Casinos Not On Gamstop Non Gamstop Casinos Casinos Not On Gamstop Online Casinos UK Non Gamstop Casino

%!PS (but not EPSF; comments have been disabled) %DVIPSCommandLine: dvips -o doc.ps doc.dvi %DVIPSParameters: dpi=600, compressed, comments removed %DVIPSSource: TeX output 1995.04.24:1421 /TeXDict 250 dict def TeXDict begin /N{def}def /B{bind def}N /S{exch}N /X{S N}B /TR{translate}N /isls false N /vsize 11 72 mul N /hsize 8.5 72 mul N /landplus90{false}def /@rigin{isls{[0 landplus90{1 -1}{-1 1} ifelse 0 0 0]concat}if 72 Resolution div 72 VResolution div neg scale isls{landplus90{VResolution 72 div vsize mul 0 exch}{Resolution -72 div hsize mul 0}ifelse TR}if Resolution VResolution vsize -72 div 1 add mul TR[matrix currentmatrix{dup dup round sub abs 0.00001 lt{round}if} forall round exch round exch]setmatrix}N /@landscape{/isls true N}B /@manualfeed{statusdict /manualfeed true put}B /@copies{/#copies X}B /FMat[1 0 0 -1 0 0]N /FBB[0 0 0 0]N /nn 0 N /IE 0 N /ctr 0 N /df-tail{ /nn 8 dict N nn begin /FontType 3 N /FontMatrix fntrx N /FontBBox FBB N string /base X array /BitMaps X /BuildChar{CharBuilder}N /Encoding IE N end dup{/foo setfont}2 array copy cvx N load 0 nn put /ctr 0 N[}B /df{ /sf 1 N /fntrx FMat N df-tail}B /dfs{div /sf X /fntrx[sf 0 0 sf neg 0 0] N df-tail}B /E{pop nn dup definefont setfont}B /ch-width{ch-data dup length 5 sub get}B /ch-height{ch-data dup length 4 sub get}B /ch-xoff{ 128 ch-data dup length 3 sub get sub}B /ch-yoff{ch-data dup length 2 sub get 127 sub}B /ch-dx{ch-data dup length 1 sub get}B /ch-image{ch-data dup type /stringtype ne{ctr get /ctr ctr 1 add N}if}B /id 0 N /rw 0 N /rc 0 N /gp 0 N /cp 0 N /G 0 N /sf 0 N /CharBuilder{save 3 1 roll S dup /base get 2 index get S /BitMaps get S get /ch-data X pop /ctr 0 N ch-dx 0 ch-xoff ch-yoff ch-height sub ch-xoff ch-width add ch-yoff setcachedevice ch-width ch-height true[1 0 0 -1 -.1 ch-xoff sub ch-yoff .1 sub]/id ch-image N /rw ch-width 7 add 8 idiv string N /rc 0 N /gp 0 N /cp 0 N{rc 0 ne{rc 1 sub /rc X rw}{G}ifelse}imagemask restore}B /G{{id gp get /gp gp 1 add N dup 18 mod S 18 idiv pl S get exec}loop}B /adv{cp add /cp X}B /chg{rw cp id gp 4 index getinterval putinterval dup gp add /gp X adv}B /nd{/cp 0 N rw exit}B /lsh{rw cp 2 copy get dup 0 eq{pop 1}{ dup 255 eq{pop 254}{dup dup add 255 and S 1 and or}ifelse}ifelse put 1 adv}B /rsh{rw cp 2 copy get dup 0 eq{pop 128}{dup 255 eq{pop 127}{dup 2 idiv S 128 and or}ifelse}ifelse put 1 adv}B /clr{rw cp 2 index string putinterval adv}B /set{rw cp fillstr 0 4 index getinterval putinterval adv}B /fillstr 18 string 0 1 17{2 copy 255 put pop}for N /pl[{adv 1 chg} {adv 1 chg nd}{1 add chg}{1 add chg nd}{adv lsh}{adv lsh nd}{adv rsh}{ adv rsh nd}{1 add adv}{/rc X nd}{1 add set}{1 add clr}{adv 2 chg}{adv 2 chg nd}{pop nd}]dup{bind pop}forall N /D{/cc X dup type /stringtype ne{] }if nn /base get cc ctr put nn /BitMaps get S ctr S sf 1 ne{dup dup length 1 sub dup 2 index S get sf div put}if put /ctr ctr 1 add N}B /I{ cc 1 add D}B /bop{userdict /bop-hook known{bop-hook}if /SI save N @rigin 0 0 moveto /V matrix currentmatrix dup 1 get dup mul exch 0 get dup mul add .99 lt{/QV}{/RV}ifelse load def pop pop}N /eop{SI restore userdict /eop-hook known{eop-hook}if showpage}N /@start{userdict /start-hook known{start-hook}if pop /VResolution X /Resolution X 1000 div /DVImag X /IE 256 array N 0 1 255{IE S 1 string dup 0 3 index put cvn put}for 65781.76 div /vsize X 65781.76 div /hsize X}N /p{show}N /RMat[1 0 0 -1 0 0]N /BDot 260 string N /rulex 0 N /ruley 0 N /v{/ruley X /rulex X V}B /V {}B /RV statusdict begin /product where{pop product dup length 7 ge{0 7 getinterval dup(Display)eq exch 0 4 getinterval(NeXT)eq or}{pop false} ifelse}{false}ifelse end{{gsave TR -.1 .1 TR 1 1 scale rulex ruley false RMat{BDot}imagemask grestore}}{{gsave TR -.1 .1 TR rulex ruley scale 1 1 false RMat{BDot}imagemask grestore}}ifelse B /QV{gsave newpath transform round exch round exch itransform moveto rulex 0 rlineto 0 ruley neg rlineto rulex neg 0 rlineto fill grestore}B /a{moveto}B /delta 0 N /tail {dup /delta X 0 rmoveto}B /M{S p delta add tail}B /b{S p tail}B /c{-4 M} B /d{-3 M}B /e{-2 M}B /f{-1 M}B /g{0 M}B /h{1 M}B /i{2 M}B /j{3 M}B /k{ 4 M}B /w{0 rmoveto}B /l{p -4 w}B /m{p -3 w}B /n{p -2 w}B /o{p -1 w}B /q{ p 1 w}B /r{p 2 w}B /s{p 3 w}B /t{p 4 w}B /x{0 S rmoveto}B /y{3 2 roll p a}B /bos{/SS save N}B /eos{SS restore}B end TeXDict begin 40258431 52099146 1000 600 600 (doc.dvi) @start /Fa 78 123 df<90383C03C090387E07E0A7EBFE0F01FC13C0A2003FB512FC48 14FEB7FCA36C14FE3901F81F80AC007FB512FEB7FCA36C14FE6C14FC3903F03F00A20007 5BEBE07EA73803C03C202E7DAD27>35 D<120FEA1FC0123F13E0A213F0121F120F1201A4 120313E01207EA0FC0A2EA3F80EA7F005A5A12F812700C1773AD27>39 DI<127012F812FE7E6C7E6C7EEA0FE06C7E12037F6C7E 1200137EA27FA2EB1F80A3EB0FC0A4EB07E0ACEB0FC0A4EB1F80A3EB3F00A2137EA25B12 01485A5B1207485AEA3FC0485A48C7FC5A12F81270133A7AB327>I<130F497EA60078EB 81E000FEEB87F000FF138FEBDFBF6CB512E06C14C0000F1400000313FCC613F0A2000313 FC000F13FF003F14C04814E039FFDFBFF0EB1F8F00FE13870078EB81E00000EB8000A66D C7FC1C207BA627>I<120FEA3FC013E0EA7FF0A213F8A2123FA2120F120113F01203EA07 E0121FEA7FC0EAFF8013005A12700D14738927>44 D<121EEA7F80A2EAFFC0A4EA7F80A2 EA1E000A0A728927>46 D<1538157C15FCA2140115F8140315F0140715E0140F15C0141F 1580143F1500A25C147E14FE5C13015C13035C13075C130F5CA2131F5C133F91C7FC5B13 7E13FE5B12015B12035BA212075B120F5B121F5B123F90C8FC5A127E12FE5AA25A12781E 3A7CB327>II<130E131FA25B5BA25B5A5A127FB5FCA213BFEA7E 3F1200B3AA003FB512805A15C01580A21A2F79AE27>IIII<001FB512E04814F0A315E090C8 FCACEB1FF0EBFFFC14FF158015C09038F03FE09038C00FF0EB0007003EEB03F8001C1301 C7FC15FC1400A3127C12FEA2140115F84813036C14F0007F130F9038801FE0393FE07FC0 6CB512806C14006C5B000113F838007FC01E2F7CAD27>I<14FF010713C0011F13F04913 F890B5FC48EB81FC3803FE0113F8EA07F0EA0FE09038C000F8001F1400485A90C8FCA25A 127EEB0FF838FE3FFE48B51280B612C015E09038F80FF09038E007F890388001FC90C7FC 15FE48147E157F153FA3127EA3127F6C147F157E6C6C13FE9038C001FC120F9038F007F8 3907F81FF06CB512E06C14C06C148090383FFE00EB0FF820307DAE27>I<1278B612FE15 FFA315FE39FC0001FCEC03F8EC07F0007814E0C7120FEC1FC01580143FEC7F00147E14FE 5C13015C13035C13075CA2495AA3495AA3133F91C7FCA55B137EA9133C20307DAE27>I< EB0FF0EB7FFE48B512804814C0000F14F0EBF81F391FE007F8393F8001FC90C7FC4814FE 007E147EA56C14FCEB8001391FC003F8390FE007F03907FC3FE00001B5128039007FFE00 6D5A90B5FC000314C0390FF00FF0391FC003F8393F8001FC90C7FC007E147EA248143FA6 007E147EA2007F14FE393F8001FC391FE007F8EBF81F6CB512F06C14E00001148039007F FE00EB0FF020307DAE27>II<121EEA7F80A2EAFFC0A4EA7F80A2EA1E00C7FCAC121EEA7F80A2EA FFC0A4EA7F80A2EA1E000A20729F27>I<120FEA3FC0A2EA7FE0A4EA3FC0A2EA0F00C7FC AC120FEA3F8013C0127F13E0A3123FA2120F120713C0120FA2EA3F80EA7F005A5A12F812 700B2A739F27>I<15101578EC01FC1403140FEC1FF8EC7FF0ECFFC0491380903807FE00 495AEB3FF0495A48485A4890C7FCEA0FFEEA1FF8EA7FF0EAFFC05BA27FEA7FF0EA1FF8EA 0FFEEA03FF6C13C06C6C7E6D7EEB0FFC6D7E903801FF806D13C0EC7FF0EC1FF8EC0FFC14 031401EC007815101E287CAA27>I<1230127812FE7E13C06C7EEA3FF8EA0FFC6C7E3801 FF806C7FEB3FF06D7EEB0FFEEB03FF6D13C09038007FE0EC3FF8EC0FFC1407A2140FEC3F F8EC7FE0903801FFC0491300EB0FFEEB1FF8495AEBFFC0485BD807FEC7FC485AEA3FF8EA 7FE0485A90C8FC5A127812301E287CAA27>62 D64 DI<007FB5FCB612C08115F87E3907E003FCEC00FE157E15 7F81A6157EA25D1403EC0FF890B55A15C015F081819038E000FE157FED3F80151FA2ED0F C0A6151F1680153FED7F004A5A007FB55AB65A5D15E06C1480222E7FAD27>I<903803F8 0E90381FFE1F90383FFFBF90B6FC5A3803FE0F3807F803497E48487E485A49137FA248C7 123FA25A127E151E150012FE5AAA7E127EA2151E007F143F7EA26C7E157F6D137E6C6C13 FE3907F001FCEBF8033903FE0FF86CB512F06C14E0013F13C06D1300EB03F820307DAE27 >I<387FFFFC14FFB612C06C80813907E00FF81407EC01FC6E7EA2157E157F811680151F A316C0150FABED1F80A3153F1600A25D15FEA24A5A4A5A140F007FB55A5DB65A6C91C7FC 14FC222E7FAD27>I<007FB61280B712C0A37E3907E0000FA6ED078092C7FCA4EC07804A 7EA390B5FCA5EBE00FA36E5A91C8FCA4ED03C0ED07E0A7007FB6FCB7FCA36C15C0232E7F AD27>I<007FB61280B712C0A37E3907E0000FA6ED078092C7FCA4EC07804A7EA390B5FC A5EBE00FA36E5A91C8FCAC387FFF80B57EA36C5B222E7EAD27>I<903807F03890381FFC 7C90387FFFFC90B5FC5A3803FC1F3807F00F380FE007EBC003001F13011380123F90C7FC A2127EA2157892C7FC5AA8EC1FFF4A1380A3007E6D1300EC00FCA36C1301A21380121FEB C003120FEBE0073807F00F3803FC1F6CB5FC7EEB7FFE90381FFC78D907F0C7FC21307DAE 27>I<3A7FFE07FFE0B54813F0A36C486C13E03A07E0007E00AF90B512FEA59038E0007E B03A7FFE07FFE0B54813F0A36C486C13E0242E7FAD27>I<007FB512E0B612F0A36C14E0 39001F8000B3B2007FB512E0B612F0A36C14E01C2E7BAD27>I<90381FFFF84913FCA36D 13F89038001F80B3AC127CA212FEA2EC3F005C387F81FE13FF6C5B6C5B000713E0C690C7 FC1E2F7BAD27>I<3A7FFC07FF8016C0486C5A6C487E16803A07C001F80014035D4A5A4A 5A141F5D4AC7FC147E14FE5CEBC1F8EBC3F013C75CEBCFF0EBDFF813FF8013FEEBFC7E14 3EEBF83F497E01E07F140F01C07F1407811403816E7EA26E7E157C157E3A7FFC01FFC016 E0486C5A6C487E16C0232E7FAD27>I<387FFFC080B5FC7E5CD803F0C8FCB3AAED0780ED 0FC0A7007FB6FCA2B7FC7E1680222E7FAD27>II<3A7FF003FFE0486C4813F0A213FC007F6D13E000079038003E0013DEA313 CFA3148013C714C0A213C314E0A213C114F0A3EBC0F8A31478147CA2143C143EA2141E14 1F140FA3EC07BEA3EC03FEEA7FFCEAFFFE1401A26C486C5A242E7FAD27>II<007FB5FCB612E081816C803907E003FEEC00FF81ED3F80151F16C0150FA6151F16 80153FED7F005DEC03FE90B55A5D5D5D92C7FC01E0C8FCADEA7FFEB5FCA36C5A222E7FAD 27>I<387FFFF0B512FE6E7E816C803907E01FF014076E7E1401811400A514015D14034A 5A141F90B55A5D5DA281EBE01F6E7E14076E7EA816F0EDF1F8A4397FFE01FBB5EBFFF080 16E06C48EB7FC0C8EA1F00252F7FAD27>82 D<90387FC0E03901FFF1F0000713FF5A5AEA 3FE0EB801F387F000F007E130712FE5A1403A3EC01E06C90C7FC127E127FEA3FC013F86C B47E6C13F86C13FE6CEBFF80C614C0010F13E0010013F0140FEC07F81403140115FC1400 127812FCA46CEB01F8A26C130390388007F09038F01FE090B5FC15C0150000F85B38701F