for anything on the 'net.

Too bad that an OpenBSD system only exposing ssh to the internet would have been vulnerable to a remote root hole for years now.

Re:The BSD's

[Anonymous Coward]

"And if anyone has ANY insight as to why Window98 is much worse than windows95 I'd love to hear it."

Well, what reason then would you have to upgrade to WinXP?

Re:The BSD's

[Checkered Daemon]

Another cool feature in OpenBSD (as of 3.0) is the 'modulate state' option in pf, the firewall/nat module. Maintains state for both filter and NAT, and 'scrubs' the ISNs to OpenBSD standards. Just the thing for those old Windoze boxen.

Re:The BSD's

[Brainchild]

Want httpd installed? "make install" in the ports directory.

Actually, it's more like: Want httpd installed? *DING!* It already is. Just check the config file, and then apachectl start. Want SSL support in your webserver? *DING!* It's already there. Just apachectl startssl instead.

But here's the real key i've found: The upgrade from OpenBSD 3.0 to 3.1 is the easiest upgrade i've ever done. Ever. Choose "upgrade" from the CD, reboot, unpack the new /etc files somewhere, and run mergemaster. *DING!* No more looking around for *.rpmsave or *.rpmnew files.

Re:The BSD's

[virtual_mps]

What really suprised me in this article is that some of the commercial unices were so poor in their implementation. Solaris was only secured after tweaking, Mac OS X, while not 100% attackable, still wasn't much better. Same for IRIX and AIX. I didn't notice version numbers however, does anyone know if the state has changed for newer version of IRIX?

It wasn't clear to me whether they tested irix with the strong iss option enabled. (tcpiss_md5=1) I assume they did not.

Re:The BSD's

[Shanep]

Too bad that an OpenBSD system only exposing ssh to the internet would have been vulnerable to a remote root hole for years now.

A system with a hole, is not vulnerable until someone discovers that hole.

No intrusions were announced before ISS found the hole, if they were it would mean that ISS was not the first to find it and it would have been patched before the ISS discovery also.

So at the end of the day, the default OpenBSD install had a hole, but was not vulnerable because Theo warned people vaguely how to temporarily fix the hole until the full patch was released. So ultimately, no default OpenBSD install was vulnerable that was kept up to date with security patches. If Theo was specific, he would have put a spotlight on 500 lines of OpenSSH code out of 27,000. Which would have led to a quick exploit.

Cancer can be cured, but without a cure for cancer or knowing how to cure cancer can you cure it?

Also available, cache of the pdf

[morcheeba]

All the pictures are included in this pdf mirror: http://www.mirrors.wiretapped.net/security/info/pa pers/networking/strange-attractors-and-tcpip-seque nce-number-analysis.pdf [1MB].

It doesn't display correctly with my version of KDE's PS/PDF Viewer, but good old ghostview works great.

Re:Also available, cache of the pdf

[Anonymous Coward]

Looks like the PDF was created with Adobe Web Capture. That means it's a real grown-up PDF file created with the actual commercial tool.

No surprise that it won't work with some of the wobbly freeware viewers.

Re:For those wondering how insecure Microsoft is .

[Querty]

He didn't say insecure, but just that win98 makes a pretty graph...

And it does, really! (Although I think Cisco IOS 12.0 makes an even prettyer one).

Relax Bill, we're not out to get you....

Here is an (almost) complete Mirror.

[Cybersonic]

Mirror: http://ralph.cx/tcpseq/

Im missing 3 images... for now...

Hit them. Hard.

[Krapangor]

An attractor is a shape that is specific to the given PRNG function, and reveals the complex nature of dependencies between subsequent results generated by the implementation.

The author should be hit with a stick.
Hard.
Several times.
There is a standard definition for an attractor in mathematics.
If the author wants to use mathematics, then he should use the well-agreed mathematical definitions and not vague pseudo-mathematical babble.
And yes, I am a mathematician.

What they basically do is to guess the (internal) dimension of the system and trying to get non-trivial attracting set out of it. It's a rather trivial fact that if you get both things right, you can attack the PRNG. However, a decent PRNG won't have any non-trivial attractors.

Re:Hit them. Hard.

[Anonymous Coward]

Look, I browsed through the article, but not enough to quibble over the mathematical definition of attractors. I don't know enough about attractors to quibble even if I did.

But I am a statistician, and about the "vague pseudomathematical babble":

Sometimes, when you're presenting stuff to nonspecialists, you need to be a little more vague and pseudomathematical for people to understand. Sometimes it's more important for 100% of the people to get a 80% valid understanding of something than 20% to get a 100% valid understanding. I think it's more accurate in this regard to describe many vague mathematical generalizations as "quasimathematical".

Just being a little vague is ok or even necessary sometimes. The problem with always using "well-agreed mathematical definitions" is that not everybody understands them. There are, however, some who might understand the gist of the argument, and sometimes it's more important to get that across.

Maybe you're of the opinion that we shouldn't explain math to people who don't understand every bit of it known to mankind. I don't believe, though, that people who try to make math a bit more accessible should be "hit hard". On the contrary--they should be encouraged. People pursue things, after all, because they're interested in it, and often, we're interested in the things that are novel to us.

