TCP/IP Hijacking

TCP/IP hijacking is a form of network-level session hijacking where an attacker exploits the flaws inherent in the Transmission Control Protocol/Internet Protocol (TCP/IP) design to seize control of a valid TCP communication session between two devices.

This attack falls under the category of active attacks as it involves tampering with data in transit or disrupting communication between systems.

Overview

TCP/IP hijacking involves an attacker intercepting an already established TCP connection between two communicating parties (the user and the server) by using spoofed packets and predicting session parameters. In this approach, the attacker uses spoofed packets to redirect the TCP traffic to their own machine. Once this is successful, the victim's connection hangs, and the attacker is able to communicate with the host's machine on behalf of the victim.

By using this technique, an attacker can easily attack systems that use one-time passwords. To launch a TCP/IP hijacking attack, both the victim and attacker must be on the same network. The target server and the victim machines can be located anywhere.

Attack Mechanism

Sequential Attack Steps

The process typically involves the following sequential steps performed by the attacker:

1. Sniffing and Prediction: The attacker passively monitors the network and sniffs the victim's connection to capture the sequence and acknowledgment numbers. This is crucial because TCP connections rely on these numbers for synchronized communication.

2. Spoofing: The attacker then sends a spoofed packet to the target server, predicting the next expected sequence number, and spoofing the victim's IP address as the source.

3. Desynchronization: The server processes the spoofed packet, increments the sequence number, and sends an acknowledgment (ACK) packet back to the victim's IP address. Since the victim did not send the original spoofed packet, they ignore the server's ACK packet. This action effectively desynchronizes the connection between the user and the server.

4. Control Acquisition: The attacker forces the victim's connection into a desynchronized state and continues to track the sequence numbers, continuously sending spoofed packets that originate from the victim's IP address. The victim's connection hangs, and the attacker is now communicating with the receiver machine on the victim's behalf.

Detailed Attack Process

TCP/IP hijacking is performed through the following steps:

• The attacker sniffs the victim's connection and uses the victim's IP address to send a spoofed packet with the predicted sequence number.
• The receiver processes the spoofed packet, increments the sequence number, and sends an acknowledgement to the victim's IP address.
• The victim machine is unaware of the spoofed packet. Therefore, it ignores the receiver machine's ACK packet and turns off sequence number count.
• Consequently, the receiver receives packets with the incorrect sequence number.
• The attacker forces the victim's connection with the receiver machine into a desynchronized state.
• The attacker tracks sequence numbers and continuously spoofs packets that originate from the victim's IP address.
• The attacker continues to communicate with the receiver machine, while the victim's connection hangs.

Attack Scenario Example

According to above figure, the next expected sequence number is 1420. If the attacker transmits that packet sequence number before the user does, they can desynchronize the connection between the user and server.

If the attacker sent the data with the expected sequence number before the user could, the server would be synchronized with the attacker. This leads to the establishment of a connection between the attacker and server. Then, the server would drop the data sent by the user with the correct sequence number, believing it to be a resent packet. The user is unaware of the attacker's action and may resend the data packet because the user does not receive an ACK for their TCP packet. However, the server would drop all the packets resent by the user. Thus, the local session hijacking attack is successfully completed.

Key Components of the Attack

• Network-Level: TCP/IP hijacking relies on transport and Internet protocols used by web applications in the application layer.
• Spoofed Packets: The attacker uses spoofed packets to seize the connection.
• Sequence Numbers: Success depends on the attacker's ability to guess or predict the sequence numbers. The Initial Sequence Number (ISN) is a unique 32-bit sequence number assigned to each new TCP connection.
• Local Segment Requirement: To launch a local TCP/IP hijacking attack, the victim and the attacker must be on the same local network.

Related Hijacking Contexts

• Blind Hijacking: When source routing is disabled, an attacker may use blind hijacking to inject malicious data into the TCP session without being able to see the response packets from the client or server.

• IP Spoofing: This technique is often classified under general TCP/IP hijacking methods. IP spoofing allows the attacker to impersonate another computer. If the attacker uses IP spoofing in a session hijack scenario, they may steal credentials and then try to initiate a new session using those credentials. When IP spoofing is used, the attacker will not be able to complete the three-way handshake and open a successful TCP connection.

• Session Hijacking as an Active Attack: Session hijacking is listed as an example of an Active Attack. Successful hijacking allows the attacker to steal a valid session ID and use it to authenticate themselves with the server.

Countermeasures

To protect against TCP/IP hijacking and sequence number prediction attacks:

• Encryption: The most effective countermeasure is using encryption protocols to secure network communications. Secure protocols such as Secure Shell (SSH), TLS, and HTTPS should be preferred over insecure clear-text protocols (like Telnet and FTP). Using encryption methods like SSL or PPTP makes IP address spoofing or session hijacking impossible during the key exchange process.

• Randomization: Implement a random initial sequence number (ISN) to prevent attacks based on sequence number spoofing.

• Filtering: Use TCP Intercept features in routers to protect TCP servers from SYN-flooding attacks, which prevent fake connection attempts from reaching the server.

• Authentication: Do not rely solely on IP-based authentication.