F81E307CAE27>I<007FB61280B712C0A439FC03F00FA60078EC0780000091C7FCB3AB90 B512C04880A36C5C222E7EAD27>I<3A7FFE01FFF8B54813FCA36C486C13F83A07E0001F 80B3AB6D133F00031500A26D5B0001147E6D13FE6C6C485A90387F87F814FF6D5B010F13 C06D5BD901FEC7FC262F80AD27>I<3A7FFC03FFE06D5A00FF15F0007F15E0497E3A07E0 007E00A46C6C5BA4EBF80100015CA46C6C485AA490387E07E0A56D485AA4011F5B149FA3 010F90C7FCA5EB07FEA46D5AA26D5A242F7FAD27>II<393FFC1FFE387FFE3F815D383FFC1F3903F00FE001F85B1201EBFC1F00 005CEBFE3F017E90C7FCEB7F7FEB3F7E14FE6D5AA26D5AA26D5AA21303130780130F8013 1F80EB3F7E147F497E017E7F141F01FC7F140FD801F87F14071203496C7E120701E07F3A 7FFC0FFF8000FF15C06D5A497E007F1580222E7EAD27>I<3A7FFC03FFE06D5A00FF15F0 007F15E0497E3A07F000FE0000035CEBF80100015CA2EBFC0300005CEBFE07017E5BA26D 485AA290381F9F80A3010F90C7FCA2EB07FEA26D5AA26D5AAF90381FFF80497FA36D5B24 2E7FAD27>I<387FFFF0B512F8A314F000FCC7FCB3B3ACB512F014F8A36C13F0153A71B3 27>91 D<127812F87EA27E127E127F7E7F121F7F120F7F12077F1203A27F12017F12007F 137E137F7F80131F80130FA280130780130380130180130080147E147F80A21580141F15 C0140F15E0140715F0140315F8140115FC1400A2157C15381E3A7CB327>I<387FFFF0B5 12F8A37EEA0001B3B3ACEA7FFFB5FCA36C13F0153A7EB327>I<131C137E3801FF800007 13E0001F13F84813FC38FFE7FF13C3130000FC133F0078131E180B79AD27>I<007FB512 F8B612FCA46C14F81E067C7E27>I<3803FFC0000F13F04813FC4813FF811380EC1FC038 1F000F000480C71207A2EB0FFF137F0003B5FC120F5A383FFC07EA7FC0130012FE5AA46C 130F007F131FEBC0FF6CB612806C15C07E000313F1C69038807F8022207C9F27>97 DI IIII<153F90391FC0FF80D97FF313C048B612E05A4814EF390FF0 7F873A1FC01FC3C0EDC000EB800F48486C7EA66C6C485AEBC01FA2390FF07F8090B5C7FC 5C485BEB7FF0EB1FC090C9FCA27F6CB5FC15E015F84814FE4880EB8001007EC7EA3F8000 7C140F00FC15C0481407A46C140F007C1580007F143F6C6CEB7F009038F807FF6CB55A00 0714F86C5CC614C0D90FFCC7FC23337EA027>II<130F497E497EA46D5A6DC7FC90C8FCA7383FFF80487FA37EEA 000FB3A4007FB512F0B6FC15F815F07E1D2F7BAE27>I<143C147E14FFA4147E143C1400 A73801FFFE4813FFA37EC7123FB3B0147E1238007C13FE38FE01FC1303B512F814F06C13 E06C13803807FE0018407CAE27>II<387FFF80B57EA37EEA000FB3B2007FB512F8B612FCA36C14F81E 2E7CAD27>I<397F07C01F3AFF9FF07FC09039FFF9FFE091B57E7E3A0FFC7FF1F89038F0 3FC001E0138001C01300A3EB803EB03A7FF0FFC3FF486C01E3138001F913E701F813E36C 4801C313002920819F27>I<387FE07F39FFF1FFC001F713F090B5FC6C80000313C1EC01 FCEBFE005B5BA25BB03A7FFF83FFE0B500C713F0A36C018313E024207F9F27>II<387FE0FFD8FFF313C090B512F081 6C800003EB81FE49C67E49EB3F8049131F16C049130FA216E01507A6150F16C07F151F6D EB3F80157F6DEBFF009038FF83FEECFFFC5D5D01F313C0D9F0FEC7FC91C8FCAC387FFF80 B57EA36C5B23317F9F27>I<90380FF03C90383FFE7E90B5FC000314FE5A380FFC1F381F E007EBC003383F800148C7FC127EA200FE147E5AA67E007E14FEA2007F1301EA3F80EBC0 03381FE007380FF81F6CB5FC7E6C147E38007FFCEB0FF090C7FCAC91381FFFF8A24A13FC 6E13F8A226317E9F27>I<397FFC03FC39FFFE0FFF023F13804A13C0007F90B5FC39007F FE1F14F89138F00F809138E002004AC7FC5CA291C8FCA2137EAD007FB57EB67EA36C5C22 207E9F27>I<9038FFF3800007EBFFC0121F5A5AEB803F38FC000F5AA2EC07806C90C7FC EA7F8013FC383FFFF06C13FC000713FF00011480D8000F13C09038003FE014070078EB03 F000FC1301A27E14036CEB07E0EBE01F90B512C01580150000FB13FC38707FF01C207B9F 27>I<133C137EA8007FB512F0B612F8A36C14F0D8007EC7FCAE1518157EA415FE6D13FC 1483ECFFF86D13F06D13E0010313C0010013001F297EA827>I<397FE01FF8486C487EA3 007F131F00031300B21401A21403EBFC0F6CB612E016F07EEB3FFE90390FF87FE024207F 9F27>I<3A7FFC0FFF80486C4813C0A36C486C13803A07C000F800EBE00100035CA2EBF0 0300015CA2EBF80700005CA390387C0F80A36D48C7FCA3EB3F3FEB1F3EA214FE6D5AA36D 5AA26D5A22207E9F27>I<3A7FFE07FFE000FF15F06D5A497E007F15E03A0F80001F00A3 6D5B0007143EA414F0EBC1F83903E3FC7CA4EBE79EA200011478A301F713F8A2EBFF0F6C 5CA3EBFE0790387C03E024207F9F27>I<393FFC1FFF486C5A168016006C487E3901F807 E06C6C485A4A5A017E90C7FC6D5AEB1F7E5C6D5A13076D5A5C80497E130F497E143EEB3E 3FEB7E1F90387C0F8001F87F00016D7E3803F0033A7FFE1FFF80A2B54813C06C486C1380 A222207E9F27>I<3A7FFC0FFF80486C4813C0A36C486C13803A07E000F800000313015D 13F00001130301F85B1200A26D485A137CA290387E0F80133EA2011F90C7FC5CA2130F14 9E14BE130714FC1303A25C1301A25CA213035CA213075C1208EA3E0F007F5B131FD87E7F C8FCEA7FFE6C5A5B6C5AEA07C022317E9F27>I<001FB512FE4814FFA490380001FEEC03 FCEC07F8EC0FF0001EEB1FE0C7EA3FC0EC7F80ECFF00495A495A495AEB1FE0495A495A49 C7FC485A4848131E4848133F485A485A485A485AB7FCA46C14FE20207E9F27>I E /Fb 1 49 df48 D E /Fc 1 49 df<13E0EA01F0EA03F8A3EA 07F0A313E0A2120F13C0A3EA1F80A21300A25A123EA35AA3127812F8A25A12100D1E7D9F 13>48 D E /Fd 50 122 df12 D<3901E003C03907F00FE0000F131F01F813F0001F133FA3000F13 1F3907B00F6038003000A2017013E0016013C0EBE00101C0138000011303018013000003 5B3807000E000E5B485B485B485B48485A00C05B1C1971B92B>34 D<387FFFF8A2B5FCA214F0150579941E>45 D<120EEA3F80127F12FFA31300127E123C09 09778819>I<1703EF0780170FA2EF1F005F173E5FA25FA24C5A16035F4C5AA24C5AA24C C7FCA2163E167E167C5EA24B5AA24B5A15075E4B5AA24BC8FCA2153E157E157C5DA24A5A A24A5A14075D4A5AA24AC9FCA2143EA25C14FC5C495AA2495AA2495A130F5C49CAFCA213 3EA25B13FC5B485AA2485AA2485A120F5B48CBFCA2123EA25AA25AA2127031537FBD2A> I50 D<16E0ED01F01503A3150716E0A3150F16C0A2151F1680A2ED3F00A3157EA2157C15FC5D 14015D14035D14075D140F5D141F92C7FC143EA25CECF81C153E903801F07EEB03E014C0 90380780FE130F49485A133EEB7C01137801F05BEA01E03803C003EA0FFE391FFFC3F048 13FB267C01FF13403AF0003FFFE000601307C71400EC0FE05DA3141F5DA3143F92C7FCA4 143E141C24487DB72A>52 D<133C137E13FF5AA313FE13FCEA00701300B2120EEA3F8012 7F12FFA31300127E123C102477A319>58 D65 D<0107B612FCEFFF8018C0903B000FF0001FF04BEB07F81703021F15FC17014B14FE A2023F1400A24B1301A2147F18FC92C7120318F84A140718F04AEC0FE0EF1FC00101ED3F 80EF7F004AEB01FEEE07F849B612E05F9139F80007F0EE01FC01076E7E177F4AEC3F80A2 010F16C0171F5CA2131F173F5CA2133FEF7F805C1800017F5D4C5A91C7485A5F49140FEE 1FE0494A5A00014AB45AB748C7FC16F816C037397BB83A>II<0103B612FEEFFFC018F0903B00 07F8000FF84BEB03FCEF00FE020F157FF03F804B141F19C0021F150F19E05D1807143F19 F05DA2147FA292C8FCA25C180F5CA2130119E04A151FA2130319C04A153FA20107178018 7F4A1600A2010F16FEA24A4A5A60011F15034D5A4A5D4D5A013F4B5A173F4A4AC7FC17FC 017FEC03F84C5A91C7EA1FC04949B45A007F90B548C8FCB712F016803C397CB83F>I<01 07B8FCA3903A000FF000034BEB007F183E141F181E5DA2143FA25D181C147FA292380003 80A24A130718004A91C7FC5E13015E4A133E167E49B512FEA25EECF8000107147C163C4A 1338A2010F147818E04A13701701011F16C016004A14031880013F150718004A5CA2017F 151E173E91C8123C177C4915FC4C5A4914070001ED7FF0B8FCA25F38397BB838>I<0107 B712FEA3903A000FF000074B1300187C021F153CA25DA2143FA25D1838147FA292C8FCEE 03804A130718004A91C7FCA201015CA24A131E163E010314FE91B5FC5EA2903807F80016 7C4A1378A2130FA24A1370A2011F14F0A24A90C8FCA2133FA25CA2137FA291CAFCA25BA2 5B487EB6FCA337397BB836>II<0103B512F8A390390007F8005DA2140FA25DA214 1FA25DA2143FA25DA2147FA292C7FCA25CA25CA21301A25CA21303A25CA21307A25CA213 0FA25CA2131FA25CA2133FA25CA2137FA291C8FC497EB6FCA25C25397CB820>73 D<0103B500F890387FFFE0A21AC090260007F8C7380FFC004B15E061020F4BC7FC183E4B 5C18F0021F4A5A4D5A4BEB0F804DC8FC023F143C5F4B5B4C5A027FEB07C04CC9FCED001E 5E4A5BED01FCECFE0315070101497E151FECFC7C4B7E903903FDE07FDAFFC07F1580ED00 3F49488014F84A131F83130F160F4A801607011F81A24A130383133F16014A80A2017F6E 7EA291C8FC494A7F007F01FE011F13FCB55CA243397CB840>75 D<0107B512FCA25E9026 000FF8C7FC5D5D141FA25DA2143FA25DA2147FA292C8FCA25CA25CA21301A25CA21303A2 5CA21307A25CA2130F170C4A141CA2011F153C17384A1478A2013F157017F04A14E01601 017F140317C091C71207160F49EC1F80163F4914FF000102071300B8FCA25E2E397BB834 >I<902603FFF891B512E0A281D90007923807F8006F6E5A61020F5E81DA0E7F5DA2021E 6D1307033F92C7FC141C82DA3C1F5C70130EEC380FA202786D131E0307141C147082DAF0 03143C70133814E0150101016E1378030014705C8201036E13F0604A1480163F010715C1 041F5B91C7FC17E149EC0FE360010E15F31607011E15FF95C8FC011C80A2013C805F1338 160013785F01F8157CEA03FC267FFFE0143CB51538A243397CB83E>78 DI<01 07B612F817FF1880903B000FF0003FE04BEB0FF0EF03F8141FEF01FC5DA2023F15FEA25D A2147FEF03FC92C7FCA24A15F817074A15F0EF0FE01301EF1FC04AEC3F80EFFE0001034A 5AEE0FF091B612C04CC7FCD907F8C9FCA25CA2130FA25CA2131FA25CA2133FA25CA2137F A291CAFCA25BA25B1201B512FCA337397BB838>I<0103B612F017FEEFFF80903B0007F8 003FC04BEB0FF01707020FEC03F8EF01FC5DA2021F15FEA25DA2143FEF03FC5DA2027FEC 07F818F092C7120F18E04AEC1FC0EF3F004A14FEEE01F80101EC0FE091B6128004FCC7FC 9138FC003F0103EC0F80834A6D7E8301071403A25C83010F14075F5CA2011F140FA25CA2 133F161F4AECE007A2017F160F180E91C7FC49020F131C007F01FE153CB5913807F07804 0313F0CAEAFFE0EF3F80383B7CB83D>82 D<92383FC00E913901FFF01C020713FC91391F C07E3C91393F001F7C027CEB0FF84A130749481303495A4948EB01F0A2495AA2011F15E0 91C7FCA34915C0A36E90C7FCA2806D7E14FCECFF806D13F015FE6D6D7E6D14E001008002 3F7F14079138007FFC150F15031501A21500A2167C120EA3001E15FC5EA3003E4A5AA24B 5AA2007F4A5A4B5A6D49C7FC6D133ED8F9F013FC39F8FC03F839F07FFFE0D8E01F138026 C003FCC8FC2F3D7ABA2F>I<0007B812E0A25AD9F800EB001F01C049EB07C0485AD90001 1403121E001C5C003C17801403123800785C00701607140700F01700485CA2140FC792C7 FC5DA2141FA25DA2143FA25DA2147FA292C9FCA25CA25CA21301A25CA21303A25CA21307 A25CA2130FA25CEB3FF0007FB512F8B6FCA2333971B83B>I<003FB539800FFFFEA32600 7F80C7EA7F8091C8EA3F00173E49153CA2491538A20001167817705BA2000316F05F5BA2 000715015F5BA2000F15035F5BA2001F150794C7FC5BA2003F5D160E5BA2007F151E161C 90C8FCA2163C4815385A16781670A216F04B5A5E1503007E4A5A4BC8FC150E6C143E6C6C 5B15F0390FC003E03907F01FC00001B5C9FC38007FFCEB1FE0373B70B83E>I87 D<49B5D8F007B5FCA3D9000790 C713E0DA03FCEC7F00187C020115786F5C4D5A02005D6F495A4DC7FC6F5BEE801E5F033F 5BEEC0705F92381FC1C016E3EEE780DB0FEFC8FC16FE6F5A5EA2150382A2150782150F15 1CED3CFF5D4B7EDA01E07FEDC03FDA03807FEC0700020E131F021E805C4A130F0270805C 49481307494880130749C71203011E81133E01FE81D807FF1407B500E090387FFFFC93B5 FC6040397CB83E>I<01181330013813709038F001E03901C003800180130000035B3807 000E000E5B000C1318001C1338485B00301360A2007013E000605BA238EF01DE38FF81FF A66CC65A003C13781C196AB92B>92 D<14F8EB07FE90381F871C90383E03FE137CEBF801 