[2818] in Privacy_Forum
[ PRIVACY Forum ] Off-Path TCP Sequence Number Inference Attack: How
daemon@ATHENA.MIT.EDU (PRIVACY Forum mailing list)
Tue May 22 00:05:42 2012
Date: Mon, 21 May 2012 20:50:15 -0700
To: privacy-list@vortex.com
Message-ID: <20120522035015.GB13499@vortex.com>
MIME-Version: 1.0
Content-Disposition: inline
From: PRIVACY Forum mailing list <privacy@vortex.com>
Reply-To: PRIVACY Forum mailing list <privacy@vortex.com>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: privacy-bounces+privacy-forum=mit.edu@vortex.com
Content-Transfer-Encoding: 8bit
Off-Path TCP Sequence Number Inference Attack: How Firewall Middleboxes Reduce Security
http://j.mp/K6EWkn (UMich [PDF])
"Abstract-In this paper, we report a newly discovered "offpath TCP
sequence number inference" attack enabled by rewall middleboxes.
It allows an off-path (i.e., not man-inthe-middle) attacker to
hijack a TCP connection and inject malicious content, effectively
granting the attacker write-only permission on the connection.
For instance, with the help of unprivileged malware, we
demonstrate that a successful attack can hijack an HTTP session
and return a phishing Facebook login page issued by a browser.
With the same mechanisms, it is also possible to inject malicious
Javascript to post tweets or follow other people on behalf of the
victim."
- - -
--Lauren--
Lauren Weinstein (lauren@vortex.com): http://www.vortex.com/lauren
Co-Founder: People For Internet Responsibility: http://www.pfir.org
Founder:
- Data Wisdom Explorers League: http://www.dwel.org
- Network Neutrality Squad: http://www.nnsquad.org
- Global Coalition for Transparent Internet Performance: http://www.gctip.org
- PRIVACY Forum: http://www.vortex.com
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://vortex.com/g+lauren / Twitter: http://vortex.com/t-lauren
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
privacy mailing list
http://lists.vortex.com/mailman/listinfo/privacy
