Lecture 18: BGP, TCP, and UDP

• Slides
• Playlist (length: 52:14)

BGP

Coming soon… Check back after the live lecture!

TCP Bytestreams

Ports

TCP Sequence Numbers

TCP Handshake

UDP

TCP RST Injection

TCP Data Injection

What obstacles does an on-path attacker need to overcome to inject data into a TCP connection?

The on-path attacker needs their injected packet to reach the victim before the legitimate packet (win the race condition).

Note that the on-path attacker already knows the correct sequence numbers because they can see all the victim’s traffic.

TCP Off-path Attacks

In a blind spoofing attack, does the off-path attacker need to guess the sequence number or the acknowledgement number when sending the ACK part of the handshake?

The attacker will know the sequence number to use, since they chose the initial sequence number in the SYN they sent. The attacker needs to guess the acknowledgement number, since the server sent the SYN-ACK with this value to the victim instead of the attacker.

Summary of TCP Security Issues