Again, I don't really know enough about it. Maybe this guy was completely incorrect. But quasimathematical babble isn't always bad.

Re:Hit them. Hard.

[Anonymous Coward]

>But I am a statistician, and about the "vague >pseudomathematical babble"

And there is the source of the problem...all statistics is pseudomathematical babble

Re:Hit them. Hard.

[brain-in-a-box]

While many mathematical definitions are weird, the definition of an attractor isn't:
Given a dynamical system an attractor is a set A which "sucks" a neighborhood of A into A.
(All trajectories in the nbh converge to A.)
The authors seems to mean this (the PRNG is a discrete dynamical system), but we can't be 100% sure because of the babble.

Re:Hit them. Hard.

[gripdamage]

If the author wants to use mathematics, then he should use the well-agreed [upon] mathematical definitions....

Umm...don't you mean the author should use clear and succinct mathematical definitions? If one is going to be limited to only those definitions which well-established mathematics provides, then the concise expression of mathematical ideas is being limited as well. Mathematicians adapt the definitions of even well established terms all the time to suit their immediate purpose, adapting the definition to fit the context of their current problem. Of course they don't just do it without telling anyone; generally a definitions section precedes the text of the article.

Re:Hit them. Hard.

[Wonko42]

I'm a proud owner of a Mensa membership card.

That may be, but I'm the proud owner of a brain, and my brain can out-think your card any day.

Re:Hit them. Hard.

[Anonymous Coward]

All your base are belong to us!

Re:Hit them. Hard.

[Tony-A]

Even if you're presenting stuff to specialists, you need to be a little more vague and pseudomathematical for people to understand.
The problem with always using "well-agreed mathematical definitions" is that not everybody understands them.
And not everybody agrees as to exactly what those "well-agreed" mathematical definitions should be. They do tend to get pretty well sorted out over time, but it does take time and effort.
Continuity is usually defined in terms of epsilons and deltas, valid enough in metric spaces, but the concept itself is valid for non-metrizable spaces which do not have distance functions. Is point-set topology a prerequisite for freshman calculus?
Is measure theory a prerequisite for statistics? Ever wanted to work with both discrete and continuous statistics at the same time?

Re:Hit them. Hard.

[Anonymous Coward]

I agree, but I don't think your example is all that great. The standard definition of continuity
in an abstract topological space X agrees with the
metric space definition if X is a metric space. Thus the situation here is just an example of generalizing a definition, or looking at a specific case, depending on your perspective. This is analogous to the definition of the discriminant of a degree 2 polynomial over the real(or complex) numbers which is easily generalized to a polynomial of arbitrary degree over an arbitrary field(note that this probably requires a generalization of the word polynomial as well). This situation appears again and again and again, e.g whether or not rings have identity, whether or not algebras are associative, etc.

More bothersome examples where a standard definition is not agreed upon are uses of the words closed, normal, regular, etc. I think that these pose much more of a problem to non-specialists since the same word can be used to mean very different things.

Oh, and I do think that basic point-set topology should be included in freshman calculus, though should not necessarily be a prerequisite

Comparison is the goal....

[Alric]

The article is not trying to report the idea of predicting the ISN as a new vulnerability.

The goal of the article is to compare how vulnerable various current operating systems are to this type of spoofed ISN attack. It discusses phase space analysis as a worthy means of doing this, and then the article presents handy feasibility charts and pretty pictures.

So please, let's have no more posts discussing how this attack is really old, man. I think most people here know this already.

This Article has Everything

[Anonymous Coward]

1. Sensationalism
"OMG Someone can guess the ISN number, We are all on our way to destruction"

2. Geekiness
"Wtf is an ISN number"

3. M$ Bashing (Note the $ $ign it means I dissaprove of Microsofts Money Grubbing Ways (TM) [OMG another funny!!])

Re:This Article has Everything

[Anonymous Coward]

"OMG Someone can guess the ISN number, We are all on our way to destruction"

I think its. We are on the way to destruction.

PDF Mirror...

[hardcode]

... at http://www.mirrors.wiretapped.net/security/info/pa pers/networking/strange-attractors-and-tcpip-seque nce-number-analysis.pdf

hardcode

--

It's 106 light-years to Chicago, we've got a full chamber of anti-matter,
a half a pack of cigarettes, it's dark, and we're wearing visors. Engage.
- Paul Tomblin in asr

Re:PDF Mirror...

[hardcode]

... of course missing out the space slash code inserted in the word sequence *sigh*

hardcode

--

I am become Typo, destroyer of words.

Re:For those wondering how insecure Microsoft is .

[FreeUser]

And also, I happened notice how you specifically failed to mention the reasonable improvements made in recent versions of Windows - specifically how its around ~10% attack feasability compared to 100% with older versions.

You mean, like this improvement?

Windows 95 sequence numbers are very weak. But it is really difficult to understand is why this algorithm was further "weakened" in Windows 98 (SE), decreasing estimated error and number of elements required to get the right guess, in average, 99.488%.

Seriously, the post was entitled "for those wondering how insecure Microsoft is", not "for those wondering how Microsoft stacks up against other systems" which, as you point out, would indicate that consumer OSes are pathetic, while 'professional' OSes like NT and 2000 are making modest improvements, and that while the *BSDs are pretty good, and GNU/Linux quite good, there are plenty of older UNIX implimentations that were quite poor, and even pathetic, as well, not to mention CISCO, which makes up much of the internet backbone.

