Off-path & side-channel attacks¶

Attack pattern¶

An on-path attacker sees the packets. An off-path one does not, and attacks anyway. The trick is inference: a shared counter that ticks differently depending on a secret, a reply that comes back a shade faster on a right guess, a rate limit that reveals whether a probe landed. From outside the connection an attacker pokes it, watches the side effects, and reconstructs the sequence number or session state it was never shown, then injects into or resets a session it could not read. Nothing is intercepted; it is worked out.

1. Off-path & side-channel attacks [AND]

    1.1 Blind in-window exploit [OR]
    
        1.1.1 NAT slipstreaming variants
            1.1.1.1 Protocol impersonation through packet injection
            1.1.1.2 HTTP header manipulation for session establishment
            1.1.1.3 SIP message injection for protocol bypass
            1.1.1.4 FTP PORT command abuse for connection manipulation
            
        1.1.2 Protocol downgrade attacks
            1.1.2.1 QUIC-to-TCP fallback exploitation
            1.1.2.2 TLS version downgrade manipulation
            1.1.2.3 Encryption protocol weakening attacks
            1.1.2.4 Forced protocol regression to vulnerable versions
            
    1.2 Side-channel data extraction [OR]
    
        1.2.1 TCP timestamp analysis
            1.2.1.1 Clock skew measurement for system identification
            1.2.1.2 Packet timing analysis for sequence prediction
            1.2.1.3 Throughput estimation for congestion inference
            1.2.1.4 Response timing for state detection
            
        1.2.2 Application data correlation
            1.2.2.1 BGP update timing correlation
            1.2.2.2 Route advertisement pattern analysis
            1.2.2.3 Session establishment timing attacks
            1.2.2.4 Protocol message size analysis
            
        1.2.3 Encrypted traffic classification
            1.2.3.1 Packet size distribution analysis
            1.2.3.2 Inter-packet timing characteristics
            1.2.3.3 Flow duration and behaviour patterns
            1.2.3.4 Machine learning-based traffic analysis
            
    1.3 Cache-based attacks [OR]
    
        1.3.1 CPU cache timing attacks
            1.3.1.1 Prime+probe techniques for memory access patterns
            1.3.1.2 Flush+reload for shared memory exploitation
            1.3.1.3 Evict+time for cryptographic operation detection
            1.3.1.4 Microarchitectural data sampling attacks
            
        1.3.2 Branch prediction exploitation
            1.3.2.1 Spectre-variant attacks on network stacks
            1.3.2.2 Indirect branch prediction manipulation
            1.3.2.3 Speculative execution side-channels
            1.3.2.4 Transient execution vulnerabilities
            

Guessed, not intercepted¶

Systems leak. Even encrypted ones give off timing, counters and error behaviour that correlate with what they hold.
Protocols are feature-rich, and features interact in ways that expose state indirectly.
Implementations rarely close every side channel: the obvious data path gets hardened, the incidental one does not.
Hardware optimisations create predictable patterns, and predictability is what an inference attack feeds on.
Shared resources under cloud tenancy leak across the boundary between tenants.
Measurement keeps improving, and signals once too faint to read become readable.