120148486C5A485A120FEBC001001F5CA2EA3F801403007F5C1300A21407485C5AA2140F 5D48ECC1C0A2141F15831680143F1587007C017F1300ECFF076C485B9038038F8E391F0F 079E3907FE03FC3901F000F0222677A42A>97 D<133FEA1FFFA3C67E137EA313FE5BA312 015BA312035BA31207EBE0F8EBE7FE9038EF0F80390FFC07C013F89038F003E013E0D81F C013F0A21380A2123F1300A214075A127EA2140F12FE4814E0A2141F15C05AEC3F80A215 005C147E5C387801F8007C5B383C03E0383E07C0381E1F80D80FFEC7FCEA01F01C3B77B9 26>I<147F903803FFC090380FC1E090381F0070017E13784913383901F801F83803F003 120713E0120FD81FC013F091C7FC485AA2127F90C8FCA35A5AA45AA3153015381578007C 14F0007EEB01E0003EEB03C0EC0F806CEB3E00380F81F83803FFE0C690C7FC1D2677A426 >II<147F903803FFC090380FC1E090383F00F0017E13785B485A485A485A120F49 13F8001F14F0383F8001EC07E0EC1F80397F81FF00EBFFF891C7FC90C8FC5A5AA55AA215 30007C14381578007E14F0003EEB01E0EC03C06CEB0F806CEB3E00380781F83803FFE0C6 90C7FC1D2677A426>IIIII107 DII< D801E013FE3A07F803FF803A0E3C0F07C03A1E3E3C03E0261C1F787F39383FF00114E000 7813C000708114804A485AEAF07FEAE07EA20000140701FE5C5BA2150F00015D5B151F5E 12034990383F8380160316070007027F130049137EA2160E000F147C49141E161C5E001F EC3C7849EB1FE00007C7EA0780292679A42F>I<147F903803FFC090380FC1F090381F00 F8017E137C5B4848137E4848133E0007143F5B120F485AA2485A157F127F90C7FCA215FF 5A4814FEA2140115FC5AEC03F8A2EC07F015E0140F007C14C0007EEB1F80003EEB3F0014 7E6C13F8380F83F03803FFC0C648C7FC202677A42A>I<9039078007C090391FE03FF090 393CF0787C903938F8E03E9038787FC00170497EECFF00D9F0FE148013E05CEA01E113C1 5CA2D80003143FA25CA20107147FA24A1400A2010F5C5E5C4B5A131F5EEC80035E013F49 5A6E485A5E6E48C7FC017F133EEC70FC90387E3FF0EC0F8001FEC9FCA25BA21201A25BA2 1203A25B1207B512C0A3293580A42A>I<3903C003F0390FF01FFC391E783C0F381C7C70 3A3C3EE03F8038383FC0EB7F800078150000701300151CD8F07E90C7FCEAE0FE5BA21200 12015BA312035BA312075BA3120F5BA3121F5BA3123F90C9FC120E212679A423>114 D<14FE903807FF8090380F83C090383E00E04913F00178137001F813F00001130313F0A2 15E00003EB01C06DC7FC7FEBFFC06C13F814FE6C7F6D13807F010F13C01300143F141F14 0F123E127E00FE1480A348EB1F0012E06C133E00705B6C5B381E03E06CB45AD801FEC7FC 1C267AA422>II<13F8D8 03FEEB01C0D8078FEB03E0390E0F8007121E121C0038140F131F007815C01270013F131F 00F0130000E015805BD8007E133FA201FE14005B5D120149137EA215FE120349EBFC0EA2 0201131E161C15F813E0163CD9F003133814070001ECF07091381EF8F03A00F83C78E090 393FF03FC090390FC00F00272679A42D>I<01F0130ED803FC133FD8071EEB7F80EA0E1F 121C123C0038143F49131F0070140FA25BD8F07E140000E08013FEC6485B150E12015B15 1E0003141C5BA2153C000714385B5DA35DA24A5A140300035C6D48C7FC0001130E3800F8 3CEB7FF8EB0FC0212679A426>I<01F01507D803FC903903801F80D8071E903907C03FC0 D80E1F130F121C123C0038021F131F49EC800F00701607A249133FD8F07E168000E0ED00 0313FEC64849130718000001147E5B03FE5B0003160E495BA2171E00070101141C01E05B 173C1738A217781770020314F05F0003010713016D486C485A000190391E7C07802800FC 3C3E0FC7FC90393FF81FFE90390FE003F0322679A437>I<13F0D803FCEB01C0D8071EEB 03E0D80E1F1307121C123C0038140F4914C01270A249131FD8F07E148012E013FEC64813 3F160012015B5D0003147E5BA215FE00075C5BA214015DA314035D14070003130FEBF01F 3901F87FE038007FF7EB1FC7EB000F5DA2141F003F5C48133F92C7FC147E147C007E13FC 387001F8EB03E06C485A383C1F80D80FFEC8FCEA03F0233679A428>121 D E /Fe 19 127 df38 D<121FEA3F80EA7FC0EAFFE0A5EA7FC0EA3F80EA1F000B0B708A2C>46 D<1507ED0F80151FA2153F16005D157E15FE5D14015D14035DA214075D140F5D141F5D14 3F92C7FC5C147E14FE5CA213015C13035C13075C130F5C131F5CA2133F91C8FC5B137E13 FE5B12015B12035B12075BA2120F5B121F5B123F90C9FC5A127E12FE5AA25A127821417B B92C>I<127012FC7E6C7E13E06C7EEA1FFC6C7E3803FF80C67FEB7FF0EB1FF8EB0FFEEB 03FF6D13C06D6C7EEC3FF8EC0FFC6EB4FC0201138080A25C02071300EC0FFCEC3FF8EC7F E049485A4990C7FCEB0FFEEB1FF8EB7FF0EBFFC000035BD80FFEC8FC485AEA7FF0485A13 8048C9FC5A1270212A7BAD2C>62 D<903803FFE0011F13F8017F13FE48B5FC48804848C6 FCEA0FF0485A49137E4848131890C9FC5A127EA25AA8127EA2127F6C140F6DEB1F806C7E 6D133F6C6CEB7F003907FE03FF6CB55A6C5C6C6C5B011F13E0010390C7FC21247AA32C> 99 DII104 D<1307EB1FC0A2497EA36D5AA20107C7FC90C8FCA7387FFFC080B5FC7EA2 EA0007B3A8007FB512FCB612FEA36C14FC1F3479B32C>I<140EEC3F80A2EC7FC0A3EC3F 80A2EC0E0091C7FCA748B512804814C0A37EC7120FB3B3A2141F003C1480007E133FB414 005CEB01FEEBFFFC6C5B5C001F5B000790C7FC1A467CB32C>I<387FFFE0B57EA37EEA00 03B3B3A5007FB61280B712C0A36C158022337BB22C>108 D<3A7F83F007E09039CFFC1F F83AFFDFFE3FFCD87FFF13FF91B57E3A07FE1FFC3E01FCEBF83F496C487E01F013E001E0 13C0A301C01380B33B7FFC3FF87FF0027F13FFD8FFFE6D13F8D87FFC4913F0023F137F2D 2481A32C>I111 D<397FF01FE039FFF8FFF801FB13FE90B6FC6C158000019038F0 7FC09138801FE091380007F049EB03F85BED01FC491300A216FE167EA816FE6D14FCA2ED 01F86D13036DEB07F0150F9138801FE09138E07FC091B51280160001FB5B01F813F8EC3F C091C8FCAD387FFFE0B57EA36C5B27367FA32C>I114 D<90387FF8700003B512F8120F5A5A387FC00F38 7E00034813015AA36CEB00F0007F140013F0383FFFC06C13FE6CEBFF80000314E0C66C13 F8010113FCEB0007EC00FE0078147F00FC143F151F7EA26C143F6D133E6D13FE9038F007 FC90B5FC15F815E000F8148039701FFC0020247AA32C>I<131E133FA9007FB6FCB71280 A36C1500D8003FC8FCB1ED03C0ED07E0A5EC800F011FEB1FC0ECE07F6DB5128016000103 5B6D13F89038003FE0232E7EAD2C>I<3A7FF003FF80486C487FA3007F7F0001EB000FB3 A3151FA2153F6D137F3900FE03FF90B7FC6D15807F6D13CF902603FE07130029247FA32C >I<01F81370D803FE13F8380FFF0148138748EBCFF0397F9FFFE0D8FF0F13C0D8FC0713 8039F803FE00387000F81D0A79B22C>126 D E /Ff 3 42 df<161E167EED01FE1507ED 0FF8ED3FE0ED7FC0EDFF80913801FE004A5A4A5A5D140F4A5A5D143F5D147F92C7FCA25C 5CB3B3B3A313015CA3495AA213075C495AA2495A495A137F49C8FC485A485AEA07F0EA1F E0485AB4C9FC12FCA2B4FCEA3FC06C7EEA07F0EA03FC6C7E6C7E6D7E133F6D7E6D7EA26D 7E801303A26D7EA3801300B3B3B3A38080A281143F81141F816E7E1407816E7E6E7E9138 00FF80ED7FC0ED3FE0ED0FF8ED07FE1501ED007E161E27C675823E>26 D40 D<12F012FCB4FC7FEA3FE06C7E6C7EEA 03FC6C7E6C7E6D7E6D7E80131F6D7E8013076D7EA2801301A26D7EA46E7EB3B3B3B28114 3FA381141FA26E7EA21407811403816E7E1400816F7E6F7E6F7E6F7E6F7E6F7EED00FE16 7FEE3FC0160FA2163FEE7F0016FEED03FC4B5A4B5A4B5A4B5A4B5A4BC7FC5D14014A5A5D 14075D140FA24A5AA2143F5DA3147F5DB3B3B3B24AC8FCA4495AA213035CA2495A130F5C 495A133F5C495A49C9FC485A485AEA0FF8485A485AEAFF8090CAFC12FC12F02AF8748243 >I E /Fg 4 55 df<007FB81280B912C0A26C17803204799641>0 D15 D<153CA2157C157815F84A5A5D14034A5A4A5A4ACBFC5C4AB812FE91BAFC5B5BD907C0CB FCEB1F80017FCCFC13FCEA07F8EA1FE0EAFF80A2EA1FE0EA07F8C67E137FEB1F80EB07C0 6DBAFC7F7F6E17FE6ECBFC806E7E6E7E6E7E1401816E7E1578157C153CA2482E7BAB53> 40 D54 D E /Fh 5 41 df<007FB712FCB812FEA26C16FC2F047A943C>0 D<171C177EEE01FEEE07FCEE1FF0EE7F C0923801FF00ED07FCED1FF0ED7FC04A48C7FCEC07FCEC1FF0EC7FC04948C8FCEB07FCEB 1FF0EB7FC04848C9FCEA07FCEA1FF0EA7FC048CAFCA2EA7FC0EA1FF0EA07FCEA01FF3800 7FC0EB1FF0EB07FCEB01FF9038007FC0EC1FF0EC07FCEC01FF9138007FC0ED1FF0ED07FC ED01FF9238007FC0EE1FF0EE07FCEE01FEEE007E171C1700AC007FB712FCB812FEA26C16 FC2F3E7AB03C>20 D<14E080A213015CA213035C1307495AA249CCFC133E137E5B485A48 5AEA0FE0003FBA12E0BB12F0A2003F19E0D80FE0CCFCEA03F06C7E6C7E137E133E7F6D7E A26D7E1303801301A2801300A25C44287CA64D>32 D<187018F0A2841878A2187C183C18 3E84A2727E727E85727E727E727E197F007FBA12C0BB12F0A26C19C0CCEA7F0019FC4E5A 4E5A4E5A614E5A4EC7FCA2183E183C187C1878A218F860A2187044287CA64D>I<15F0A2 14014A5A5D14074A5AA24ACBFC143E5C91B912E04918F05B010F18E0D91F80CBFC017FCC FC13FCEA07F8EA1FE0EAFF80A2EA1FE0EA07F8C67E137FEB1F806DB912E0010318F07F6D 18E0027CCBFC80806E7EA26E7E1403816E7E1400A2442A7CA74D>40 D E /Fi 19 90 df<123C127EB4FCA21380A2127F123D1201A412031300A25A1206120E 120C121C5A5A126009177A8715>59 D<16035E5EA24C7EA2163F167FA216FFA2ED01BFED 033F831506161F150C1518A215301570156015C083EC01800203130F15001406A25C141C 14184A80A2027FB5FC91B6FCA2903901800007A249C7FC1306835B16035B5B1370136013 E01201D807F04A7EB549B512F0A25B34367DB53A>65 D67 D<010FB612F817FF18C0903B003FC0003FE0EF0FF0EF03F84B 6D7E717E027F157F8492C81380A24A151F19C05CA21301A25CA21303183F5CA213071980 4A157FA2130F19004A5D60011F1501605C4D5A013F5E17074A4A5A60017F4B5A4DC7FC91 C8127E4C5A494A5AEE0FF049EC3FC000014AB4C8FCB712FC16F093C9FC3A337DB23F>I< 010FB712FEA218FC903A003FC000031700187C4B143CA2027F151C181892C8FCA25CA24A 1303A201014A1338040613304A1500160E13035E4A137C91B512FC5B5EECF0001638130F 16305C1860011F027013E0046013C04A140104001380133F17034A15005F017F150EA291 C8121E5F49157C5F4914030001ED1FF0B8FCA25F37337DB239>I<010FB712FCA218F890 3A003FC00007170018785D1838147F183092C8FCA25CA25C16060101020E1370040C1360 4A1500A20103141C5E5C16F849B5FCA25EECF001010F130016605CA2011F14E05E5CA201 3F91C8FCA25CA2137FA291CAFCA25BA25B487EB6FCA336337DB231>II<0107B512E05BA2903900 1FF0005DA25DA2143FA25DA2147FA292C7FCA25CA25CA21301A25CA21303A25CA21307A2 5CA2130FA25CA2131FA25CA2133FA25CA2137FA291C8FC5B007F13FEB5FCA223337EB222 >73 D<010FB500C090B5FCA39026003FE0C7EA1FE04B1500183E4B143818F0027FEC01C0 4D5A92C7000EC7FC5F4A5C17E04A495A4C5A0101020EC8FC5E4A5B16F0010313011503EC F80F4B7E0107133FEDF3FCECF1C39138F381FE90380FF7019138FC00FF5C5C49486D7EA2 4A6D7EA2013F6E7EA24A6D7EA2137F707E91C7FC707E5B707E5B00014B7EB500FC013F13 F85EA240337DB241>75 D<010FB512F0A39026003FE0C7FC5DA25DA2147FA292C8FCA25C A25CA21301A25CA21303A25CA21307A25CA2130FA25C170C011F151C17185C1738013F15 3017705C17E0137F160191C7EA03C0160749EC0F80161F49147F0001913803FF00B8FCA2 5E2E337DB234>I<90260FFFE049B5FCA281D9001F9138000FE04A6CEC07801900DA33FC 1406A2DA71FE140E180C146081DAE07F141C701318ECC03F82010116386F6C133014806F 7E010316706F6C136014001503496E13E003015C0106801500010EECFF0160010CEC7F81 A2011CEC3FC395C7FC0118EC1FE3A20138EC0FF717F60130140717FE017014035F016014 01A213E0705A1201D807F01578B57E1730A240337DB23D>78 DI81 D<010FB67E17F817FE903A003FC001FF9338003FC0EF1FE04B130FEF07F0147FA292C713 F8A25CEF0FF05CA20101ED1FE018C04AEC3F8018000103157E4C5A4AEB07F0EE3FC049B5 00FEC7FC16F89138F0007E82010F6E7E707E5C83131FA25CA2013F141FA25CA2017F143F 5F91C7FC180649160E180C49161C00011718B500FC011F133893380FE070040713E0C938 