But, since Microsoft is conducting a wholesale attack on our very freedom of choice through it Palladium and DRM efforts, pointing out additional, purely technical reasons for moving away from Microsoft to *BSD and GNU/Linux alternatives and thereby protecting your security as well as your freedom isn't such an ignoble thing to be doing at all.

Summary: Linux is the winner

[Anonymous Coward]

Linux trounced the field. Period. Linux is the winner.

Other systems failed, including FreeBSD which is rated "medium to high risk". OpenBSD fared very poorly also, as did BSDI, both exhibiting highly predictable behaviour.

Solaris, HPUX, AIX, Mac OSX well -- they failed to measure up, with HPUX particularly shameful.

Windows? What is there to say -- it ran with the losers.

Re:Summary: Linux is the winner

[Anonymous Coward]

Your mom must be very proud linus.

Re:Summary: Linux is the winner

[Anonymous Coward]

nice troll, but you missed this "The current version of OpenBSD generates a 31-bit wide cloud which does not produce any useful spoofing sets"
0.00% vulnerability is infinitely better than a 0.05% vulnerability rate as tested with linux.

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

Mac OS 9 is a Unix?

Those bastards didn't tell us!!@!

Read the story: OpenBSD failed the test

[Anonymous Coward]

What the heck are you talking about. The numbers don't lie. You obviously do. Read the story again. OpenBSD stumbled badly in this test.

Re:Read the story: OpenBSD failed the test

[steelhawk]

OpenBSD _2.8_ was fairly bad in the test... but that's a pretty old version... as they say the CURRENT at that time was much better... and I think that is incorporated in the newer OpenBSD releases.. (as in at least 3.x)

Re:Read the story: OpenBSD failed the test

[Anonymous Coward]

Still learning how to read are we?
OpenBSD-current as of early 2001. 0.00 vulnerability.
Default 2.8 had a 1.00% vulnerability.

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

The point is thought that this is a larger issue than a single isse: major operating systems, as well as "consumer" versions (aka Windows) are not doing well in this regaurd. Furthermore, all kinds of embedded "smart" devices use NO randomness at all.

Just trolling and pointing out that outdated unsupported versions of Windows have extremely insecure ISN generation is a waste of time.

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

The thing I don't understand is... why do people continue to compare nowadays linux (or IRIX, Solaris, *BSD) etc... to things like Win98, which is _over 4 years_ old by now... Shouldn't we compare to things like XP (which is the replacement Windows for both the DOS^H^H^HWin9x/ME line and NT/2k) instead?

Just my 2 eurocents

Re:For those wondering how insecure Microsoft is .

[ealar dlanvuli]

And also, I happened notice how you specifically failed to mention the reasonable improvements made in recent versions of Windows - specifically how its around ~10% attack feasability compared to 100% with older versions.

So your saying when they ganked the FreeBSD network stack w/o even a tip of the hat, they improved thier non-existant security?

Wow, who'da thunk.

Re:For those wondering how insecure Microsoft is .

[zulux]

Actually this is a case of "You Get What You Don't Pay For" -

HPUX, Windows and AIX are all expensive and suck.

Linux, OpenBSD, FreeBSD are all free and work wonderfully.

So in this case, your level of protection is determined by your inteligence and not by the amount of money you sepend.

Re:For those wondering how insecure Microsoft is .

[zrodney]

what a lame job of baiting... better, right?

are there 100s of thousands of old windows boxes
with lame tcp/ip or are people running hpux on
their dsl and cable modem boxes now?

These pictures look familiar.

[fidget42]

Is it just me, or do these pictures look just like the X-ray defraction of a crystal? I suppose it goes to show the symmetry in the universe.

Re:These pictures look familiar.

[cvore]

Your question is mostly answered on a realy cool article about chaos theory linked on the site, on the reference section :-) One finds simelar probability graphs on most new scientific stuff now: physiscs, chemestry and so on :)

Re:These pictures look familiar.

[fidget42]

Your question is mostly answered on a realy cool article about chaos theory linked on the site, on the reference section

Well, at least I read most of the article! ;) Although I should have probably read everything *sigh*

It Is Called Research, and it Takes Time

[FreeUser]

I wonder how it came to be that you didn't publish the only meaningful indications of Microsoft's security? Oh, I know. It's because they are about 1/6th as bad as the outdated versions you impartially decided to cite.

That may be, but probably isn't, true.

If you read the article carefully you'll notice that the versions of *BSD and the Linux kernel (2.2.x) are also outdated. This isn't some neferious plot to diss Microsoft (hell, that isn't all that hard to do with cold, hard, factual data in the first place, so there is no need for anyone to cook the data, least of all this study), it is a result of the fact that research and study take time.

I'm sure if the author had looked at Linux 2.4.x and current versions of the BSDs the results would have been significantly better (Mac OS X as well, being a BSD derivative).

As for whether or not the various Windows versions would have been better, that is an assumption we really cannot make. Not for any prejudicial reasons, but because historically they generally haven't always improved, and indeed on at least one occasion (95->98) got considerably worse. We can hope that the security of Windows 2k has improved since then, but there is no real historical precendence to support that hope, in contrast with most other competitors products including the BSDs and Linux products cited here.

