This week’s hot news within network security circles is likely to be about the most recent update to the TCP specification which allegedly allows communication channels to be hijacked by a remote attacker. This latest TCP specification has been implemented on Linux systems, but is yet to be on Windows, apparently.
This is essentially an information disclosure flaw. The latest TCP specification may leak information about established, active connections through a side channel. The researchers who discovered the flaw claim it could allow a hacker to insert malicious or unwanted data packets into a data packet series between any two arbitrary machines whose IPs are known. Interestingly this Man-in-the-Middle type scenario would not require the attacker to insert himself/herself on the same communication channel as the connected target machines.
How serious is this flaw to a typical end user, though? To attack an end user, a hacker would need to identify a spoofed IP address to pretend to come from a specific source with which the user has already established a connection, and the user’s own target IP address. Hence, the probability that any specific user gets targeted at random is less, the reason being that there is a huge user base of dynamically-allocated IPs. Exploitation of the flaw could be more likely to succeed in IPv4 cases, but with the introduction of IPv6 the probability that an individual user’s IP would be found at random is small, both in the case of mobile devices and desktop computers.
Given the nature of an attempted attack perhaps this flaw will be more worrisome to web servers, etc., which are required to be ON all the time, and more likely to have predictable IPs.
As for the malware injection claim, it seems less likely that a malware payload by itself would be sent within a data packet. Rather, it could be a malicious URL that redirects the user to download the malware.
Installing a reputed and updated security product like K7 Total Security should block any malicious URLs being accessed or malicious files from being downloaded onto a victim’s computer.
Image courtesy: wakinguptheghost.com
Samir Mody, K7 Threat Control Lab
V.Dhanalakshmi, K7 Threat Control Lab
