<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 1 feb. 2014, at 12:54, Alexander Holler <<a href="mailto:holler@ahsoftware.de">holler@ahsoftware.de</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Am 01.02.2014 12:46, schrieb Thijs Alkemade:<br><blockquote type="cite"><br>On 1 feb. 2014, at 10:47, Alexander Holler <<a href="mailto:holler@ahsoftware.de">holler@ahsoftware.de</a>> wrote:<br><br><blockquote type="cite">Am 31.01.2014 22:51, schrieb Thijs Alkemade:<br><br><blockquote type="cite">These use an incrementing counter to generate ids, starting from 0. This means<br>that, for example, roster retrieval always gets the same id and could be<br>spoofed by a fast enough attacker:<br></blockquote><br>Could you elaborate how that attacker does send those spoofed stanzas?<br></blockquote><br>Okay, "fast enough" isn't really accurate, you need to cheat to be faster<br>than someone's own server.<br><br>Suppose I want to target someone and I know the server they use, the account<br>there, the fixed resource they have set and that I have control over the<br>network my target is using.<br><br>I can see there's an outgoing connection to an XMPP server, but it's using TLS<br>so I can't directly manipulate it. However, the initial packets on a stream<br>usually have a set ordering, depending on the client. If I know the roster<br>retrieval is always the 3rd iq packet, and always the 7th TLS packet, then I<br>can delay the 7th TLS packet while I send an new packet to the target's<br>server:<br></blockquote><br>Hmm, How you do replace a packet in a TLS stream?<br><br>I don't consider the id (or even the resource name as mentioned in another mail) as part of the security concept of XMPP.<br><br>If you are able to inject or replace packets in a stream, almost everything can be done.<br><br>Maybe I miss something important here.<br></div></blockquote><br></div><div><div><div>I don’t replace the packet, try to read what I write.</div><div><br></div><div>I only *delay* one TLS packet to give me enough time to send a reply before</div><div>the query arrives at the server.</div><div><br></div><div>Thijs</div><div><br></div></div></div></body></html>