The comparison was fair: it was a snapshot of the state of the art taken a couple of years ago, then studied and analized in detail over those past two years. This is how every study that bases itself on factual research works, as opposed to corporate marketing drivel purchased to look like research, as has come from the Microsoft camp on numerous occasions in the last couple of years, and has in every case been thoroughly, and utterly obliterated in public rebuttal.

Re:It Is Called Research, and it Takes Time

[Anonymous Coward]

If you only had a brain...

"As for whether or not the various Windows versions would have been better, that is an assumption we really cannot make. Not for any prejudicial reasons, but because historically they generally haven't always improved, and indeed on at least one occasion (95->98) got considerably worse. We can hope that the security of Windows 2k has improved since then, but there is no real historical precendence to support that hope, in contrast with most other competitors products including the BSDs and Linux products cited here."

READ THE FUCKING ARTICLE, NUMBNUTZ.

They HAVE the Win2k results in there, idiot.

Re:why is it

[treat]

Ohh, friggin' wah. The MAN is forcing you.. its NOT YOUR FAULT you're a corporate bitch.. its NOT YOUR FAULT the man can push you around.

Why not start looking for a better job instead of bitching and whinning on slashdot all day.

Try finding, especially in this depressed economy, an IT job that does not require you to use Microsoft software at least sometimes. I would estimate that this describes less than one tenth of one percent of jobs. It is virtually impossible to avoid. Switching jobs is not a solution to this problem.

OLD AND SILLY

[fanatic]

Predictable ISNs are only a problem against a machine which has been configured to allow another machine privileges based solely on that second's machine IP address. Then pedictable ISNs allow a third machine to 'spoof' it's address, claiming to be the seond machine by using it's IP address, even though the third machine can't see the responses from the first machine, because the third machine doesn't have the IP address it's claiming.

If you don't configure this 'trust' relationship based on IP address alone, this is not an issue.

Example: SSH allows one machine to trust another, but requires that the trusted machine be at the right IP addresss AND posess the correct private key or keys - so no issue.

Any one who, in this time, configures a machine to trust another, based solely on the IP address in the frames received, is crazy. It's a very unwise practice.

Re:OLD AND SILLY

[GoRK]

Uh.. DNS

Let's say the next time you load up thinkgeek.com and buy some overpriced gadget, your machine gets a spoofed ip during the DNS query, and instead of talking to thinkgeek.com you pass through some web proxy that harvests your credit card number and personal info (perhaps you fail to notice the lack of https:// this time). Of course, your thinkgeek order proxies right through to thinkgeek.com properly by the spoofed machine, then your local DNS cache expires and there's no trace of what happened.

Re:OLD AND SILLY

[Anonymous Coward]

>AND possess the correct private key or keys

No, the private key is never exchanged, what you're thinking of is dropping a person's public key into the remote account's ~/.ssh/authorized_keys, which obviously isn't so secure.

Re:OLD AND SILLY

[sedawkgrep]

Uh..DNS *queries* are UDP. Only TCP has this 'issue'.

And if you order something online w/o verifying HTTPS, you're a moron. Plain and simple. If you *were* DNS spoofed, hopefully your browser would issue a warning that the Cert was invalid.

DNS has its problems, yes...But they have nothing to do with ISNs.

Re:OLD AND SILLY

[WNight]

I think predicting ISNs also lets you hijack a connection...

You let Alice telnet into Bob's machine and do enough that she's had time to enter her password. You then DoS Alice into next week while sending telnet packets to Bob that will create some sort of hole for you to come through later.

Bob sends the responses to Alice but she doesn't see them because she's flooded off the net, and Bob doesn't bother resending them because you ACK the packets.

Now SSH does prevent this, because you can still forge TCP/IP headers and guess ISNs, but you can't fake the encryption without knowing the password (and if you knew that, you'd just log in normally.)

Configuring a machine to trust another based soley on the IP is actually rhosts, I think. I've never actually used it, but that sounds right. And yes, it's supposed to be quite insecure.

Re:OLD AND SILLY

[Q2Serpent]

And if you order something online w/o verifying HTTPS, you're a moron.

Really? How about all of the people who do online shopping, but know nothing more than point-and-click? Let me put it another way: How many people that shop online could answer what 'https' stands for? Or even 'http'? And why https is a good thing when shopping with credit card numbers? I don't think a majority of the people fall into this category...

Don't be so quick to assume that all computer users have any idea what they are doing other than to click where it says to. That's what makes computers so easy to use. Unfortunately, it also makes it easier for malicious people to take advantage of others. But this has been a trade off in many things...

Re:OLD AND SILLY

[fanatic]

I think predicting ISNs also lets you hijack a connection...

I think this is far more dificult than if a machine is using rhosts. You need to know that the user is looged in. You need to guess the ISN, then guess how many other bytes haved floed to get the current SN. Seems much more dificult to me.

Now SSH does prevent this, ... but you can't fake the encryption without knowing the password (and if you knew that, you'd just log in normally.)

