One of the more fascinating securit

One of the more fascinating security holes was described by Robert Morris. This form of attack takes advantage of the predictability of sequence numbers used in TCP implementations. In particular BSD 4.2 and 4.3 (and their many siblings) have been shown to be vulnerable.
1) The initial sequence numbers (ISN) used by TCP should be random, incrementing values, Berkeley Unix starts with an ISN of 1and increments it a fixed number of times per second and per connection. It is therefore possible to estimate the next ISN that will be used by: connecting to the server, recording the ISN and then measuring the time to the next connection.
2) To avoid the attacked host sending a reset message to the spoofed host the attacker must flood the appropriate port on the spoofed host.
3) The attack proper starts by opening a connection to the server (S) but with the source address spoofed to be that of a trusted host (T) on the network.
4) The server will respond with an acknowledgment and its own ISN. This will be sent to the trusted host because of the address spoof. Under normal circumstances the host would not recognise this acknowledgment, the attacker actually opened this connection, however the attacker disabled the trusted host in [2].
5) The attacker uses its predicted server ISN to carry on the conversation, for example it could instruct the server to send it the password file.
Defences against this attack include using TCP stacks with less predictable ISNs. Firewalls should also be block packets with internal source addresses arriving on the external interface (input filtering) and similarly block packets with an source address different from the internal network to stop attacks originating from the site. Logging could also detect the unusual network activity (e.g. host T generating RST messages) this kind of attack generates.

ผลลัพธ์ (อังกฤษ) 2:

The more fascinating One of security holes was described by Robert Morris.This form of attack takes advantage of the predictability of sequence numbers used in TCP implementations. In BSD particular 4.2 and 4.3 (and their many siblings) have been shown to be vulnerable.
1) The initial sequence numbers (ISN) used by TCP should be random, incrementing values,starts with an ISN Berkeley Unix and increments of 1 fixed it a number of times per second and per connection. It is therefore possible to estimate the next ISN that will be used by: connecting to the server, and then recording the ISN measuring the time to the next connection.
2) avoid To attacked the host sending a message to reset the spoofed host the attacker must flood the appropriate port on the spoofed host.
3) The attack proper starts by opening a connection to the server (S), but with the spoofed source address to be that of a trusted host (T) on the network.
4) The server will respond with an acknowledgment and its own ISN.This will be sent to the host because of the trusted address spoof. Under normal circumstances the host would not recognise this acknowledgment, the attacker actually opened this connection, however the attacker disabled in the Trusted host [ 2].
5) The attacker uses its predicted ISN server to carry on the conversation, for example it could instruct the Server to send it the password file.
using this attack against Defences include TCP stacks with less predictable ISNs.Firewalls should also be internal block packets with source addresses arriving on the external interface (input filtering) and similarly block packets with source address different from an internal network to stop the attacks originating from the Site. Logging could also detect the unusual network activity (e. g.host T RST generating messages) generates this kind of attack.