Port randomization paper
Folks,
During the last few years a couple of vulnerability advisories were
published about a number of blind attacks against TCP (.
These attacks required the attacker to guess or know the four-tuple
that identifies the TCP connection to be attacked.
Clearly, of the IP addresses and port numbers in use, the (client
side) ephemeral port can be obfuscated, thus requiring much more
effort from an off-path attacker.
While attack-specific counter-measures have been implemented in most
stacks, there are still stacks that do not implement the general
counter-measure of obfuscation of the client port number.
Also, interoperability problems that result from some port
randomization techniques have been publicly discussed. However, there
has not been much advance in this respect.
We have published an internet-draft (i.e., a document aimed at the
IETF) that discussess the topic of port randomization, and proposes a
number of approaches that I don't think had been documented before.
The document is available in PDF format at:
http://www.gont.com.ar/drafts/port-randomization/draft-larsen-tsvwg-port-randomization-01.pdf
. Additionally, you can get it in other fancy formats at:
http://www.gont.com.ar/drafts/port-randomization/ .
We would like to get feedback from the community on this document.
Wether it is that there are drawbacks with our approaches that we
missed, or whether you can think of better alternatives, or whether
you think the proposed approaches are a good idea.
Feel free to post your comments/questions on-list or privately at:
fernando@xxxxxxxxxxx
Thanks,
--
Fernando Gont
e-mail: fernando@xxxxxxxxxxx || fgont@xxxxxxx
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1