Actually, the encryption is not based on the password. IANAE, (I Am Not An Expert), but I think SSH uses a public key exchange to encrypt an exchange where a session key is selected, the session key is then used in symmetric encryption. So you'd need the user's private key, AND to be able to see the traffic from the target back to the user (which is encrypted using the user's public key) at least to hijack the session. Since we're talking ISN predictability issues here, this is usually an issue when you can't see the traffic from the target - otherwise, you'd know the ISN and predictability would not be an issue.

Re:OLD AND SILLY

[fanatic]

From the post to which you're replying: DNS has its problems, yes...But they have nothing to do with ISNs.

You are missing the point altogether. DNS is completely outside the scope of this issue.

Re:OLD AND SILLY

[stripes]

Now SSH does prevent this, because you can still forge TCP/IP headers and guess ISNs, but you can't fake the encryption without knowing the password (and if you knew that, you'd just log in normally.)

SSH V1 in some modes did not prevent this (well, the unencrypted mode for sure didn't!). The DES mode at least could be forced to resync if you sent a lot of data...maybe 2^40 bits. This attack was actually succesfully used and somewhat publisized about 2 years ago...maybe 3. It only worked because the fellow who was attacked went away on a confrence and left an ssh session up and the attackers had 4 days to pump laots of data across. Definilty not a "low hanging fruit" attack!

I don't really know if SSH V2 prevents it, I have not really looked closley at the V2 protocal (unlike V1 where I wrote a Java client). Maybe someday...maybe when I need to learn another new language...

Re:OLD AND SILLY

[Anonymous Coward]

Predictable ISNs allow hijacking of ftp, smtp, telnet, http sessions, dns zone transfers and many other protocols you use every day for many purposes. And, of course, DoS attacks.

Re:OLD AND SILLY

[sedawkgrep]

If you are directing this at me, yes I know it is outside the scope; that's why I said what I said. (DNS is UDP, etc)

Re:OLD AND SILLY

[sedawkgrep]

People unwilling to educate themselves in even the most basic way about the safety of online transactions where either MONEY or confidential information is concerned will never have my sympathy.

Browsers can only go *so* far with something like this - the end-user has to be educated enough to understand the realm in which they're working and the implications of their actions.

sedawkgrep

Re:OLD AND SILLY

[Anonymous Coward]

yes, i'm sure that every time you order something online you not only look to see if there's a little lock icon, but you also view the ssl certificate, even if it's a company you've ordered from 50 times in the past year.

oh wait, nobody's that pedantic, which means that every single person on the planet is a moron.

oh, and if you actually do check it every time, you're a paranoid wacko.

Re:OLD AND SILLY

[Anonymous Coward]

DNS is not only UDP. As a matter of fact, many important DNS transactions happen over TCP.

Re:OLD AND SILLY

[fanatic]

If you are directing this at me, yes I know

no, this was to Q2Serpent.

Re:OLD AND SILLY

[yuri benjamin]

How about all of the people who do online shopping, but know nothing more than point-and-click? Let me put it another way: How many people that shop online could answer what 'https' stands for?
They may not know what "https" stands for, but hopefully someone has told them what that padlock icon is for.

Re:OLD AND SILLY

[sedawkgrep]

QUERIES I SAID. JESUS READ MY POST.

Only DNS transactions that happen over TCP are zone transfers.

Re:OLD AND SILLY

[Anonymous Coward]

Zone transfers happen to be more susceptible to such attacks, because are typically automated and happen between machines you can carefully "probe".

Besides, no, queries can happen over TCP. The rule is a bit different.

Re:For those wondering how insecure Microsoft is .

[FreeUser]

The thing I don't understand is... why do people continue to compare nowadays linux (or IRIX, Solaris, *BSD) etc... to things like Win98, which is _over 4 years_ old by now

The data that was studied for the last two or three years was collected prior to the study commencing, i.e. at least two or three years ago. If you'd bothered to read the paper, you would have noticed that the versions of *BSD and Linux being compared are equally as old (kernel 2.2.x of Linux, for example).

When you conduct a scientific study (not to be confused with the marketing drivel often sold as science and frequently purchased by the likes of Microsoft, and just as frequently disgraced and utterly rebutted a few days later by the scientific community) you collect the data, then you analize the data and draw conclusions from that data. All of that takes time, so any rigorous study conducted is going to be working with data collected at some time in the past.

[opinion]
I'm sure a study will come out showing the appalling weaknesses of Windows XP, but such a study will likely be reviled by Microsoft enthusiasts because, by the time the rigorous work is done, there will be some newer, even more invasive and buggy release of Windows out. That will not, however, make the study any less valid or accurate, any more than it would the study conducted here.
[/opinion]

For the love of God

[gazbo]

RTFA

The results are given in the article, and they are ~1/6th as vulnerable. The original poster strangely seemed to read straight past those results though...

MOD PARENT UP! But you forgot one thing

[Anonymous Coward]

4. This is a repost and the article is really really old

(Although its worth reposting of course, see your reason #3)

Are you willing to bet on it?

[XNormal]

Predictable ISNs are only a problem against a machine which has been configured to allow another machine privileges based solely on that second's machine IP address.

Are you willing to bet that this is the *only* kind of attack possible using sequence number prediction? Someone with a sick imagination may find other novel and destructive uses for it.

In fact, I can already think of some...