03FFC09338007F0037357DB23A>I<03FF13180207EBE038021FEBF87891397F00FCF802 FCEB1FF0D901F0130F4948130749481303494814E0A249C71201A2013E15C0A3137E1780 A2017F91C7FC8080EB3FF014FF15F06D13FE6D6D7E6D806D80010080020F7F1400150F6F 7E150315011500A2120CA2001C5D1218A2150100385D003C14035E4B5A007E4A5A007F14 1F6D49C7FCD87BE0137C39F9FC03F839F07FFFE0D8E01F138026C003FEC8FC2D377CB42F >I<0003B812F05A18E0903AF0007F000FD80F8049130390C71401000E5C48EE00C01401 121800384A1301A2003001031580127000605CA20207140300E01700C74990C7FCA2140F A25DA2141FA25DA2143FA25DA2147FA292C9FCA25CA25CA21301A25CA21303A25C497E00 1FB512FEA334337FB22D>I86 DI<267FFFF8ECFFFEB5FCA2000390C8EA1FE06C48ED0F006C6C151E171C5F6D6C14 605F6D6C13014C5A4CC7FC6D6C13065E5E6D6C5B5E6D6C13E04B5A4B5AD903FC90C8FC15 065D6D6C5A5D6D6C5A15E05D6E5A92C9FCA2147E14FEA35C1301A35C1303A35C1307A213 0F0007B512E0A337337EB22D>89 D E /Fj 22 90 df<121C127FEAFF80A5EA7F00121C 0909798817>58 D<121C127FEAFF80A213C0A3127F121C1200A412011380A2120313005A 1206120E5A5A5A12600A19798817>II<124012F812FE6C7EEA3FE0EA0FF8EA03FEC66C7EEB3FE0EB0FF8EB03FE903800FF80 EC3FE0EC0FF8EC03FE913800FF80ED3FE0ED0FF8ED03FE923800FF80EE3FE0EE0FF8EE03 FE933800FF80EF3FC0A2EFFF80933803FE00EE0FF8EE3FE0EEFF80DB03FEC7FCED0FF8ED 3FE0EDFF80DA03FEC8FCEC0FF8EC3FE0ECFF80D903FEC9FCEB0FF8EB3FE0EBFF80D803FE CAFCEA0FF8EA3FE0EAFF8048CBFC12F81260323279AD41>62 D<1760177017F01601A216 03A21607160FA24C7EA216331673166316C3A2ED0183A2ED0303150683150C1601151815 30A21560A215C014011580DA03007FA202061300140E140C5C021FB5FC5CA20260C7FC5C 83495A8349C8FC1306A25BA25B13385B01F01680487E000716FFB56C013F13FF5EA2383C 7DBB3E>65 D<9339FF8001C0030F13E0037F9038F80380913A01FF807E07913A07F8000F 0FDA1FE0EB079FDA3F80903803BF0002FFC76CB4FCD901FC80495A4948157E495A495A49 48153E017F163C49C9FC5B1201484816385B1207485A1830121F4993C7FCA2485AA3127F 5BA312FF90CCFCA41703A25F1706A26C160E170C171C5F6C7E5F001F5E6D4A5A6C6C4A5A 16076C6C020EC8FC6C6C143C6C6C5C6CB4495A90393FE00FC0010FB5C9FC010313FC9038 007FC03A3D7CBA3B>67 D<0103B7FC4916E018F8903B0007F80007FE4BEB00FFF03F8002 0FED1FC0180F4B15E0F007F0021F1503A24B15F81801143F19FC5DA2147FA292C8FCA25C 18035CA2130119F84A1507A2130319F04A150FA2010717E0181F4A16C0A2010FEE3F80A2 4AED7F00187E011F16FE4D5A4A5D4D5A013F4B5A4D5A4A4A5A057FC7FC017F15FEEE03FC 91C7EA0FF049EC7FC0B8C8FC16FC16C03E397DB845>I<0103B812F05BA290260007F8C7 123F4B1407F003E0020F150118005DA2141FA25D19C0143FA24B1330A2027F1470190092 C7126017E05C16014A495A160F49B6FCA25F9138FC000F01031407A24A6DC8FCA201075C 18034A130660010F160693C7FC4A150E180C011F161C18184A1538A2013F5E18F04A4A5A A2017F15074D5A91C8123F49913803FF80B9FCA295C7FC3C397DB83D>I<0103B812E05B A290260007F8C7123F4B140FF003C0140F18015DA2141FA25D1980143FA25D1760027F14 E095C7FC92C75AA24A1301A24A495A16070101141F91B6FC94C8FCA2903903FC001F824A 130EA21307A24A130CA2010F141CA24A90C9FCA2131FA25CA2133FA25CA2137FA291CBFC 497EB612C0A33B397DB835>II<0107B512FCA216 F890390007F8005DA2140FA25DA2141FA25DA2143FA25DA2147FA292C7FCA25CA25CA213 01A25CA21303A25CA21307A25CA2130FA25CA2131FA25CA2133FA25CA2137FA291C8FC49 7EB6FCA326397DB824>73 D<0103B500F8903807FFFC5BA290260007F8C813804BEDFC00 19F0020F4B5AF003804B4AC7FC180E021F1538604B5CEF0380023F4AC8FC170E4B133C17 70027F5C4C5ADB0007C9FC160E4A5B167E4A13FE4B7E01015B92380E7F80ECFC1CED383F 010301E07FECFDC04A486C7EECFF00D907FC6D7E5C4A130783130F707E5C1601011F81A2 4A6D7EA2013F6F7EA24A143F84137F717E91C8123F496C81B60107B512C0A26146397DB8 47>75 D<0103B6FC5B5E90260007FCC8FC5D5D140FA25DA2141FA25DA2143FA25DA2147F A292C9FCA25CA25CA21301A25CA21303A25CA2130718404A15C0A2010F150118804A1403 A2011F16005F4A1406170E013F151E171C4A143C177C017F5D160391C7120F49EC7FF0B8 FCA25F32397DB839>I<902603FFF891381FFFF8496D5CA2D90007030113006FEC007C02 061678DA0EFF157081020C6D1460A2DA1C3F15E0705CEC181F82023815016F6C5C143015 0702706D1303030392C7FC02607FA2DAE0015C701306ECC0008201016E130EEF800C5C16 3F0103EDC01C041F131891C713E0160F49EDF03818300106140717F8010E02031370EFFC 60130CEE01FE011C16E004005B011815FF177F1338600130153FA20170151F95C8FC01F0 81EA07FCB512E01706A245397DB843>78 D<4BB4FC031F13F09238FE01FC913903F0007E DA07C0EB1F80DA1F80EB0FC0023EC7EA07E002FCEC03F0495A4948EC01F8495A4948EC00 FC495A49C912FE49167E13FE49167F1201485AA2485AA2120F5B001F17FFA2485AA34848 ED01FEA400FFEE03FC90C9FCA2EF07F8A2EF0FF0A218E0171F18C0EF3F806C167F180017 FE4C5A6C6C5D1603001F4B5A6D4A5A000FED1F806C6C4AC7FC6D147E0003EC01F8D801FC 495AD8007EEB0FC090263F807FC8FC903807FFF801001380383D7CBA3F>I<4BB4FC031F 13F09238FE01FC913903F0007EDA07C0EB1F80DA1F80EB0FC0023EC7EA07E002FCEC03F0 495A4948EC01F8495A4948EC00FC495A013F16FE49C9FC13FE187F485A12035B12075B12 0F4916FF121FA2485AA34848ED01FEA448C9EA03FCA3EF07F8A218F0170F18E0171F18C0 EF3F807EEF7F0017FEDA07C05B6C90391FF001F8903980383803001F496C485A9139E00C 0FE0260FC0C0EB1F80D807E1D90E3FC7FC0280137ED803F1EB07F8D801F95C3A007FC00F C0903A3FE07F0003903807FFFE0100018F5BDA000F1306170E171E705A177CEEC1F816FF 5FA25F5F6F5B6F48C7FCED00F8384B7CBA42>81 D<0103B612F849EDFF8018E0903B0007 F8001FF84BEB03FCEF00FE020F157FA24BEC3F80A2021F16C0A25DA2143FF07F805DA202 7FEDFF006092C7485A4D5A4A4A5A4D5A4AEC1F80057FC7FC0101EC07F891B612E094C8FC 9139FC000FC00103EC03F0707E4A6D7E831307177E5C177F010F5D5F5CA2011F1401A25C A2133F16034A4A1360A2017F17E019C091C71401496C01011480B61503933900FE0700EF 7E0ECAEA1FFCEF07F03B3B7DB83F>I<92391FE00380DBFFFC130002036D5A91390FE01F 8F91393F0007DF027EEB01FE02F81300495A4948147E177C4948143C495AA2011F153891 C8FCA3491530A28094C7FC80806D7E14FEECFFE06D13FE6DEBFFC06D14F06D806D80021F 7F02037FEC003F03037F1500167F163F161FA3120C160FA2001C151F94C7FCA3003C153E A25E003E5D127E007F4A5A6D495A6DEB0FC0D8F9F0495AD8F0FE01FEC8FC39E03FFFF801 0F13E0D8C00190C9FC313D7CBA33>I<0003B812FEA25A903AF8003FC00101C091388000 7E4848163C90C7007F141C121E001C92C7FCA2485CA200305C007017180060130112E048 5CA21403C716005DA21407A25DA2140FA25DA2141FA25DA2143FA25DA2147FA292C9FCA2 5CA25CA21301A25CA21303A25CEB0FFC003FB6FC5AA237397EB831>I<267FFFFC91383F FFC0B55DA2000390C83807FC006C48ED03E06060000094C7FC5F17065FA25F6D5DA26D5D 17E05F4C5AA24CC8FC6E1306A2013F5C161C16185EA25E6E5BA2011F495A150393C9FC15 06A25D6E5AA2010F5B157015605DA2ECE18002E3CAFC14F3EB07F614FE5C5CA25C5CA26D 5AA25C91CBFC3A3B7CB830>86 D<277FFFFC01B500F890B51280B5FC60000390C7D807FC C7380FF80001FC4BEC03E000016204035E98C7FC621A0604075DA2040F5DA2041B5D6216 336D02735D1663000003C34A5A83DB01834AC8FC04815CDB0301140603075D1506030C5D A203185D1970033015606115606D01E04A5A15C090267F01804AC9FC17FEDA0300140604 00130E0206150C020E5D140C4A5DA24A5D18E04A5D715A5C4A92CAFCA26DC85AA2013E15 7C1778133C1770133801301560513B7CB84E>I 89 D E /Fk 49 124 df<913A03FF8007FE027F9039F07FFF800103B500FDB512E0010F 903A00FFFE0FF0D93FF8ECF81F90267FE0019038F03FF849485A4816E014804816C00200 ED1FF081F007C06F91C7FCA8B912E0A4000390C701C0C7FCB3ABB5D8FC3FEBFF80A43D3A 7EB938>11 D<141C143C14F8EB01F0EB03E01307EB0FC0EB1F8014005B137E13FE5B1201 5B1203A2485AA2120F5B121FA25B123FA4485AA512FFB1127FA56C7EA4121F7FA2120F7F 1207A26C7EA212017F12007F137E7F7F1480EB0FC0EB07E01303EB01F0EB00F8143C141C 165377BD25>40 D<12E07E127C7E7E7F6C7E6C7E12037F6C7E7F12007F137E137FA2EB3F 80A214C0131F14E0A2130F14F0A4EB07F8A514FCB114F8A5EB0FF0A414E0131FA214C013 3F1480A2EB7F00A2137E13FE5B12015B485A5B1207485A485A90C7FC123E5A12F05A1653 7BBD25>I<49B47E010F13F0013F13FC9038FE01FF3A01F8007F804848EB3FC04848EB1F E0150F485AED07F0121FA27FA27F7F01FEEB0FE0EBFF809138E01FC06CEBF03F02FC1380 9138FF7F006C14FC6C5C7E6C14FE6D7F6D14C04914E048B612F0EA07F848486C13F8261F E01F13FC383FC007EB8001007F6D13FE90C7123F48140F48140715031501A21500A216FC 7E6C14016D14F86C6CEB03F06D13076C6CEB0FE0D80FFEEB7FC00003B61200C614FC013F 13F00103138027387CB630>56 D58 DI65 DIII III II75 DI78 DIIIII<003FB91280A4D9F800EBF003 D87FC09238007FC049161F007EC7150FA2007C1707A200781703A400F818E0481701A4C8 92C7FCB3AE010FB7FCA43B387DB742>IIII89 D97 D<13FFB5FCA412077EAF4AB47E020F13F0023F13FC9138FE03FFDAF00013804AEB7FC002 80EB3FE091C713F0EE1FF8A217FC160FA217FEAA17FCA3EE1FF8A217F06E133F6EEB7FE0 6E14C0903AFDF001FF80903AF8FC07FE009039F03FFFF8D9E00F13E0D9C00390C7FC2F3A 7EB935>I<903801FFC0010F13FC017F13FFD9FF8013802603FE0013C048485AEA0FF812 1F13F0123F6E13804848EB7F00151C92C7FC12FFA9127FA27F123FED01E06C7E15036C6C EB07C06C6C14806C6C131FC69038C07E006DB45A010F13F00101138023257DA42A>II<903803FF8001 1F13F0017F13FC3901FF83FE3A03FE007F804848133F484814C0001FEC1FE05B003FEC0F F0A2485A16F8150712FFA290B6FCA301E0C8FCA4127FA36C7E1678121F6C6C14F86D14F0 00071403D801FFEB0FE06C9038C07FC06DB51200010F13FC010113E025257DA42C>I<16 1FD907FEEBFFC090387FFFE348B6EAEFE02607FE07138F260FF801131F48486C138F003F 15CF4990387FC7C0EEC000007F81A6003F5DA26D13FF001F5D6C6C4890C7FC3907FE07FE 48B512F86D13E0261E07FEC8FC90CAFCA2123E123F7F6C7E90B512F8EDFF8016E06C15F8 6C816C815A001F81393FC0000F48C8138048157F5A163FA36C157F6C16006D5C6C6C495A D81FF0EB07FCD807FEEB3FF00001B612C06C6C91C7FC010713F02B377DA530>103 D<13FFB5FCA412077EAFED7FC0913803FFF8020F13FE91381F03FFDA3C01138014784A7E 4A14C05CA25CA291C7FCB3A3B5D8FC3F13FFA4303A7DB935>II<13FF B5FCA412077EAF92380FFFE0A4923803FC0016F0ED0FE0ED1F804BC7FC157E5DEC03F8EC 07E04A5A141FEC7FE04A7E8181A2ECCFFEEC0FFF496C7F806E7F6E7F82157F6F7E6F7E82 150F82B5D8F83F13F8A42D3A7EB932>107 D<13FFB5FCA412077EB3B3ACB512FCA4163A 7DB91B>I<01FED97FE0EB0FFC00FF902601FFFC90383FFF80020701FF90B512E0DA1F81 903983F03FF0DA3C00903887801F000749DACF007F00034914DE6D48D97FFC6D7E4A5CA2 4A5CA291C75BB3A3B5D8FC1FB50083B512F0A44C257DA451>I<01FEEB7FC000FF903803 FFF8020F13FE91381F03FFDA3C011380000713780003497E6D4814C05CA25CA291C7FCB3 A3B5D8FC3F13FFA430257DA435>I<903801FFC0010F13F8017F13FFD9FF807F3A03FE00 3FE048486D7E48486D7E48486D7EA2003F81491303007F81A300FF1680A9007F1600A300 3F5D6D1307001F5DA26C6C495A6C6C495A6C6C495A6C6C6CB45A6C6CB5C7FC011F13FC01 0113C029257DA430>I<9039FF01FF80B5000F13F0023F13FC9138FE07FFDAF001138000 03496C13C00280EB7FE091C713F0EE3FF8A2EE1FFCA3EE0FFEAA17FC161FA217F8163F17 