Attack tree (TCP)¶

1. Compromise TCP sessions [OR]

    1.1 Connection hijacking [OR]

        1.1.1 Sequence number exploitation [OR]
            1.1.1.1 Off-path ISN prediction via timestamp leaks
            1.1.1.2 In-window guessing due to poor ISN randomisation

        1.1.2 RST and FIN injection [OR]
            1.1.2.1 Spoof RST packets to tear down active connections
            1.1.2.2 FIN spoofing for covert session termination

    1.2 Session establishment attacks [OR]

        1.2.1 SYN-based resource exhaustion
            1.2.1.1 SYN flood to exhaust the half-open connection table

        1.2.2 Authentication bypass [OR]
            1.2.2.1 Exploit TCP-MD5 weaknesses (brute force, implementation flaws)
            1.2.2.2 Race session establishment before authentication completes
            1.2.2.3 Extract or exploit TCP-AO keys (side-channel, key theft, fallback abuse)

    1.3 Off-path and side-channel attacks [OR]

        1.3.1 Blind in-window injection [OR]
            1.3.1.1 NAT slipstreaming variants to inject through middleboxes
            1.3.1.2 Protocol downgrade to bring target onto exploitable transport

        1.3.2 Side-channel data extraction [OR]
            1.3.2.1 TCP timestamp analysis to infer host state or sequence numbers
            1.3.2.2 Encrypted traffic classification for target identification

2. Transport-layer service disruption [OR]

    2.1 Resource exhaustion [OR]

        2.1.1 SACK-based attacks [OR]
            2.1.1.1 Craft packets with excessive SACK blocks to force disproportionate kernel memory allocation
            2.1.1.2 SACK-based kernel memory corruption (e.g., CVE-2019-11477)

        2.1.2 Amplification and reflection [OR]
            2.1.2.1 TCP middlebox reflection
            2.1.2.2 ACK/PSH flood to consume target processing resources

    2.2 Stateful device bypass [OR]

        2.2.1 Firewall and monitoring evasion [OR]
            2.2.1.1 Fragmentation overlap attacks to bypass stateful inspection
            2.2.1.2 Crafted TCP segmentation evasion past cloud load balancers

        2.2.2 TCP Fast Open exploitation
            2.2.2.1 TFO cache poisoning to bypass security controls or inject packets

        2.2.3 Cloud instance resource exhaustion
            2.2.3.1 Exhaust cloud instance resources hosting network services

    2.3 Keepalive and timer abuse [OR]

        2.3.1 Hold timer attacks
            2.3.1.1 Delay TCP ACKs to expire application-layer keepalive timers

        2.3.2 Persist timer exploitation
            2.3.2.1 Force zero-window conditions to exhaust CPU through timer handling

        2.3.3 Retransmission storm
            2.3.3.1 Induce excessive retransmissions via selective packet loss

3. Cross-protocol exploitation [OR]

    3.1 BGP via TCP weaknesses [OR]

        3.1.1 Router OS TCP stack compromise [AND]
            3.1.1.1 TCP stack RCE via vendor-specific flaws (JunOS, IOS XR)
            3.1.1.2 Persistent BGP route manipulation after OS compromise

        3.1.2 BGP session attacks [OR]
            3.1.2.1 Sequence prediction to inject malicious BGP UPDATE messages
            3.1.2.2 Subvert BGP graceful restart via spoofing or memory exhaustion

        3.1.3 Man-in-the-middle at transport layer [OR]
            3.1.3.1 ARP/DNS spoofing to redirect BGP traffic through attacker position
            3.1.3.2 BGP peering over unencrypted IXP links
            3.1.3.3 Route reflector compromise for iBGP-wide route injection

        3.1.4 Supply chain and infrastructure [OR]
            3.1.4.1 Backdoored router firmware or software images
            3.1.4.2 Compromised network management software
            3.1.4.3 Pre-installed weak TCP-AO keys in vendor equipment

        3.1.5 BGP-layer persistence and evasion [OR]
            3.1.5.1 Time-based hijacking (micro-duration announcements)
            3.1.5.2 Geographic-specific route manipulation
            3.1.5.3 Mimicking legitimate AS-path patterns
            3.1.5.4 Exploitation of RPKI 'unknown' validation state
            3.1.5.5 Leveraging peer conflicts for route ambiguity
            3.1.5.6 Adaptive attack timing based on monitoring gaps

    3.2 Multi-protocol chaining [OR]

        3.2.1 TCP to application-layer attacks [OR]
            3.2.1.1 Session hijacking to inject data into application sessions
            3.2.1.2 Protocol downgrade enabling plaintext session attacks

    3.3 Coordinated multi-vector attacks [OR]

        3.3.1 Chained TCP/BGP exploitation [AND]
            3.3.1.1 Initial access via TCP stack vulnerability
            3.3.1.2 Privilege escalation to BGP process
            3.3.1.3 Persistent route manipulation
            3.3.1.4 TCP-AO key material extraction for future sessions

        3.3.2 Distributed session attacks [OR]
            3.3.2.1 Distributed TCP sequence prediction across multiple sources
            3.3.2.2 Synchronised BGP session reset attacks across multiple peers
            3.3.2.3 Cross-platform exploitation campaigns