RANTING THE TRUTH

[Anonymous Coward]

--if 1% of script kiddies (and older hackers) who are the grief and cause behind these attacks got the shit beat out of them and chucked in jail for ten years, 99% of the honest users of the internet would be at least 50% happy that this occurred. This geek community here is blaming the door on someones home for the cause of breaking and entering. Lookit at the partisan bickering here --"it's all microsofts fault, no it's apples fault, no it's blah blah blahs fault". BZZT wrong answer.

NOPE, it's the assholes who start the attacks fault! The rape victim is NOT responsible! The car the rape victim rides in is NOT responsible! where the rape victim walks is NOT responsible! The RAPIST is responsible for the crime!

My home is MINE, don't come in unless invited, EVEN IF THE DOORS AND WINDOWS ARE WIDE OPEN. IT doesn't matter what BRAND of door I use, either, that's my choice, my HOME is still off-limits unless invited in. That's the law and the only thing every society on the planet has come up with that works, ie, "respect" for others property, even if it's "exposed".

The other 50% might not even know about it, but they could compute in peace, use their computers instead of having to fixate on security so much that the practical useages they were designed for are number 17 on the list.

Yes, I pulled these figures out of my hole, but still, it's vague enough but right-on enough to be more or less accurate.

I DO know that I'm dropping a dime to the feds if I hear of any hackers boasting about their black hat ability.

That might be after they physically "attack" me forcing me to use "self defense". The cops can deal with the beat to snot carcass then.

It's the geek community as a whole to blame, because these hackers are KNOWN to other people in the majority of the cases, who DON'T CARE, who think it's cool, or who secretly use it as an excuse to perpetuate their "security/sys admin" JOBS. There just aren't that many highly secret guys out there compared to the volume of "sport hackers" and these "security analysts" who are just trying to justify their black hat exploits by posing as white hats or greyhats, EYE EMMM OO. Dr. Jekyl/Mr. Hyde behavior is KNOWN to the community, but no one here wants to admit it out loud!

Until malicious hacking is treated as a crime exactly like home break-ins, it won't get any better. Same with spammers, by the way.

Wouldn't shed ONE tear over either a pasty faced acne scarred kid getting put in the hospital over hacking, nor some pasty faced fat old geek, if they are black hat cracking and hacking. Screw 'em! Application of the louisville slugger magic wand of justice, relocation of all the digits on both hands, and the insertion of various pieces of 1337 hardware where the sun don't shine just MIGHT get their attention that what they are doing is just plain WRONG and it's a waste of valuable communities time and money and effort to keep this 'security" deal as such an expense that it has become. If there was a rash of breakins in some neighborhood, what is better, catch the perps or make everyone buy titanium front doors and cement block over their windows? Me as joe computer user keep getting told I need the titanium door and cement blocks, that even if I apply those patches that YET AGAIN next week I'll have to add to it, but I AIN'T seeing any hackers busted, very, very, very few of them. GEE, WONDER WHY THIS IS? They *really* can't be found? Huh? I'm supposed to believe this? Phooie, a LOT of them could be found, just on this forum I bet there's hundreds of them, and I'd bet a nickel most geeks have someone in their circle of friends who IS a blackhat, at least part-time.

All that is needed mostly is to take the less than .00001% jerks out there and chuck them in jail, treat them like the felons they are.

Foreign hackers? No problem, start major internet blocking of their dns names and then their numeric domains and finally all their IP traffic in general until they police themselves. If that means entire countries like korea or china or israel or syria, so be it, CUT the cables. when the fatcat businessmen in those countries realise that business is shutdown until they stop their own citizens black hat behavior, it will stop almost entirely.

Re:RANTING THE TRUTH

[Anonymous Coward]

That might be after they physically "attack" me forcing me to use "self defense". The cops can deal with the beat to snot carcass then.

Shit, more testosterone poisoning. What the cops will, in fact, deal with is the fact that you took over their job, and the judge's, jury's and executioner's. After which your very sorry ass WIILL do time as Spike's dickwarmer.

For all your ranting and posturing, your daughter will wind up just as pregnant by the AIDS-carrying rapist whether it's the street's fault, the rapist's fault or the the fault of her twitching her ass in the wrong neighborhood because "it's her right".

Not recently rewritten.

[Inoshiro]

"OpenBSD had the best TCP/IP random number generation (recently re-written)."

Didn't you question anything when they said 2.2.1x, or OpenBSD 2.8 was "recent"? No? OpenBSD 3.1 is the most recently released one. They've had this for quite a few releases now (didn't you also notice that OpenSSH's default root problem affected OpenBSD 2.9-3.1?). They also had *no* data for Linux 2.4, or Windows XP.

Don't believe me? Scroll down to the bottom of the page where it mentions it was last updated in April 2001.

Re:For those wondering how insecure Microsoft is .

[markmoss]

why do people continue to compare nowadays linux (or IRIX, Solaris, *BSD) etc... to things like Win98, which is _over 4 years_ old by now

Maybe because lots of people are still using Win98 - for economic reasons, because of a need to support old software needed to access critical data, or because considering microsoft's track record so far we tend to assume that in a few years it will be discovered that XP has even worse holes... Or people just don't like WPA, and assume that it's a future revenue enhancement tool - in a few years when MS has a replacement for XP on the market, their site for XP WPA might suddenly have all sorts of problems until people start giving up and buying a new OS when their systems crash and have to be reloaded.