F06E137F6E14E06EEBFFC0DAF00313809139FC07FE0091383FFFF8020F13E0020390C7FC 91C9FCACB512FCA42F357EA435>I<49B4EB0780010FEBE00F013FEBF81F9039FFC07C3F 0003EB803E3A07FE000F7F4848EB07FF121F497F123F497F127FA25B12FFAA6C7EA36C7E 5D6C7E000F5C6C6C5B6C6C133F6CEBC0FD39007FFFF1011F13C10101130190C7FCAC037F 13FEA42F357DA432>I<9038FE03F000FFEB0FFEEC3FFF91387C7F809138F8FFC000075B 6C6C5A5CA29138807F80ED3F00150C92C7FC91C8FCB3A2B512FEA422257EA427>I<9038 3FF0383903FFFEF8000F13FF381FC00F383F0003007E1301007C130012FC15787E7E6D13 0013FCEBFFE06C13FCECFF806C14C06C14F06C14F81203C614FC131F9038007FFE140700 F0130114007E157E7E157C6C14FC6C14F8EB80019038F007F090B512C000F8140038E01F F81F257DA426>I<130FA55BA45BA25B5BA25A1207001FEBFFE0B6FCA3000390C7FCB215 78A815F86CEB80F014816CEBC3E090383FFFC06D1380903803FE001D357EB425>I<01FF EC3FC0B5EB3FFFA4000714016C80B3A35DA25DA26C5C6E4813E06CD9C03E13FF90387FFF FC011F13F00103138030257DA435>I119 D123 D E /Fl 51 122 df<9138FF807E01079038E1FF80903A1F807FC3C0D93E00EB87E049EBFF 074913FE485A00039138FC018049017CC7FCAAB712FCA22703E0007CC7FCB3A6486C13FE 3A7FFF0FFFF0A22B2F7FAE29>11 D<14FF010713E090381F80F090383E003849137C4913 FC485A1203491378153092C7FCA7157CB612FCA23803E000157CB3A5486C13FE3A7FFF0F FFE0A2232F7FAE27>I<003C13F0387E01F838FF03FCA2EB83FEA2EA7F81383D80F60001 1306A30003130EEB000CA248131C00061318000E13384813704813E0387001C000601380 17157EAD23>34 D<13031307130E131C1338137013F0EA01E013C01203EA0780A2EA0F00 A2121EA35AA45AA512F8A25AAB7EA21278A57EA47EA37EA2EA0780A2EA03C0120113E0EA 00F013701338131C130E1307130310437AB11B>40 D<12C07E12707E7E7E120FEA078012 0313C0EA01E0A2EA00F0A21378A3133CA4131EA5131FA2130FAB131FA2131EA5133CA413 78A313F0A2EA01E0A2EA03C013801207EA0F00120E5A5A5A5A5A10437CB11B>I<123C12 7EB4FCA21380A2127F123D1201A312031300A25A1206120E5A5A5A126009157A8714>44 D<123C127E12FFA4127E123C08087A8714>46 D<140EA2141E143EA2147E14FEA2EB01BE 1303143E1306130E130C131813381330136013E013C0EA0180120313001206120E120C5A 123812305A12E0B612FCA2C7EA3E00A9147F90381FFFFCA21E2D7EAC23>52 D<000CEB0180380FC01F90B512005C5C14F014C0D80C7EC7FC90C8FCA8EB1FC0EB7FF838 0DE07C380F801F01001380000E130F000CEB07C0C713E0A2140315F0A4127812FCA448EB 07E012E0006014C00070130F6C14806CEB1F006C133E380780F83801FFE038007F801C2D 7DAB23>I56 D<4A7E4A7EA34A7EA24A7EA3EC1BF81419A2EC30FCA2EC70FEEC607E A24A7EA349486C7EA2010380EC000FA201066D7EA3496D7EA2011FB57EA2903818000149 6D7EA349147EA201E0147F4980A20001ED1F801203000716C0D80FF0EC3FE0D8FFFC0103 B5FCA2302F7EAE35>65 D67 DIII72 DI75 DI78 DII82 D<007FB712F8A29039000FC003007C150000701638A200601618A200E0161CA248160CA5 C71500B3A94A7E011FB512E0A22E2D7EAC33>84 D87 D91 D<0003130C48131C000E133848 13704813E0003013C0EA700100601380A2EAE00300C01300A300DE137800FF13FCEB83FE A2EA7F81A2383F00FC001E1378171577AD23>II<13FF000713C0380F01F0381C00F8003F137C80A2143F001E7FC7FCA4EB07FF13 7F3801FE1FEA07F0EA1FC0EA3F80EA7F00127E00FE14065AA3143F7E007E137F007FEBEF 8C391F83C7FC390FFF03F83901FC01E01F207D9E23>97 DII<15F8141FA214011400ACEB0FE0EB7FF83801 F81E3803E0073807C003380F8001EA1F00481300123E127EA25AA9127C127EA2003E1301 7EEB8003000F13073903E00EFC3A01F03CFFC038007FF090391FC0F800222F7EAD27>I< EB1F80EBFFF03803E0783807C03E380F801E381F001FEC0F80123E007E130715C0127C12 FCA3B6FCA200FCC8FCA5127EA2003E14C0123F6C1301390F80038001C013003803E00F38 01F03C38007FF8EB1FC01A207E9E1F>II<013F13F89038 FFC3FE3903E1FF1E3807807C000F140C391F003E00A2003E7FA76C133EA26C6C5A000713 78380FE1F0380CFFC0D81C3FC7FC90C8FCA3121E121F380FFFF814FF6C14C04814F0391E 0007F848130048147C12F848143CA46C147C007C14F86CEB01F06CEB03E03907E01F8039 01FFFE0038003FF01F2D7E9D23>III<130FEB1F80EB3FC0A4EB1F80EB0F0090C7FCA8EB07C013FFA2130F13 07B3AD1230127838FC0F80A21400485AEA783EEA3FF8EA07E0123C83AD16>III<2607C07F EB07F03BFFC3FFC03FFC903AC783F0783F3C0FCE01F8E01F803B07DC00F9C00F01F8D9FF 8013C04990387F000749137EA249137CB2486C01FEEB0FE03CFFFE0FFFE0FFFEA2371E7E 9D3C>I<3807C0FE39FFC3FF809038C703E0390FDE01F0EA07F8496C7EA25BA25BB2486C 487E3AFFFE1FFFC0A2221E7E9D27>II<3807C0FE39 FFC7FF809038CF03E0390FDC01F03907F800FC49137E49133E49133FED1F80A3ED0FC0A8 151F1680A2ED3F00A26D137E6D137C5D9038FC01F09038CE07E09038C7FF80D9C1FCC7FC 01C0C8FCA9487EEAFFFEA2222B7E9D27>I<380781F838FF87FEEB8E3FEA0F9CEA07B813 B0EBF01EEBE000A45BB0487EB5FCA2181E7E9D1C>114 D<3801FE183807FFB8381E01F8 EA3C00481378481338A21418A27E7EB41300EA7FF06CB4FC6C13C06C13F0000113F83800 1FFC130138C0007E143EA26C131EA27EA26C133CA26C137838FF01F038E3FFC000C01300 17207E9E1C>I<1360A413E0A312011203A21207121FB512F0A23803E000AF1418A71438 3801F03014703800F860EB3FE0EB0F80152A7FA81B>II<3AFFFC01FFC0A23A0FE0007E000007147C15380003143015706C6C1360A26C 6C5BA390387C0180A26D48C7FCA2EB3F07EB1F06A2EB0F8CA214DCEB07D8A2EB03F0A36D 5AA26D5A221E7F9C25>I<3BFFFC3FFE07FFA23B0FE003F001F801C09038E000F0000701 0114E0812603E00314C0A2913807F8012701F006781380A29039F80E7C030000D90C3C13 00A290397C181E06A2151F6D486C5AA2168C90391F600798A216D890390FC003F0A36D48 6C5AA36DC75A301E7F9C33>I<3AFFFC01FFC0A23A0FE0007E000007147C153800031430 6D137000011460A26C6C5BA2EBFC01017C5BEB7E03013E90C7FCA2EB1F06A2148EEB0F8C A2EB07D8A2EB03F0A36D5AA26D5AA2495AA2130391C8FC1278EAFC06A25B131CEA7838EA 7070EA3FE0EA0F80222B7F9C25>121 D E /Fm 5 53 df<13FF000313C0380781E0380F 00F0001E137848133CA248131EA400F8131FAD0078131EA2007C133E003C133CA26C1378 6C13F0380781E03803FFC0C6130018227DA01E>48 D<13E01201120712FF12F91201B3A7 487EB512C0A212217AA01E>II<13FF000313 C0380F03E0381C00F014F8003E13FC147CA2001E13FC120CC712F8A2EB01F0EB03E0EB0F C03801FF00A2380003E0EB00F01478147C143E143F1230127812FCA2143E48137E006013 7C003813F8381E03F0380FFFC00001130018227DA01E>I<14E01301A213031307A2130D 131D13391331136113E113C1EA01811203EA07011206120C121C12181230127012E0B6FC A2380001E0A6EB03F0EB3FFFA218227DA11E>I E /Fn 31 123 df34 D46 D49 DII<163FA25E5E5D5D A25D5D5D5DA25D92B5FCEC01F7EC03E7140715C7EC0F87EC1F07143E147E147C14F8EB01 F0EB03E0130714C0EB0F80EB1F00133E5BA25B485A485A485A120F5B48C7FC123E5A12FC B91280A5C8000F90C7FCAC027FB61280A531417DC038>I65 D67 D69 D78 D80 D<003FBA12E0A59026FE000FEB8003D87FE0933800 3FF049171F90C71607A2007E1803007C1801A300781800A400F819F8481978A5C81700B3 B3A20107B8FCA545437CC24E>84 D<01181418013C143C01FC14FC4848495A4848495A49 5C4848495A4848495A001F141F90C790C7FC003E143EA2003C143C007C147C00781478A2 00F814F8A2485CD8F1F0EBF1F0D8F7FCEBF7FCB46CEBFFFE6D806E1480A36C80A36C806C 496C13006C486D5A6C486D5AD801F0EB01F0292274C43A>92 D<903801FFE0011F13FE01 7F6D7E48B612E03A03FE007FF84848EB1FFC6D6D7E486C6D7EA26F7FA36F7F6C5A6C5AEA 00F090C7FCA40203B5FC91B6FC1307013F13F19038FFFC01000313E0000F1380381FFE00 485A5B127F5B12FF5BA35DA26D5B6C6C5B4B13F0D83FFE013EEBFFC03A1FFF80FC7F0007 EBFFF86CECE01FC66CEB8007D90FFCC9FC322F7DAD36>97 D99 DII104 D<137C48B4FC4813804813C0A24813E0A56C13C0A26C13806C1300EA007C90C7FCAAEB7F C0EA7FFFA512037EB3AFB6FCA518467CC520>I107 DI<90277F8007FEEC0FFCB590263FFFC090387FFF8092B5D8F001B512E0 02816E4880913D87F01FFC0FE03FF8913D8FC00FFE1F801FFC0003D99F009026FF3E007F 6C019E6D013C130F02BC5D02F86D496D7EA24A5D4A5DA34A5DB3A7B60081B60003B512FE A5572D7CAC5E>I<90397F8007FEB590383FFF8092B512E0028114F8913987F03FFC9138 8F801F000390399F000FFE6C139E14BC02F86D7E5CA25CA35CB3A7B60083B512FEA5372D 7CAC3E>II<90397FC00FF8 B590B57E02C314E002CF14F89139DFC03FFC9139FF001FFE000301FCEB07FF6C496D1380 4A15C04A6D13E05C7013F0A2EF7FF8A4EF3FFCACEF7FF8A318F017FFA24C13E06E15C06E 5B6E4913806E4913006E495A9139DFC07FFC02CFB512F002C314C002C091C7FCED1FF092 C9FCADB67EA536407DAC3E>I<90387F807FB53881FFE0028313F0028F13F8ED8FFC9138 9F1FFE000313BE6C13BC14F8A214F0ED0FFC9138E007F8ED01E092C7FCA35CB3A5B612E0 A5272D7DAC2E>114 D<90391FFC038090B51287000314FF120F381FF003383FC0004913 3F48C7121F127E00FE140FA215077EA27F01E090C7FC13FE387FFFF014FF6C14C015F06C 14FC6C800003806C15806C7E010F14C0EB003F020313E0140000F0143FA26C141F150FA2 7EA26C15C06C141FA26DEB3F8001E0EB7F009038F803FE90B55A00FC5CD8F03F13E026E0 07FEC7FC232F7CAD2C>III121 D<001FB71280A49026FC001F130001E0495A5B49495A90C7485A48 495B123E4A5B4A5B003C495BA24A90C7FC4A5A4A5AC7FC4A5A495B495BA2495B49903880 0780491300A2495A4948130F49481400A2485B48495B485BA248495B4890C75A48485C15 034848EB1FFEB7FCA4292C7DAB32>I E /Fo 4 121 df85 D105 D110 D<3B7FFF800FFFC0A2000790390003FE006C48EB01F800015D000015C0017F 13036D5C6E48C7FC90381FC0066D6C5A151C6D6C5A903803F83001015BECFCE06D6C5AEC 7F80A2143F6E7E140F4A7E4A7E1433EC63F8ECE1FCECC0FE903801807E0103137F49486C 7E0106131F4980011C6D7E496D7E0130130301708001F06D7E000181000781D81FF84913 80B46C4913F8A22D2B7DAA33>120 D E /Fp 5 53 df48 D<13381378EA01F8121F12FE12E01200B3AB487EB512F8A215267BA521>I<13FF000313 E0380E03F0381800F848137C48137E00787F12FC6CEB1F80A4127CC7FC15005C143E147E 147C5C495A495A5C495A010EC7FC5B5B903870018013E0EA0180390300030012065A001F B5FC5A485BB5FCA219267DA521>I<13FF000313E0380F01F8381C007C0030137E003C13 3E007E133FA4123CC7123E147E147C5C495AEB07E03801FF8091C7FC380001E06D7E147C 80143F801580A21238127C12FEA21500485B0078133E00705B6C5B381F01F03807FFC0C6 90C7FC19277DA521>I<1438A2147814F81301A2130313071306130C131C131813301370 136013C012011380EA03005A120E120C121C5A12305A12E0B612E0A2C7EAF800A7497E90 383FFFE0A21B277EA621>I E /Fq 85 123 df11 DIII<001C131C007F137F39FF80FF80A26D13C0A300 7F137F001C131C00001300A40001130101801380A20003130301001300485B0006130600 0E130E485B485B485B006013601A197DB92A>34 D<030C1303031E497EA2033E130FA203 3C91C7FCA3037C5BA20378131EA203F8133EA24B133CA20201147CA24B1378A3020314F8 A24B5BA202071301007FB91280BA12C0A3C7271F0007C0C7FCA2021E5CA2023E130FA202 3C91C8FCA2027C5BA20278131EA202F8133EA2BA12C0A36C1880280003E000F8C8FC4A5B A201071301A202805BA3010F1303A202005BA2491307A2011E5CA2013E130FA2013C91C9 FCA3017C5BA20178131EA20130130C3A4A7BB945>I<017C166048B416F02607C3801401 260F81C01403D900E04A5A001E01784A5A003E6D141F003C013FEC7F80007C90271BE003 FFC7FC0218B512BF007891381FFC3E00F8011CC75A020C14FC5F4C5A16035F4C5A160F5F 