TCP Sequence Number Prediction

In early April, we posted the (incomplete, but thoroughly documented) source to a program which performed the sequence number attack, as allegedly used by Kevin Mitnick against Tsutomu Shimomura's computers, to the bugtraq mailing list. Here is a copy of that source, as well as a description of the attack written by Tsutomu.

As is, the code will not compile. It's reliant upon a low level library which sends and received packets through a packet filter. We posted the incomplete code as protection from having every unsophisticated hacker with the ability to exploit a vulnerability which really hasn't been addressed by computer vendors. It's value therefore is primarily as an educational tool to system administrators who'd like to know how such an attack is implemented.

Since we posted it, there have been several requests from people responsible for security at their sites, as well as tiger teams, for the full compileable source code. We've decided to sell the compileable source code for several reasons.

  1. It limits its distribution to only those who have a large enough need to pay for it.
  2. It limits our liability as we require each customer to sign a license agreement which states that the software will only be used for official purposes on authorized networks.

The code compiles on any SunOS 4.x and Solaris 2.x machine. It's probably portable to any other machine which supports BPF, NIT, or DLPI packet filters.

There is NO warranty for this code. It may work on your network, it may not. If it doesn't work, that's probably a good thing. :-) It does, however, work for us on our network of 2 Suns, 1 NetBSD machine, and a NeXT.

The software is $250 for the complete source, for non-commercial purposes. If you're a consultant and are planning on using it to test your customers' networks, please contact us.


En Garde Systems, Inc.
2101 Whitecloud St., NE
Albuquerque, NM 87112
(505) 275-8655
(505) 275-8482 (Fax)
info@EnGarde.com