Tuesday, June 13, 2000
What a strange attack this is …
Watching monnet again I see some odd activity coming from an IP
address. Random TCP packets with the Reset bit set to random TCP ports on
my primary machine. I try to trace back the connection and it goes nowhere,
so the source address seems to be forged.
I might have to talk to my upstream provider on what to do.
New net-based attack?
In looking closer at the forged TCP packets I'm getting, I'm
wondering if this is some very subtle attack going on.
The sequence I'm seeing is a TCP packet from the forged address
with the FINISH flag set. My system then tries to repond to the
packet (why? It's not a valid connection to begin with) but the data it
sends back contains garbage from previous IP packets, not
neccessarily just other TCP packets.
Now, could it be that somewhere along the path some host's NIC is in
promiscuous mode and can read the packets, and with a long enough sample of
data, might be able to determine information from the partial garbage
packets sent back? For instance, I'm seeing my system send back garbage
packets with part of my SNMP community string.