4CC8FC021C5B00780118133E007C5D16FC003C01385B003E90383001F0001EEB70036C01 E05B903981C007C03907C3800F2601FF005BD8007C49C9FC90C748EB07C0033EEB1FF04B EB3C3803FCEBF81C4B497E913A01F001E00602030103130703E0497E912607C007148002 0F15011580DA1F00018013C04A010F1300143E5C14FC5C495A13035C495A130F4A010713 0149C701C013805B013E1603490203140001FC6F5A49020113064848913800F00E000370 5A49ED3C3849ED1FF06C48ED07C03A437BBD45>37 D<141FEC7FC0903801F0E0903803C0 600107137090380F803090381F00381518A25BA2133E133F15381530A215705D5D140190 381F838092CAFC1487148E02DC49B51280EB0FF85C4A9039003FF8000107ED0FC06E5D71 C7FC6E140E010F150CD91DFC141C01391518D970FE143801E015302601C07F1470D80380 5D00076D6C5BD80F00EBC00148011F5C4890380FE003003E6E48C8FC007E903807F80602 03130E00FE6E5A6E6C5A1400ED7F706C4B13036F5A6F7E6C6C6D6C5B7013066C6C496C13 0E6DD979FE5B281FF001F07F133C3C07F80FE03FC0F86CB539800FFFF0C69026FE000313 C0D91FF0D9007FC7FC393E7DBB41>I<121C127FEAFF80A213C0A3127F121C1200A41201 1380A2120313005A1206120E5A5A5A12600A1979B917>I<146014E0EB01C0EB0380EB07 00130E131E5B5BA25B485AA2485AA212075B120F90C7FCA25A121EA2123EA35AA65AB212 7CA67EA3121EA2121F7EA27F12077F1203A26C7EA26C7E1378A27F7F130E7FEB0380EB01 C0EB00E01460135278BD20>I<12C07E12707E7E7E120F6C7E6C7EA26C7E6C7EA21378A2 137C133C133E131EA2131F7FA21480A3EB07C0A6EB03E0B2EB07C0A6EB0F80A31400A25B 131EA2133E133C137C1378A25BA2485A485AA2485A48C7FC120E5A5A5A5A5A13527CBD20 >I<15301578B3A6007FB812F8B912FCA26C17F8C80078C8FCB3A6153036367BAF41>43 D<121C127FEAFF80A213C0A3127F121C1200A412011380A2120313005A1206120E5A5A5A 12600A19798817>II<121C127FEAFF80A5EA7F00121C09097988 17>I<150C151E153EA2153C157CA2157815F8A215F01401A215E01403A215C01407A215 80140FA215005CA2141E143EA2143C147CA2147814F8A25C1301A25C1303A2495AA25C13 0FA291C7FC5BA2131E133EA2133C137CA2137813F8A25B1201A25B1203A25B1207A25B12 0FA290C8FC5AA2121E123EA2123C127CA2127812F8A25A12601F537BBD2A>IIIII<1538A2157815F8A2140114 031407A2140F141F141B14331473146314C313011483EB030313071306130C131C131813 301370136013C01201EA038013005A120E120C5A123812305A12E0B712F8A3C73803F800 AB4A7E0103B512F8A325397EB82A>I<0006140CD80780133C9038F003F890B5FC5D5D15 8092C7FC14FC38067FE090C9FCABEB07F8EB3FFE9038780F803907E007E090388003F049 6C7E12066E7EC87EA28181A21680A4123E127F487EA490C71300485C12E000605C127000 30495A00385C6C1303001E495A6C6C485A3907E03F800001B5C7FC38007FFCEB1FE0213A 7CB72A>II<12301238123E003FB612E0A316C05A16 8016000070C712060060140E5D151800E01438485C5D5DC712014A5A92C7FC5C140E140C 141C5CA25CA214F0495AA21303A25C1307A2130FA3495AA3133FA5137FA96DC8FC131E23 3B7BB82A>III<121C127FEAFF80 A5EA7F00121CC7FCB2121C127FEAFF80A5EA7F00121C092479A317>I<121C127FEAFF80 A5EA7F00121CC7FCB2121C127F5A1380A4127F121D1201A412031300A25A1206A2120E5A 121812385A1260093479A317>I<007FB812F8B912FCA3CCFCAEB912FCA36C17F836167B 9F41>61 D63 D<1538A3157CA315FEA34A7EA34A6C7EA202077FEC063FA2020E7FEC0C1FA2021C 7FEC180FA202387FEC3007A202707FEC6003A202C07F1501A2D901807F81A249C77F167F A20106810107B6FCA24981010CC7121FA2496E7EA3496E7EA3496E7EA213E0707E120148 6C81D80FFC02071380B56C90B512FEA3373C7DBB3E>65 DI<913A01 FF800180020FEBE003027F13F8903A01FF807E07903A03FC000F0FD90FF0EB039F4948EB 01DFD93F80EB00FF49C8127F01FE153F12014848151F4848150FA248481507A2485A1703 123F5B007F1601A35B00FF93C7FCAD127F6DED0180A3123F7F001F160318006C7E5F6C7E 17066C6C150E6C6C5D00001618017F15386D6C5CD91FE05C6D6CEB03C0D903FCEB0F8090 2701FF803FC7FC9039007FFFFC020F13F002011380313D7BBA3C>IIIIIII<013FB512E0A39039001FFC 00EC07F8B3B3A3123FEA7F80EAFFC0A44A5A1380D87F005B0070131F6C5C6C495A6C49C7 FC380781FC3801FFF038007F80233B7DB82B>IIIIIII82 DI<003FB812E0A3D9C003EB001F27 3E0001FE130348EE01F00078160000701770A300601730A400E01738481718A4C71600B3 B0913807FF80011FB612E0A335397DB83C>IIII<007FB590383FFFFCA3C6 01F801071380D97FE0D903FCC7FC013FEC01F06D6C5C5F6D6C5C6D6C13034CC8FC6D6C13 06160E6D6C5B6DEB8018163891387FC0306E6C5A16E06E6C5A91380FF18015FB6EB4C9FC 5D14036E7EA26E7F6F7EA24B7E15DF9138019FF09138038FF8150F91380607FC91380E03 FE140C4A6C7EEC38000230804A6D7E14E04A6D7E49486D7E130391C76C7E01066E7E130E 010C6E7E011C1401013C8101FE822607FF80010713E0B500E0013FEBFF80A339397EB83E >II<003FB7FCA39039FC0001FE01C0 130349495A003EC7FC003C4A5A5E0038141F00784A5A12704B5A5E006014FF4A90C7FCA2 4A5A5DC712074A5AA24A5A5D143F4A5AA24A5A92C8FC5B495AA2495A5C130F4948EB0180 A2495A5C137F495A16034890C7FC5B1203485AEE0700485A495C001F5D48485C5E484849 5A49130FB8FCA329397BB833>II< 3901800180000313033907000700000E130E485B00181318003813380030133000701370 00601360A200E013E0485BA400CE13CE39FF80FF806D13C0A3007F137FA2393F803F8039 0E000E001A1974B92A>II96 DIIIII<147E903803FF 8090380FC1E0EB1F8790383F0FF0137EA213FCA23901F803C091C7FCADB512FCA3D801F8 C7FCB3AB487E387FFFF8A31C3B7FBA19>IIIIIII<2703F00FF0EB1FE000FFD93F FCEB7FF8913AF03F01E07E903BF1C01F83803F3D0FF3800FC7001F802603F70013CE01FE 14DC49D907F8EB0FC0A2495CA3495CB3A3486C496CEB1FE0B500C1B50083B5FCA340257E A445>I<3903F00FF000FFEB3FFCECF03F9039F1C01F803A0FF3800FC03803F70013FE49 6D7EA25BA35BB3A3486C497EB500C1B51280A329257EA42E>II<3903 F01FE000FFEB7FF89038F1E07E9039F3801F803A07F7000FC0D803FEEB07E049EB03F049 14F849130116FC150016FEA3167FAA16FEA3ED01FCA26DEB03F816F06D13076DEB0FE001 F614C09039F7803F009038F1E07E9038F0FFF8EC1FC091C8FCAB487EB512C0A328357EA4 2E>II<3807E01F00FFEB7FC09038E1E3E09038E387F0380FE707EA03E613EE9038EC 03E09038FC0080491300A45BB3A2487EB512F0A31C257EA421>II<1318A51338A31378A313F81201 12031207001FB5FCB6FCA2D801F8C7FCB215C0A93800FC011580EB7C03017E13006D5AEB 0FFEEB01F81A347FB220>IIIIII<003FB512FCA2EB8003D83E0013F8003CEB07F00038 EB0FE012300070EB1FC0EC3F800060137F150014FE495AA2C6485A495AA2495A495A495A A290387F000613FEA2485A485A0007140E5B4848130C4848131CA24848133C48C7127C48 EB03FC90B5FCA21F247EA325>I E /Fr 40 121 df<922601FFFC903801FFE0033F9026 FF801F13F84AB6D8E07F13FE020F03F9B6FC023FD9C00FB500C0138091277FFC0003D9FE 0113C0902601FFE049495A494949494813E04990C714F049484A13E0495A19C0495A7413 C0017F17804A6E6E1380719138007E007192C7FCAEBCFCA526007FF8C7000301C0C8FCB3 B3A7007FB5D8F803B612F0A553547DD34E>11 D39 D<157815FC14031407141F14 FF130F0007B5FCB6FCA2147F13F0EAF800C7FCB3B3B3A6007FB712FEA52F4E76CD43>49 DI<91380FFFC091B512FC0107ECFF80011F15E09026 3FF8077F9026FF800113FC4848C76C7ED803F86E7E491680D807FC8048B416C080486D15 E0A4805CA36C17C06C5B6C90C75AD801FC1680C9FC4C13005FA24C5A4B5B4B5B4B13C04B 5BDBFFFEC7FC91B512F816E016FCEEFF80DA000713E0030113F89238007FFE707E701380 7013C018E07013F0A218F8A27013FCA218FEA2EA03E0EA0FF8487E487E487EB57EA318FC A25E18F891C7FC6C17F0495C6C4816E001F04A13C06C484A1380D80FF84A13006CB44A5A 6CD9F0075BC690B612F06D5D011F1580010302FCC7FCD9001F1380374F7ACD43>I<177C 17FEA2160116031607160FA2161F163F167FA216FF5D5DA25D5DED1FBFED3F3F153E157C 15FCEC01F815F0EC03E01407EC0FC01580EC1F005C147E147C5C1301495A495A5C495A13 1F49C7FC133E5B13FC485A5B485A1207485A485A90C8FC123E127E5ABA12C0A5C96C48C7 FCAF020FB712C0A53A4F7CCE43>III<121F7F7FEB FF8091B81280A45A1900606060A2606060485F0180C86CC7FC007EC95A4C5A007C4B5A5F 4C5A160F4C5A484B5A4C5A94C8FC16FEC812014B5A5E4B5A150F4B5AA24B5AA24B5A15FF A24A90C9FCA25C5D1407A2140FA25D141FA2143FA4147F5DA314FFA55BAC6D5BA2EC3FC0 6E5A395279D043>I<913807FFC0027F13FC0103B67E010F15E090261FFC0113F8903A3F E0003FFCD97F80EB0FFE49C76C7E48488048486E1380000717C04980120F18E0177FA212 1F7FA27F7F6E14FF02E015C014F802FE4913806C7FDBC00313009238F007FE6C02F85B92 38FE1FF86C9138FFBFF06CEDFFE017806C4BC7FC6D806D81010F15E06D81010115FC0107 81011F81491680EBFFE748018115C048D9007F14E04848011F14F048487F484813030300 14F8484880161F4848020713FC1601824848157F173FA2171FA2170FA218F8A27F007F17 F06D151FA26C6CED3FE0001F17C06D157F6C6CEDFF806C6C6C010313006C01E0EB0FFE6C 01FCEBFFFC6C6CB612F06D5D010F1580010102FCC7FCD9000F13C0364F7ACD43>I<171F 4D7E4D7EA24D7EA34C7FA24C7FA34C7FA34C7FA24C7FA34C8083047F80167E8304FE804C 7E03018116F8830303814C7E03078116E083030F814C7E031F81168083033F8293C77E4B 82157E8403FE824B800201835D840203834B800207835D844AB87EA24A83A3DA3F80C880 92C97E4A84A2027E8202FE844A82010185A24A820103854A82010785A24A82010F855C01 1F717FEBFFFCB600F8020FB712E0A55B547BD366>65 D<932601FFFCEC01C0047FD9FFC0 13030307B600F81307033F03FE131F92B8EA803F0203DAE003EBC07F020F01FCC7383FF0 FF023F01E0EC0FF94A01800203B5FC494848C9FC4901F882494982494982494982494982 4990CA7E494883A2484983485B1B7F485B481A3FA24849181FA3485B1B0FA25AA298C7FC 5CA2B5FCAE7EA280A2F307C07EA36C7FA21B0F6C6D1980A26C1A1F6C7F1C006C6D606C6D 187EA26D6C606D6D4C5A6D6D16036D6D4C5A6D6D4C5A6D01FC4C5A6D6DEE7F806D6C6C6C 4BC7FC6E01E0EC07FE020F01FEEC1FF80203903AFFE001FFF0020091B612C0033F93C8FC 030715FCDB007F14E0040101FCC9FC525479D261>67 DII 73 D77 D80 D82 D<91260FFF80130791B5 00F85B010702FF5B011FEDC03F49EDF07F9026FFFC006D5A4801E0EB0FFD4801800101B5 FC4848C87E48488149150F001F824981123F4981007F82A28412FF84A27FA26D82A27F7F 6D93C7FC14C06C13F014FF15F86CECFF8016FC6CEDFFC017F06C16FC6C16FF6C17C06C83 6C836D826D82010F821303010082021F16801400030F15C0ED007F040714E01600173F05 0F13F08383A200788200F882A3187FA27EA219E07EA26CEFFFC0A27F6D4B13806D17006D 5D01FC4B5A01FF4B5A02C04A5A02F8EC7FF0903B1FFFC003FFE0486C90B65AD8FC0393C7 FC48C66C14FC48010F14F048D9007F90C8FC3C5479D24B>I97 DI<913801FFF8021FEBFF8091B6 12F0010315FC010F9038C00FFE903A1FFE0001FFD97FFC491380D9FFF05B4817C048495B 5C5A485BA2486F138091C7FC486F1300705A4892C8FC5BA312FFAD127F7FA27EA2EF03E0 6C7F17076C6D15C07E6E140F6CEE1F806C6DEC3F006C6D147ED97FFE5C6D6CEB03F8010F 9038E01FF0010390B55A01001580023F49C7FC020113E033387CB63C>I<4DB47E0407B5 FCA5EE001F1707B3A4913801FFE0021F13FC91B6FC010315C7010F9038E03FE749903800 07F7D97FFC0101B5FC49487F4849143F484980485B83485B5A91C8FC5AA3485AA412FFAC 127FA36C7EA37EA26C7F5F6C6D5C7E6C6D5C6C6D49B5FC6D6C4914E0D93FFED90FEFEBFF 80903A0FFFC07FCF6D90B5128F0101ECFE0FD9003F13F8020301C049C7FC41547CD24B> I<913803FFC0023F13FC49B6FC010715C04901817F903A3FFC007FF849486D7E49486D7E 