COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-323

TCP (ISN) Counter Rate Probe

This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.

Abstraction

Detailed

Typical severity

Low

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.

Requirements

What does the attack require?

Prerequisites

  • The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Skills required

Not stated in the MITRE record.

Resources required

  • Any type of active probing that involves non-standard packet headers requires the use of raw sockets, which is not available on particular operating systems (Microsoft Windows XP SP 2, for example). Raw socket manipulation on Unix/Linux requires root privileges. A tool capable of sending and receiving packets from a remote system.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Bypass Protection MechanismHide Activities

Affected scopes: Confidentiality, Access Control, Authorization

CAPEC-323: TCP (ISN) Counter Rate Probe — DayBreach Saldırı Sözlüğü · DayBreach