I agree, comparing Win98 to server OS's like BSD isn't fair - there should be two separate comparisons, desktop to desktop and server to server. I gather that in server software, Win2K isn't bad in comparison to other commercial server products, but the OSS products (Linux and BSD) are far better. So Microsoft's bellyaching about OSS being insecure is proven wrong. (And if Linux has improved that much in the last 4 years, it's another indication that when security becomes important, open source can improve much faster than closed.)

As for comparing desktop to desktop, it's hard to arrange a comparison that everyone would agree is fair. First off, you don't exactly have competing desktop OS's - you have MS which writes desktop OS's and tries to upgrade them to run servers later, and you've got everything else (since Mac OS 9), which are *nix server OS's downgraded to run a desktop. It's something for MS to whine about when they lose. Anyhow, MS's latest desktop (XP Home) might have acquired a good sequence randomizer to plug this one hole, but the default installation apparently opens up a lot of others. I wonder how many other utterly brain-dead decisions like allowing Plug-n-Play to work across the network are not yet revealed...

Re:Dumb "paper"

[Anonymous Coward]

Encryption as in e-mail, ftp, DNS and many other sensitive things we just always encrypt to be sure. yes.

Because studying takes non-zero time.

[Anonymous Coward]

And making the graphs, arguing over them, discussing them with peers, checking through again, proofreading, journal submission, proofreading, journal resubmission, proofreading. galley proofs. Non-zero time. And there's always at least 5 typos, 5 errors, 5 homonyms, and someone's name spelled incorrectly. Always.

Taco likes slashdotting

[Anonymous Coward]

I think the folks at Slashdot grin when a site is crushed to death with hits as soon as they get linked by Slashdot.

For one thing, it's sort of fun to guess which sites can handle the bandwidth and which cannot. Correcting spelling and grammar, apparently, gets very boring for Taco et al, and betting on who can handle the Slashdot effect provides some relief.

Not to mention, being the news website to have so much traffic that this effect is named after them is comforting to the ego. Why adapt the site to fix this and lose this?

Finally, the Karma system solves the Slashdot effect adequently. Users have a chance to race to post the Google cache and receive 3 to 5 mod points. Those who don't get the post in first can go on to mirror the site on their own server for some Karma.

Caching sites in a way that worked technically and legally is obviously possible and they could have done it long ago. The above reasons are the only possible explanations for why they haven't done it ... other than pure laziness.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:why is it

[treat]

If your field was shooting babies in the head with a high powered rifle; and all of the sudden you realized that your job made you do immoral bad things, would you change fields?

The advertisement in your signature points to www.coronahost.com, which claims to be running Microsoft IIS. So I am sure you will agree that while the theoretical discussion is interesting, in the real world there are forces that you simply can not control. The only thing that can be done is to helplessly complain.

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

why do people continue to compare nowadays linux (or IRIX, Solaris, *BSD) etc... to things like Win98, which is _over 4 years_ old by now

Who cares how old it is. It's being patched constantly. It's not like the sequence # generator can't be updated 4 years after original release.

You're making me laugh

[Anonymous Coward]

You're talking to a guy who brags about being in mensa.

Its kind of like the special olympics, but the mensa people think they're smarter somehow because they passed an IQ test with high grades.

Its more than funny, but I'll let braniac there figuire it out.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

So in this case, your level of protection is determined by your inteligence and not by the amount of money you sepend.

so explain to me, why isn't the attack feasibility for linux 100% then?

OS fingerprinting

[horatio]

nmap will tell you what the OS is, and give you a rough idea of how hard it would be to use the target's ISN against it.

Uptime 0.811 days (since Sat Jun 29 22:04:58 2002)

TCP Sequence Prediction: Class=random positive increments
Difficulty=2918407 (Good luck!)

IPID Sequence Generation: All zeros

Stup[id plug.

[mindstrm]

Before everyone goes off about security.

TCP was not designed to be secure. It was designed to ensure data is put back in the proper order at the remote end, and to be able to adjust it's transmission to deal with congestion.

Yes, there is a security issue.... but any security breach through ip spoofing is really a fault of the higher layer application/protocol and NOT of the ability for a tcp session to be spoofed.

Before people get too gleeful...

[Lars T.]

The paper talks about a n-dimensional space, but only looks at the 3-dimensional case. It is totaly possible that the picture looks different at other dimensions (even at two), and spoofing works better when you use that as a basis. Which of course doesn't make the others more secure should they have better results at other dimensions - the worst case is still the worst case.

grsecurity patches

[jooniqzb1tch]

if you're interested in random ISN's I'd suggest you try the grsecurity patch from grsecurity.

it has loads of other interesting functions and the random ISN generator seems to work fine, here's a nmap scan result :

TCP Sequence Prediction: Class=random positive increments
Difficulty=4184073 (Good luck!)
TCP ISN Seq. Numbers: BA77562B B9B190FD BA8C8609 BA3DFEB2 BA92DBDB B9BA515C
IPID Sequence Generation: Randomized

Re:For those wondering how insecure Microsoft is .