4849130F48496D7E48178048497F18C0488191C7FC4817E0A248815B18F0A212FFA490B8 FCA318E049CAFCA6127FA27F7EA218E06CEE01F06E14037E6C6DEC07E0A26C6DEC0FC06C 6D141F6C6DEC3F806D6CECFF00D91FFEEB03FE903A0FFFC03FF8010390B55A010015C002 1F49C7FC020113F034387CB63D>II104 D<137F497E000313E0487FA2487FA76C5BA26C5BC613806DC7FC90C8FCADEB3F F0B5FCA512017EB3B3A6B612E0A51B547BD325>I107 DIII<913801FFE0021F13FE91B612C0 010315F0010F9038807FFC903A1FFC000FFED97FF86D6C7E49486D7F48496D7F48496D7F 4A147F48834890C86C7EA24883A248486F7EA3007F1880A400FF18C0AC007F1880A3003F 18006D5DA26C5FA26C5F6E147F6C5F6C6D4A5A6C6D495B6C6D495B6D6C495BD93FFE011F 90C7FC903A0FFF807FFC6D90B55A010015C0023F91C8FC020113E03A387CB643>I<903A 3FF001FFE0B5010F13FE033FEBFFC092B612F002F301017F913AF7F8007FFE0003D9FFE0 EB1FFFC602806D7F92C76C7F4A824A6E7F4A6E7FA2717FA285187F85A4721380AC1A0060 A36118FFA2615F616E4A5BA26E4A5B6E4A5B6F495B6F4990C7FC03F0EBFFFC9126FBFE07 5B02F8B612E06F1480031F01FCC8FC030313C092CBFCB1B612F8A5414D7BB54B>I<9039 7FE003FEB590380FFF80033F13E04B13F09238FE1FF89139E1F83FFC0003D9E3E013FEC6 ECC07FECE78014EF150014EE02FEEB3FFC5CEE1FF8EE0FF04A90C7FCA55CB3AAB612FCA5 2F367CB537>114 D<903903FFF00F013FEBFE1F90B7FC120348EB003FD80FF81307D81F E0130148487F4980127F90C87EA24881A27FA27F01F091C7FC13FCEBFFC06C13FF15F86C 14FF16C06C15F06C816C816C81C681013F1580010F15C01300020714E0EC003F030713F0 15010078EC007F00F8153F161F7E160FA27E17E07E6D141F17C07F6DEC3F8001F8EC7F00 01FEEB01FE9039FFC00FFC6DB55AD8FC1F14E0D8F807148048C601F8C7FC2C387CB635> I<143EA6147EA414FEA21301A313031307A2130F131F133F13FF5A000F90B6FCB8FCA426 003FFEC8FCB3A9EE07C0AB011FEC0F8080A26DEC1F0015806DEBC03E6DEBF0FC6DEBFFF8 6D6C5B021F5B020313802A4D7ECB34>IIII<007FB500F090387FFFFEA5C66C48C7000F90C7FC6D6CEC07F86D6D5C6D6D495A 6D4B5A6F495A6D6D91C8FC6D6D137E6D6D5B91387FFE014C5A6E6C485A6EEB8FE06EEBCF C06EEBFF806E91C9FCA26E5B6E5B6F7E6F7EA26F7F834B7F4B7F92B5FCDA01FD7F03F87F 4A486C7E4A486C7E020F7FDA1FC0804A486C7F4A486C7F02FE6D7F4A6D7F495A49486D7F 01076F7E49486E7E49486E7FEBFFF0B500FE49B612C0A542357EB447>I E /Fs 49 122 df<91393FE00FE0903A01FFF83FF8903A07E01EF83C903A1F800FF07E90 3A3F001FE0FE017E133F4914C0485A1738484890381F8000ACB812C0A33B03F0001F8000 B3A7486C497EB50083B5FCA32F357FB42D>11 D<14C01301EB0380EB0F00130E5B133C5B 5BA2485A485AA212075B120F90C7FC5AA2121E123EA3123C127CA55AB0127CA5123C123E A3121E121FA27E7F12077F1203A26C7E6C7EA213787F131C7F130FEB0380EB01C0130012 4A79B71E>40 D<12C07E1270123C121C7E120F6C7E6C7EA26C7E6C7EA27F1378137C133C 133EA2131E131FA37F1480A5EB07C0B0EB0F80A514005BA3131E133EA2133C137C137813 F85BA2485A485AA2485A48C7FC120E5A123C12705A5A124A7CB71E>I<156015F0B3A400 7FB812C0B912E0A26C17C0C800F0C8FCB3A4156033327CAB3C>43 D45 D<123C127E12FFA4127E123C08087A8715>I<13075B5B13 7FEA07FFB5FC13BFEAF83F1200B3B3A2497E007FB51280A319327AB126>49 D<007FB812C0B912E0A26C17C0CCFCAC007FB812C0B912E0A26C17C033147C9C3C>61 D<15E0A34A7EA24A7EA34A7EA3EC0DFE140CA2EC187FA34A6C7EA202707FEC601FA202E0 7FECC00FA2D901807F1507A249486C7EA301066D7EA2010E80010FB5FCA249800118C77E A24981163FA2496E7EA3496E7EA20001821607487ED81FF04A7ED8FFFE49B512E0A33336 7DB53A>65 DIIII72 DI75 DI78 DII82 D<90381FE00390387FFC0748B5FC3907F01FCF390F8003FF48C7FC003E808148 80A200788000F880A46C80A27E92C7FC127F13C0EA3FF013FF6C13F06C13FF6C14C06C14 F0C680013F7F01037F9038003FFF140302001380157F153FED1FC0150F12C0A21507A37E A26CEC0F80A26C15006C5C6C143E6C147E01C05B39F1FC03F800E0B512E0011F138026C0 03FEC7FC22377CB42B>I<007FB712FEA390398007F001D87C00EC003E0078161E007016 0EA20060160600E01607A3481603A6C71500B3AB4A7E011FB512FCA330337DB237>I86 D89 D91 D93 D97 DII<153FEC0FFFA3EC007F81AEEB07F0EB3FFCEBFC0F3901F003 BF3907E001FF48487E48487F8148C7FCA25A127E12FEAA127E127FA27E6C6C5BA26C6C5B 6C6C4813803A03F007BFFC3900F81E3FEB3FFCD90FE0130026357DB32B>III<151F90391FC07F809039FFF8E3C03901F07FC73907E03F033A0FC01F 83809039800F8000001F80EB00074880A66C5CEB800F000F5CEBC01F6C6C48C7FCEBF07C 380EFFF8380C1FC0001CC9FCA3121EA2121F380FFFFEECFFC06C14F06C14FC4880381F00 01003EEB007F4880ED1F8048140FA56C141F007C15006C143E6C5C390FC001F83903F007 E0C6B51280D91FFCC7FC22337EA126>III107 DI<2703F01FE013FF00FF 90267FF80313C0903BF1E07C0F03E0903BF3803E1C01F02807F7003F387FD803FE147049 6D486C7EA2495CA2495CB3486C496C487EB53BC7FFFE3FFFF0A33C217EA041>I<3903F0 1FC000FFEB7FF09038F1E0FC9038F3807C3907F7007EEA03FE497FA25BA25BB3486CEB7F 80B538C7FFFCA326217EA02B>II<3903F03F8000FFEBFFE09038F3C0F89038F7007ED807FE7F6C48EB1F804914C049 130F16E0ED07F0A3ED03F8A9150716F0A216E0150F16C06D131F6DEB3F80160001FF13FC 9038F381F89038F1FFE0D9F07FC7FC91C8FCAA487EB512C0A325307EA02B>I<3803E07C 38FFE1FF9038E38F809038E71FC0EA07EEEA03ECA29038FC0F8049C7FCA35BB2487EB512 E0A31A217FA01E>114 DI<13 30A51370A313F0A21201A212031207381FFFFEB5FCA23803F000AF1403A814073801F806 A23800FC0EEB7E1CEB1FF8EB07E0182F7FAD1E>IIII<3A7FFF807FF8A33A 07F8001FC00003EC0F800001EC070015066C6C5BA26D131C017E1318A26D5BA2EC807001 1F1360ECC0E0010F5BA2903807E180A214F3010390C7FC14FBEB01FEA26D5AA31478A214 30A25CA214E05CA2495A1278D8FC03C8FCA21306130EEA701CEA7838EA1FF0EA0FC02530 7F9F29>121 D E /Ft 14 119 df65 D67 D83 D97 DI<90 3807FF80013F13F090B512FC3903FE01FE4848487EEA0FF8EA1FF0EA3FE0A2007F6D5A49 6C5A153000FF91C7FCA9127F7FA2003FEC07807F6C6C130F000FEC1F00D807FE133E3903 FF80FCC6EBFFF8013F13E0010790C7FC21217DA027>I<903803FF80013F13F090B512FC 48EB03FE3907FC007F4848EB3F804848EB1FC05B003FEC0FE0127F5B16F012FF150790B6 FCA301C0C8FCA4127F7F123F16F06C7E000F14016C6CEB03E0D803FEEB0FC03A01FF807F 806C6CB51200011F13FC010313E024217EA029>101 D105 D108 D<3901F803FF00FF010F 13C0023F13F09138FC0FF89039F9E007FC380FFBC06CB4486C7E1400A25BA25BB2B539E0 7FFFF0A42C217DA031>110 D<3901F81F8000FFEB7FF0ECFFF89038F9E3FC9038FBC7FE 380FFF876C1307A213FEEC03FCEC01F8EC0060491300B1B512F0A41F217EA024>114 D<9038FFE1C0000713FF5A383F803F387E000F14075A14037EA26C6CC7FC13FCEBFFE06C 13FC806CEBFF80000F14C06C14E0C6FC010F13F0EB007F140F00F0130714037EA26C14E0 6C13076CEB0FC09038C01F8090B5120000F913FC38E03FE01C217DA023>I<133CA5137C A313FCA21201A212031207001FB51280B6FCA3D807FCC7FCB0EC03C0A79038FE07801203 3901FF0F006C13FEEB3FFCEB0FF01A2F7EAE22>I118 D E /Fu 49 122 df<167016E0ED01C0ED0380ED0700150E153C5D15F85D 4A5A4A5A4A5A140F4AC7FC141E143E5C147814F8495A5C1303495AA2495AA249C8FCA25B 133E137E137CA25BA212015BA212035BA212075BA2120FA25BA2121FA290C9FCA25AA212 3EA3127EA2127CA65AAB1278A6127C123CA47EA2120E120FA27E6C7EA26C7EA26C7E1360 246472CA28>40 D<1560A2157081A281151E150E150FA2811680A3ED03C0A516E0A21501 A71503A91507A216C0A4150FA21680A2151FA21600A25DA2153EA2157EA2157C15FCA25D 1401A25D14035DA214075D140F5DA24AC7FCA2143EA25C147814F8495AA2495A5C130749 5A91C8FC131E133E5B13785B485A485A485A48C9FC121E5A5A12E05A23647FCA28>I<16 0E161EA3163EA2163CA2167CA21678A216F8A25EA21501A25EA21503A25EA21507A25EA2 007FB912E0BAFCA27EC8001FC9FCA2151EA2153EA2153CA2157CA21578A215F8A25DA214 01A25DA21403A25DA21407A25D14033B3C73B64B>43 D<13F0EA03FC1207A2EA0FFEA4EA 07FCEA03CCEA000C131C1318A2133813301370136013E0EA01C013801203EA0700120E5A 5A5A5A5A0F1D7A891E>I<007FB5FCB6FCA214FEA21805789723>I<120FEA3FC0127FA212 FFA31380EA7F00123C0A0A76891E>I48 D<16C01501A215031507ED0F80151F153F157F913801FF005C140F147F903807FCFEEB0F F0EB0700EB00015DA314035DA314075DA3140F5DA3141F5DA3143F5DA3147F92C7FCA35C 5CA313015CA313035CA313075CA2130FA2131F133FB612FCA25D224276C132>IIII<0260143002 78EB01F091397F801FE091B612C01780170016FC4914F016C0DACFFEC7FC02C0C8FC1303 5CA3130791C9FCA35B130EA3131E90381C07F8EC3FFE9138F80F8090393DC007C0D93F80 7F90383E0003013C80496D7E1370A290C7FC82A41503A415075E120E123F486C130F00FF 5DA390C7485A5A00F84A5A12E04B5A93C7FC15FE14016C5C0070495A0078495A6CEB1FC0 003E495A261F80FEC8FC6CB45A000313E0C66CC9FC2C4476C132>II<9026380FC0131C9038787FE0902671FFF0133C01F3157801EF15F090B5FC48 01E0EB01E09139007003C04848EB380701F8EC1F804848EB1C3F4990381FFF004848EB07 DF49EB001E48C85A121E5E4815F800385D0078140100705D00F01403485D1507C8485AA2 4BC7FCA25D153E157E157C15FC5D1401A24A5AA214075D140F5D141FA25D143FA24AC8FC A314FEA21301A25C1303A25C1307A35C130FA35C5C6D5A2E4472C132>III<130FEB1FC0133FEB 7FE013FFA214C0EB7F801400131E90C7FCB3A5120FEA3FC0127FA212FFA35B6CC7FC123C 132B76AA1E>I64 DI67 D<91B912C0A30201902680000313806E90C8127F4A163F191F4B150FA3 0203EE07005DA314074B5D190EA2140F4B1307A25F021F020E90C7FC5DA2171E023F141C 4B133C177C17FC027FEB03F892B5FCA39139FF8003F0ED00011600A2495D5CA216010103 4B13705C19F061010791C8FC4A1501611803010F5F4A150796C7FC60131F4A151E183E18 3C013F167C4A15FC4D5A017F1503EF0FF04A143F01FF913803FFE0B9FCA26042447AC342 >69 D<91B91280A30201902680000713006E90C8FC4A163FA24B81A30203160E5DA31407 4B151E191CA2140F5D17075F021F020E90C7FC5DA2171E023F141C4B133CA2177C027F5C ED800392B5FCA291B65AED00071601A2496E5A5CA2160101035D5CA2160301075D4A90CA FCA3130F5CA3131F5CA3133F5CA2137FA313FFB612E0A341447AC340>I<027FB512E091 B6FCA20200EBE000ED7F8015FFA293C7FCA35C5DA314035DA314075DA3140F5DA3141F5D A3143F5DA3147F5DA314FF92C8FCA35B5CA313035CA313075CA3130F5CA3131F5CA2133F A25CEBFFE0B612E0A25D2B447BC326>73 D<91B56C93387FFFC08298B5FC02014DEBC000 6E614A5FA203DF4C6CC7FC1A0E63912603CFE05D038F5F1A381A711407030FEEE1FCA2F1 01C3020FEE0383020E60F107036F6C1507021E160E021C60191CF1380F143C023804705B A2F1E01F0278ED01C091267003F85EF003801A3F02F0ED070002E0030E5CA24E137F1301 02C04B91C8FC606201036D6C5B02805F4D5A943803800113070200DA07005BA2050E1303 495D010E606F6C5A1907011E5D011C4B5CA27048130F133C01384B5C017892C7FC191F01 F85C486C027E5DD807FE027C4A7EB500F00178013FB512C0A216705A447AC357>77 D<91B56C49B512E0A28202009239000FFC00F107F0706E5A4A5F15DF705D1907EC03CFDB 8FF892C7FCA203875D02077F0303150EA270141EEC0F01020E161C826F153C141E021C6E 1338167F1978023C800238013F1470A27113F00278131F02705E83040F130102F014F84A 5E1607EFFC0313014A01035C17FE1807010314014A02FF90C8FCA2705B0107168F91C813 8E177F18DE5B010EED3FDC18FCA2011E151F011C5EA2170F133C01386F5A1378A201F815 03486C5EEA07FEB500F01401A2604B447AC348>I<91B712F018FEF0FF80020190398000 