[32827] in bugtraq
Re: A new TCP/IP blind data injection technique?
daemon@ATHENA.MIT.EDU (Michal Zalewski)
Fri Dec 12 17:08:04 2003
Date: Fri, 12 Dec 2003 18:24:00 +0100 (CET)
From: Michal Zalewski <lcamtuf@ghettot.org>
To: Barney Wolff <barney@databus.com>
Cc: bugtraq@securityfocus.com, full-disclosure@netsys.com
In-Reply-To: <20031212171444.GA31845@pit.databus.com>
Message-ID: <20031212181851.V6830@dekadens.coredump.cx>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
> I suspect that in these cases the RSTs may be coming from firewalls
> rather than end-hosts. It would be more impressive and surprising if
> one ever got a SYN-ACK in response.
Not really. A variant of the same test addressed to common ports such as
139 resulted in four SYN+ACKs coming back, compared to 50 SYN+ACKs when
the checksum was correct - which is roughly similar to the previous
figure. Quite surprisingly, some of this comes from what seems to be
Windows XP SP1 - but maybe an intermediate device rewrites the packet
instead.
--
------------------------- bash$ :(){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2003-12-12 18:18 --
http://lcamtuf.coredump.cx/photo/current/
