New Hacking Technique?

[Cody]

I was just reading Hacking Exposed 2nd Edition one day, and I thought of something: would this be a new type of DDoS attack?

This attack requires 3 things:

A. The cracker's computer, or the infected one.
B. An "innocent" computer w/ fast Internet.
C. The target system.

From now on, I will refer to the systems by their numbers. Ok...

Suppose this. (A) sends a SYN packet to (B) with the source IP of (C). We will now give A an IP of 1.1.1.1 B an IP of 2.2.2.2 and C an IP of 3.3.3.3

Here is it "dirtified":

SYN <FROM: 3.3.3.3 TO: 2.2.2.2>
SYN/ACK <FROM:3.3.3.3 TO: 3.3.3.3>
ACK <FROM: 3.3.3.3 TO 3.3.3.3>

Now imagine hundreds and hundreds of 1.1.1.1's out there (systems infected with something similar to SubSeven that would allow you to send SYN ACK packets) doing this all to one server (A and B could be any system, but the target the same)....

That could probably crash a server pretty quick. This would also work with any type of UDP or TCP/IP connection that requires a response similar to SYN SYN/ACK ACK

[psyklone]

with that example, the exchange would actually look like:

SYN <SRC: 3.3.3.3 DST: 2.2.2.2>
SYN/ACK <SRC: 2.2.2.2 DST: 3.3.3.3>
ACK <SRC: 3.3.3.3 DST: 2.2.2.2>
ACK <SRC: 2.2.2.2 DST: 3.3.3.3>

and that would go on (in a valid exchange) depending on window size agreed upon during the 'handshake' for . of course this example is only concerning spoofing an ip, not including window size, sequence numbers, etc.

the problem with this is that the first packet going either direction (during the SYN and SYN/ACK) has the SYN bit set and everything following have the ACK bit set. functionality is included in most internet devices, and even in home user firewalls, that packets that are inbound with the ACK bit set that are not a reply to an outbound packet from your machine (with the SYN bit set) get dropped so i'm thinking that this wouldn't be very effective.

also this wouldn't apply to udp, this handshake is a tcp function that is the basis for its control information which is something that udp lacks.


feedback from anyone else?

cheers,

psyklone

[edwelly]

I just read what you guys wrote and I am so confused right now...
---edwelly

[Fingers]

Moved to Networking and Internet