Date: Tue, 22 Aug 2006 07:32:56 -0400 From: "Michael Scheidell" <scheidell@secnap.net> To: "Uwe Doering" <gemini@geminix.org>, <freebsd-security@FreeBSD.ORG> Subject: RE: SSH scans vs connection ratelimiting Message-ID: <B3BCAF4246A8A84983A80DAB50FE72424C6A79@secnap2.secnap.com>
next in thread | raw e-mail | index | archive | help
> -----Original Message----- > From: owner-freebsd-security@freebsd.org=20 > [mailto:owner-freebsd-security@freebsd.org] On Behalf Of Uwe Doering > Sent: Tuesday, August 22, 2006 4:09 AM > To: freebsd-security@FreeBSD.ORG > Subject: Re: SSH scans vs connection ratelimiting >=20 > that someone could fake a complete exchange like this from the remote=20 > via a TCP connection while using source IP address spoofing. My=20 > understanding so far is that source IP address spoofing from=20 > the remote=20 > works only with connectionless protocols like UDP and ICMP,=20 > or TCP SYN=20 > packets as a special case. Please correct me if I'm wrong. You are more or less correct. For all practical purposes, spoofing a three way tcp connection is impossible. (for all practical purposes) There is man in the middle attacks, routing hijacking, and possibly tcp connection id spoofing, but if you are using a modern os that does not suffer from connecting id guessing, its so hard to do that that only someone specifically trying to break into your network, who has the ability to sniff your traffic, might even have a ghost of a chance of doing this. (and if you already have the *keys from known_hosts, ssh will complain about it if it even gets that far) --=20 Michael Scheidell, CTO 561-999-5000, ext 1131 SECNAP Network Security Corporation Keep up to date with latest information on IT security: Real time security alerts: http://www.secnap.com/news
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?B3BCAF4246A8A84983A80DAB50FE72424C6A79>