  We show how an off-path (spoofing-only) attacker can perform cross-site
scripting (XSS), cross-site request forgery (CSRF) and site spoofing/defacement
attacks, without requiring vulnerabilities in either web-browser or server and
circumventing known defenses. Attacker can also launch devastating denial of
service (DoS) attacks, even when the connection between the client and the
server is secured with SSL/TLS. The attacks are practical and require a puppet
(malicious script in browser sandbox) running on a the victim client machine,
and attacker capable of IP-spoofing on the Internet. Our attacks use a
technique allowing an off-path attacker to learn the sequence numbers of both
client and server in a TCP connection. The technique exploits the fact that
many computers, in particular those running Windows, use a global IP-ID
counter, which provides a side channel allowing efficient exposure of the
connection sequence numbers. We present results of experiments evaluating the
learning technique and the attacks that exploit it. Finally, we present
practical defenses that can be deployed at the firewall level; no changes to
existing TCP/IP stacks are required.
