How can you spoof a TCP connection to a device that uses the same initial sequence number for each run of a TCP handshake?

Question

So supposing the TCP implementation on a device always uses the same initial sequence number how could you as an off path attacker exploit this to spoof a connection to this device?

So in order to do this you would need the device to set up a TCP handshake with you. To ensure that a RST message is not sent by the device I assume you would need to spoof both the SYN and ACK message (this would require knowledge of the device's IP address then? As an off path attacker how could you get that?).

Or...

Would you only need to spoof the SYN message, send a SYN/ACK with what the device will believe to be valid given that it has a valid sequence number? Would the device not simply sent a RST message in response to a SYN/ACK message?

Any ideas?

Answer 1

"Spoofing" is normally about using a fake source address. You want to connect to the target, without revealing your actual IP address, instead using another IP address. In your case, you (the attacker) perfectly know the device's IP address; what you do not want to reveal is your own IP address. You want to open a connection with the device such that the device believes that it talks to a client with a completely distinct IP address.

The main problem with spoofing is that while you can send arbitrary packets with a fake source IP address, you won't receive any response, because responses will be sent to the fake address, not yours. This, in particular, makes it very difficult to complete the TCP handshake because each party must send s+1 as an acknowledgement of the sequence number s sent by the peer. If you are the client and are trying to spoof, you won't receive the SYN+ACK packet from the server, and thus won't know what value to put in your own ACK. You might "get lucky" but since these are 32-bit integers, the probability of success is only 1 in 4294967296.

Now, if the target server uses a poor random generator, then your probability of guessing the sequence number chosen by the target may go up. In particular, if the target server always uses the same value (a very poor generator indeed), then you can guess it with probability 1, i.e. succeed each time. You can thus send a SYN, not receive the SYN+ACK (because it is sent at the fake address), but still send your ACK with the right value, based on your "guess" of the sequence number chosen by the server. The server will be content with that ACK. At that point, you can send arbitrary data through the connection. Of course you still won't see any answer, but if the point is to issue commands, then this is sufficient (example situation: you want to send spam through a SMTP server that refuses email sending except from a few specific client IP addresses).

In all of this, all your packets must bear the fake (spoofed) IP address.