Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The authors uncover a class of cross-app network attacks where an unprivileged client-side application collaborates with a remote off-path adversary to bypass TCP initial sequence number (ISN) and DNS UDP source port randomization across all major operating systems. By exploiting standard OS primitives—such as socket `bind()` semantics, IP options, cBPF, and deterministic flaws in kernel ISN generation algorithms—the off-path attacker accurately infers active connection states without requiring elevated privileges. The attack achieves full TCP connection hijacking and DNS cache poisoning on Linux, Android, Windows, macOS, and iOS, prompting upstream security patches across major OS vendors.
Unprivileged local processes can collude with remote off-path attackers to break modern TCP sequence and UDP port randomization, enabling silent connection hijacking and DNS cache poisoning across every major operating system.
Off-path network attacks against TCP and DNS (over UDP) client-server connections are generally considered impractical nowadays, due to built-in security features in these protocols, e.g. randomized TCP (initial) sequence numbers and randomized UDP source ports, respectively. In this work, we refute this presumption by demonstrating that an unprivileged malicious application running on the client (but practically off-path), when combined with a remote off-path adversary, can enable powerful network attacks against such connections. We show how such a local--remote collaboration between the malicious application and a remote adversary allows inference of sensitive connection state, including TCP sequence numbers and DNS stub-resolver UDP source ports. Our attacks exploit standard socket API calls such as bind(), protocol mechanisms such as IP options, and operating system features such as cBPF and procfs to infer the TCP initial sequence number (ISN) and the UDP source port in use by the connection of interest. Specifically, we take advantage of certain properties of the ISN generation algorithm as implemented in major operating systems. We demonstrate TCP connection hijacking in Linux, Android, Windows, macOS and iOS, and DNS cache poisoning against Windows, Android and the popular systemd-resolved DNS stub resolver in Linux. We evaluate our techniques across multiple operating systems and realistic deployment settings, including environments behind port-preserving NAT-integrated routers. We disclosed our techniques to Microsoft, Apple, Linux and Google, which led to the release of several patches.