#144 TCP Spoofing Reliable Payload Transmission Past the Spoofed TCP Handshake Eric Pan
Presenters detail vulnerability discovery and exploitation in #144 TCP Spoofing Reliable Payload Transmission Past the Spoofed TCP Handshake Eric Pan.
Summary
TCP Spoofing Motivation
Eric Pan presents research on reliably transmitting payloads through spoofed TCP connections after handshake brute force. Attackers spoof victim IPs to bypass IP-based authentication in email SPF checks, database trust rules, and firewall allow lists.
Handshake Brute Force
Modern OSes hardened ISN prediction, pushing attackers toward brute-forcing sequence numbers with spoofed SYN and ACK floods. The harder problem is using the connection without knowing when it establishes or which sequence numbers are valid.
Send Window Brute Forcing
RFC acknowledgment rules permit old ACK values on new connections that acknowledge data never sent. Attackers split the search space into window-sized chunks, injecting payloads by brute-forcing acceptable ACK numbers on spoofed sessions.
Feedback Channels and Mitigation
A second primitive uses side channels—such as Linux SYN cookie ISN generation differences when listen backlogs fill—to confirm successful spoofing. Testing showed Windows, BSD, and Linux were vulnerable; Linux patched upstream and IETF work aims to tighten ACK validation.
Related talks
IEEE Symposium on Security and Privacy·17 min
Presenters detail vulnerability discovery and exploitation in #144 TCP Spoofing Reliable Payload Transmission Past the Spoofed TCP Handshake Eric Pan.
IEEE Symposium on Security and Privacy·15 min
Engineers explore architecture and security mechanisms for Crowd-GPS-Sec: Leveraging Crowdsourcing to Detect and Localize GPS Spoofing Attacks.
Videos·46 min
Cesare Pizzi
Analysts investigate attack surfaces and defenses concerning REW-sploit: Dissect Payloads With Ease by Cesare Pizzi.