The origins of the Idle Scan
antirez.com
antirez.com
https://seclists.org/bugtraq/1998/Dec/79
Antirez should be humble to his younger self, even with Redis under his belt now.
For a person who has been computing for many years, but who is epically uninterested in security, it would have been great with a short and clear description of the attack. I think I understand everything mentioned yet fail to see the danger.
Edit: wikipedia to the rescue [1].
Edit2: typos/grammar.
The short version is that it lets an attacker on machine A determine whether machine B has a port open, without needing to actually receive a response from B. This is done by creating a SYN packet destined for machine B, but with a false source of some innocent victim machine C. If the port is open, machine B will "respond" to machine C with a SYN/ACK.
Machine C thinks machine B is trying to talk to someone else, and so responds with a RST packet. This increments machine C's packet counter, which can be queried as described in the article.
This allows the attacker on machine A to enumerate the services offered by machine B ("port scan"), without leaving any record on B that is traceable to machine A. There are some targets (e.g. law enforcement) that can take umbrage at being port scanned, and try to do something about it.
It doesn't super work today, because modern operating systems use unpredictable packet IDs. This makes the query from A to C ineffective.
At this point there is so much "Internet Background Radiation" of constant port scanning and everyone has just accepted that you are being constantly scanned by, say, Shodan and it's ilk that this threat doesn't seem super-alarming. Back in the 1990's- when SSL wasn't everywhere, and telnet was still a thing- someone who could silently find your attempt at security-through-obscurity 'I moved telnet to port 2525" nonsense that was still done pretty regularly in 1998- was a big deal.
Is this Wikipedia entry up-to-date. On NetBSD, there is a sysctl to randomise IPID.