CAPEC-324: TCP (ISN) Sequence Predictability Probe
Description
This type of operating system probe attempts to determine an estimate for how predictable the sequence number generation algorithm is for a remote host. Statistical techniques, such as standard deviation, can be used to determine how predictable the sequence number generation is for a system. This result can then be compared to a database of operating system behaviors to determine a likely match for operating system and version.
- Likelihood of attack
- Medium
- Typical severity
- Low
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.
Consequences
- Confidentiality
Read Data
- ConfidentialityAccess ControlAuthorization
Bypass Protection Mechanism; Hide Activities
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.