New TCP Flaw Found - Reset Attacks around the corner?

Well, I wondered when this would surface. I heard about a presentation a couple of weeks ago that was going on at CanSecWest 2004 this week in which Paul Watson was going to discuss TCP Reset Attacks. The grapevine spoke of an interesting paper... but I never got a copy of it.

It appears that the UK National Infrastructure Security Co-Ordination Centre (NISCC) got an early copy of his paper yesterday and has issued an alert discussing various scenarios... including Paul's discover of the practicability of the RST attack.

Basically the attack pattern is resetting an established TCP connection by sending suitable TCP packets with the RST (Reset) or SYN (Synchronise) flags set. The packets need to have source and destination IP addresses that match the established connection as well as the same source and destination TCP ports. Of course all this is easy to spoof... and quite easy to do with Perl and Net::RawIP. (And people commented on my entry about the practicality of Perl *pffft*)

You can read the details in the NISCC alert, which provides some information on mitigation techniques, including an interesting idea of resizing TCP window to deflect the attack.

Now just to get a copy of the paper and read Paul's research about the attack. Maybe I can get a copy from Joost since I know he was attending the conference. Joost? Otherwise, if you are in town attending the conference let me know and we can hook up for beers... and look at the paper more closely.