[MSZ]

so it's probably a year out of date, don't feel so singled out

Actually, the whole thing is more than a year old! It was primarily published on private page by the researcher. Now that he works for BindView, they "reprinted" it as a company. Nothing new to see here, move along.

Re:For those wondering how insecure Microsoft is .

[mindstrm]

Care to fill us in?

Re:For those wondering how insecure Microsoft is .

[ez76]

Windows 95 sequence numbers are very weak. But it is really difficult to understand is why this algorithm was further "weakened" in Windows 98 (SE), decreasing estimated error and number of elements required to get the right guess, in average, 99.488%.

Put that interesting tidbit together with Cringely's thoughts on Microsoft's "TCP/MS" strategy with Palladium.

I'm not usually a paranoid "MS wants to rule the world type" but this is a little too convenient a coincidence to ignore.

Great article

[ikekrull]

That is the most interesting thing i have seen on Slashdot for a long time.

CERT Advisory on this subject

[Anonymous Coward]

See http://www.cert.org/advisories/CA-2001-09.html. Also http://www.kb.cert.org/vuls/id/498440. It has some good background about why this was news at the time. For example, assertions in this thread that ISN prediction doesn't matter if you don't use address-based authentication are just plain wrong, and the advisory tells you why.

Re::-o

[Anonymous Coward]

michael sims quotes a troll... what is the world coming to

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

I don't explain things for simpletons.

4 lines of code

[Anonymous Coward]

Interesting that such a simple analysis in TCP/IP seemingly random
time series could give insight of a 1-dimensional phenomena into a
reconstructed n-dimensional geometrical body. Something that a geometric
solution of a non-linear Partial Differential Equation
is difficult to achieve. Maybe this other way around analysis
as Stephen Wolfram remarks, could give insight into other
i-D manifestations of nature with TCP/IP encryption likelihood
(i.e. seismic, encephalographic, stock markets...) where
prediction or quality of encryption could be used as a mean for
identifying determinism out of a seemingly random signal. Could be the
tool instead of the goal.

cheers

this is really quite old

[Anonymous Coward]

This sort of thing has been round for years. Someone (I forget who...just had a long drive...sorry) wrote a security book about seven or eight years ago and described this. Turns out by predicting the sequence numbers you can hijaak a Telnet connection (or any other sort of connection). Pretty wild stuff

Reminds me of the Spectral Test mentioned in Knuth

[Anonymous Coward]

In Knuth's The Art of Computer Programming, he discusses the "spectral test" at length. It is a way of testing random number generators for patterns, using 2, 3, 4 or more dimensions. He shows a couple of pictures similar in spirit to the ones in the paper we are discussing.

From Knuth, Volume 2, section 3.3.4, 3rd. ed.: "Not only do all good generators pass this test, all generators now known to be bad actually fail it. This it is by far the most powerful test known, and it deserves particular attention."

Re:For those wondering how insecure Microsoft is .

[yuri benjamin]

I just read the article you linked to.
It really does scare me, doubly so because I live in a small country (NZ) that is paying huge sums to this foreign vendor that is a convicted monopolist. That money should be going to the local economy. I hope NZ will be able to buy non-palladium-crippled hardware to run alternative OSen.

attack feasablity 0% in most cases

[mycal]

While ISN spoofing can be a problem, it really isn't in 99% of the machines in use today.

ISN spoofing requires that the target machine runs .rhost or other IP based authentication. Without this, this attack cannot be utilized. Also you need to be able to muzzle the spoofed machine during the attack, much easier a few years ago than today as things like SYN floods are much less effective.

In the old days this type of authentication was commonly used, but not much anymore. An the argument about windoz boxes being insecure as ISN spoofing, really doesn't mean a thing since there not going to be running IP based authentication.

It is a fun problem to talk about, but there is much better ways to solve it than tossing compute cycles on strong hashes ala RFC1948.

mycal

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

connection hijacking.

even sshv1 isn't safe, though sshv2 is.

They're not outdated, they're last year's :-)

[billstewart]

If you look at the date on the web page, it's April 2001. Linux 2.2.x was just fine back then :-)

Re:For those wondering how insecure Microsoft is .

[Anonymous Coward]

THANK GOD you showed up. THE defender of TRUTH has
arrived everyone. Pack up your FUD guns and go home.

Re:why is it

[Anonymous Coward]

Wow. The DEFENDER of TRUTH is back. Setting all
the wrongs in world right.
I feel better already.

There was a CERT advisory about this

[Anonymous Coward]

CERT® Advisory CA-2001-09 Statistical Weaknesses in TCP/IP Initial Sequence Numbers

And another thing...

[Anonymous Coward]

Many of the graphs are pretty, which is a bonus for stoners, midnight-espresso-drip-feeders, and non-TCP-gurus. Without specifically mentioning Win98's graph, the site probably wouldn't have ben /.ed...

Re:For those wondering how insecure Microsoft is .

[mindstrm]

Yeah.. but again, you can't see the response. Same boat as spoofing the connection in the first place.

yes, there are situations where you can do something nasty with it.. but they are rather specific ones, and rely on using unsecure protocols anyway.

TCP was not designed to be secure. It was designed to get packets reassembled in order, and to be able to dynamically change it's transmission properties to deal with congestion.