7FE06E90C7EA1FF04AED07F818034B15FCF001FE1403A24B15FFA21407A25DA2140FF003 FE5DA2021F16FC18074B15F8180F023F16F0F01FE04B15C0F03F80027FED7F0018FE4BEB 03FCEF0FF002FFEC7FC092B6C7FC17F892CAFC5BA25CA21303A25CA21307A25CA2130FA2 5CA2131FA25CA2133FA25CA2137FA25C497EB67EA340447AC342>80 D<91B77E18F818FE020190398001FF806E90C7EA3FC04AED1FE0F00FF04BEC07F8180319 FC14034B15FEA314075DA3020FED07FC5DA2F00FF8141F4B15F0F01FE0F03FC0023F1680 4BEC7F0018FEEF03F8027F4A5A4BEB1FC04CB4C7FC92B512F891B612E092380003F8EE00 FE177F496F7E4A6E7EA28413034A140FA2171F13075CA2173F130F5CA24D5A131F5CA301 3F170E5CA2017FEE801E191C4A163C496C1638B66C90383FC070051F13F094380FE1E0CA 3803FF80943800FE003F467AC347>82 DI<001FB500F090383FFFFCA326003FF0C7000113806D48913800FE00013F167C 18785C187018F0017F5E5CA2170101FF5E91C8FCA21703485F5BA21707000394C7FC5BA2 5F0007160E5BA2171E120F49151CA2173C121F491538A21778123F491570A217F0127F49 5DA2160100FF5E90C8FCA216035F16074893C8FC5E160E161E5E007E1538007F15785E6C 4A5A6D495A001F4A5A6D49C9FC6C6C133E6C6C13F83903FC07F0C6B512C0013F90CAFCEB 07F83E466DC348>85 D97 DIIII<14FE137FA3 EB01FC13001301A25CA21303A25CA21307A25CA2130FA25CA2131FA25C157F90393F83FF C091388F81F091381E00F802387F4948137C5C4A137EA2495A91C7FCA25B484814FE5E5B A2000314015E5BA2000714035E5B1507000F5DA249130F5E001F1678031F1370491480A2 003F023F13F0EE00E090C7FC160148023E13C01603007E1680EE070000FEEC1E0FED1F1E 48EC0FF80038EC03E02D467AC432>104 D<143C147E14FE1301A3EB00FC14701400AE13 7C48B4FC3803C780380703C0000F13E0120E121C13071238A21278EA700F14C0131F00F0 138012E0EA003F1400A25B137EA213FE5B12015BA212035B141E0007131C13E0A2000F13 3CEBC038A21478EB807014F014E0EB81C0EA0783EBC7803803FE00EA00F8174378C11E> I<16F0ED03F8A21507A316F0ED01C092C7FCAEEC01F0EC07FCEC1E1EEC380F0270138014 E0130114C0EB03800107131F1400A2130E153F131E011C140090C7FC5DA2157EA215FEA2 5DA21401A25DA21403A25DA21407A25DA2140FA25DA2141FA25DA2143FA292C7FCA25C14 7EA214FE001C5B127F48485A495AA248485A495AD8F81FC8FCEA707EEA3FF8EA0FC02556 83C11E>I<14FE137FA3EB01FC13001301A25CA21303A25CA21307A25CA2130FA25CA213 1FA25C167E013F49B4FC92380783C09138000E07ED3C1F491370ED603F017E13E0EC01C0 9026FE03801380913907000E00D9FC0E90C7FC5C00015B5C495AEBF9C03803FB8001FFC9 FCA214F03807F3FCEBF07F9038E01FC06E7E000F130781EBC003A2001F150FA20180140E A2003F151E161C010013E0A2485DA2007E1578167000FE01015B15F1489038007F800038 021FC7FC2A467AC42D>IIIIII114 D<1470EB01F8A313035CA31307 5CA3130F5CA3131F5CA2007FB512E0B6FC15C0D8003FC7FCA25B137EA313FE5BA312015B A312035BA312075BA3120F5BA2EC0780001F140013805C140E003F131EEB001C143C1438 5C6C13F0495A6C485AEB8780D807FEC7FCEA01F81B3F78BD20>116 D<137C48B414072603C780EB1F80380703C0000F7F000E153F121C0107150012385E1278 D8700F147E5C011F14FE00F05B00E05DEA003FEC0001A2495C137E150313FE495CA21507 1201495CA2030F13380003167849ECC070A3031F13F0EE80E0153F00011581037F13C06D EBEF8300000101148090397C03C787903A3E0F07C70090391FFE01FE903903F000782D2D 78AB34>I<017CEE038048B4020EEB0FC02603C780013FEB1FE0380703C0000E7F5E001C 037E130F01071607123804FE130300785DEA700F4A1501011F130100F001804914C012E0 EA003FDA000314034C14805B137E0307140701FE1700495CA2030F5C0001170E495CA260 A24848495A60A2601201033F5C7F4B6C485A000002F713036D9039E7E0078090267E01C3 49C7FC903A1F0781F81E903A0FFF007FF8D901FCEB0FE03B2D78AB41>119 D<02F8133FD907FEEBFFE0903A0F0F83C0F0903A1C07C780F890393803CF03017013EE01 E0EBFC07120101C013F8000316F00180EC01C000074AC7FC13001407485C120EC7FC140F 5DA3141F5DA3143F92C8FCA34AEB03C01780147EA202FEEB0700121E003F5D267F81FC13 0E6E5BD8FF83143CD903BE5B26FE079E5B3A7C0F1F01E03A3C1E0F83C0271FF803FFC7FC 3907E000FC2D2D7CAB2D>I<137C48B414072603C780EB1F80380703C0000F7F000E153F 001C1600130712385E0078157EEA700F5C011F14FE00F0495B12E0EA003FEC00015E5B13 7E150301FE5C5BA2150700015D5BA2150F00035D5BA2151F5EA2153F12014BC7FC6D5B00 005BEB7C0390383E0F7EEB1FFEEB03F090C712FE5DA214015D121F397F8003F0A24A5A48 48485A5D48131F00F049C8FC0070137E007813F8383801F0381E07C06CB4C9FCEA01FC29 4078AB2F>I E /Fv 22 122 df<121EEA7F8012FF13C0A213E0A3127FEA1E601200A413 E013C0A312011380120313005A1206120E5A5A5A12600B1D78891B>44 D<143014F013011303131F13FFB5FC13E713071200B3B3B0497E497E007FB6FCA3204278 C131>49 DI52 D<000615C0D807C0130701FCEB7F8090B612005D5D5D15E0158026063FFCC7FC90C9FCAE 14FF010713C090381F01F090383800FC01F0137ED807C07F49EB1F8016C090C7120F0006 15E0C8EA07F0A316F81503A216FCA5123E127F487EA416F890C712075A006015F0A20070 140F003015E00038EC1FC07E001EEC3F806CEC7F006C6C13FE6C6C485A3901F807F03900 7FFFE0011F90C7FCEB07F826447BC131>I<14FF010713E0011F13F890387F80FC9038FC 007E48487F4848EB1F804848EB0FC0000FEC07E0485AED03F0485A16F8007F140190C713 FCA25AA216FE1500A516FFA46C5CA36C7E5D121F7F000F5C6C6C1306150E6C6C5B6C6C5B D8007C5B90383F01E090390FFF80FE903801FE0090C8FC150116FCA4ED03F8A216F0D80F 801307486C14E0486C130F16C0ED1F80A249EB3F0049137E001EC75A001C495A000F495A 3907E01FE06CB51280C649C7FCEB1FF028447CC131>57 D<16C04B7EA34B7EA34B7EA34B 7EA3ED19FEA3ED30FFA203707FED607FA203E07FEDC03FA2020180ED801FA2DA03007F16 0FA20206801607A24A6D7EA34A6D7EA34A6D7EA20270810260147FA202E08191B7FCA249 820280C7121FA249C87F170FA20106821707A2496F7EA3496F7EA3496F7EA201788313F8 486C83D80FFF03037FB500E0027FEBFFC0A342477DC649>65 D<010FB512FEA3D9000313 806E130080B3B3AB123F487E487EA44A5A13801300006C495A00705C6C13076C5C6C495A 6CEB1F802603E07FC7FC3800FFFCEB1FE027467BC332>74 D76 D97 D99 D101 D104 D I108 D<3901FC01FE00FF903807FFC091381E07F091383801F8000701707F0003EBE0002601FD C07F5C01FF147F91C7FCA25BA35BB3A8486CECFF80B5D8F83F13FEA32F2C7DAB36>110 DI<3901FC03FC00FF90380FFF8091383C07 E091387001F83A07FDE000FE00010180137F01FFEC3F8091C7EA1FC04915E049140F17F0 160717F8160317FCA3EE01FEABEE03FCA3EE07F8A217F0160F6D15E0EE1FC06D143F1780 6EEB7E00D9FDC05B9039FCF003F891383C0FE091381FFF80DA03FCC7FC91C9FCAE487EB5 12F8A32F3F7DAB36>I<3903F803F000FFEB1FFCEC3C3EEC707F0007EBE0FF3803F9C000 015B13FBEC007E153C01FF13005BA45BB3A748B4FCB512FEA3202C7DAB26>114 D<1306A5130EA4131EA3133E137EA213FE12011207001FB512F0B6FCA2C648C7FCB3A415 0CAA017E131C017F1318A26D133890381F8030ECC070903807E0E0903801FFC09038007F 001E3E7EBC26>116 DI121 D E /Fw 18 119 df65 D<4DB5ED03C0057F02F014070407B600FE140F047FDBFFC0131F4BB800F0133F030F05FC 137F033F9127F8007FFE13FF92B6C73807FF814A02F0020113C3020702C09138007FE74A 91C9001FB5FC023F01FC16074A01F08291B54882490280824991CB7E4949844949844949 8449865D49498490B5FC484A84A2484A84A24891CD127FA25A4A1A3F5AA348491A1FA448 99C7FCA25CA3B5FCB07EA380A27EA2F50FC0A26C7FA37E6E1A1F6C1D80A26C801D3F6C6E 1A00A26C6E616D1BFE6D7F6F4E5A7F6D6D4E5A6D6D4E5A6D6D4E5A6D6E171F6D02E04D5A 6E6DEFFF806E01FC4C90C7FC020F01FFEE07FE6E02C0ED1FF8020102F8ED7FF06E02FF91 3803FFE0033F02F8013F1380030F91B648C8FC030117F86F6C16E004071680DC007F02F8 C9FC050191CAFC626677E375>67 D80 D83 D<001FBEFCA64849C79126E0000F14 8002E0180091C8171F498601F81A0349864986A2491B7FA2491B3F007F1DC090C9181FA4 007E1C0FA600FE1DE0481C07A5CA95C7FCB3B3B3A3021FBAFCA663617AE070>I<913803 FFFE027FEBFFF00103B612FE010F6F7E4916E090273FFE001F7FD97FE001077FD9FFF801 017F486D6D7F717E486D6E7F85717FA2717FA36C496E7FA26C5B6D5AEB1FC090C9FCA74B B6FC157F0207B7FC147F49B61207010F14C0013FEBFE004913F048B512C04891C7FC485B 4813F85A5C485B5A5CA2B55AA45FA25F806C5E806C047D7F6EEB01F96C6DD903F1EBFF80 6C01FED90FE114FF6C9027FFC07FC01580000191B5487E6C6C4B7E011F02FC130F010302 F001011400D9001F90CBFC49437CC14E>97 D<92380FFFF04AB67E020F15F0023F15FC91 B77E01039039FE001FFF4901F8010113804901E0010713C04901804913E0017F90C7FC49 484A13F0A2485B485B5A5C5A7113E0485B7113C048701380943800FE0095C7FC485BA4B5 FCAE7EA280A27EA2806C18FCA26C6D150119F87E6C6D15036EED07F06C18E06C6D150F6D 6DEC1FC06D01E0EC7F806D6DECFF00010701FCEB03FE6D9039FFC03FFC010091B512F002 3F5D020F1580020102FCC7FCDA000F13C03E437BC148>99 D<92380FFFC04AB512FC020F ECFF80023F15E091B712F80103D9FE037F499039F0007FFF011F01C0011F7F49496D7F49 90C76C7F49486E7F48498048844A804884485B727E5A5C48717EA35A5C721380A2B5FCA3 91B9FCA41A0002C0CBFCA67EA380A27EA27E6E160FF11F806C183F6C7FF17F006C7F6C6D 16FE6C17016D6C4B5A6D6D4A5A6D01E04A5A6D6DEC3FE0010301FC49B45A6D9026FFC01F 90C7FC6D6C90B55A021F15F8020715E0020092C8FC030713F041437CC14A>101 D103 D105 D<903807FF80B6FCA6C6FC7F7FB3A90503B61280A6DD 003FEB8000DE0FFCC7FCF01FF04E5AF0FFC04D5B4D90C8FCEF07FC4D5AEF3FF04D5A4D5A 4C90C9FC4C5AEE0FFC4C5A4C5AEE7FC04C7E03837F03877F158F039F7F03BF7F92B5FC83 8403FC804B7E03F0804B6C7F4B6C7F1580707F707F707FA270807080717FA2717F717F71 7FA2717F717F83867180727F95B57EB7D8E00FECFFF0A64C647BE355>107 D<903807FF80B6FCA6C6FC7F7FB3B3B3B3ADB712E0A623647BE32C>I<902607FF80D91F FFEEFFF8B691B500F00207EBFF80040702FC023F14E0041F02FF91B612F84C6F48819326 7FE07F6D4801037F922781FE001F9027E00FF0007FC6DA83F86D9026F01FC06D7F6DD987 F06D4A487F6DD98FC0DBF87EC7804C6D027C80039FC76E488203BEEEFDF003BC6E4A8003 FC04FF834B5FA24B5FA24B94C8FCA44B5EB3B2B7D8F007B7D8803FB612FCA67E417BC087 >I<902607FF80EB1FFFB691B512F0040714FC041F14FF4C8193267FE07F7F922781FE00 1F7FC6DA83F86D7F6DD987F07F6DD98FC0814C7F039FC78015BE03BC8003FC825DA25DA2 5DA45DB3B2B7D8F007B71280A651417BC05A>I<902607FF80EBFFF8B6010FEBFF80047F 14F00381B612FC038715FF038F010114C09227BFF0003F7FC6DAFFC0010F7F6D91C76C7F 6D496E7F03F86E7F4B6E7F4B17804B6F13C0A27313E0A27313F0A21BF885A21BFCA3851B FEAE4F13FCA41BF861A21BF0611BE0611BC06F92B512801B006F5C6F4A5B6F4A5B03FF4A 5B70495B04E0017F13C09226CFFC03B55A03C7B648C7FC03C115F803C015E0041F91C8FC 040313E093CBFCB3A3B712F0A64F5D7BC05A>112 D<913A3FFF8007800107B5EAF81F01 1FECFE7F017F91B5FC48B8FC48EBE0014890C7121FD80FFC1407D81FF0801600485A007F 167F49153FA212FF171FA27F7F7F6D92C7FC13FF14E014FF6C14F8EDFFC06C15FC16FF6C 16C06C16F06C826C826C826C82013F1680010F16C01303D9007F15E0020315F0EC001F15 00041F13F81607007C150100FC81177F6C163FA2171F7EA26D16F0A27F173F6D16E06D15 7F6D16C001FEEDFF806D0203130002C0EB0FFE02FCEB7FFC01DFB65A010F5DD8FE0315C0 26F8007F49C7FC48010F13E035437BC140>115 DI118 D E end TeXDict begin 1 0 bop 611 432 a Fw(A)53 b(Simple)h(Activ)l(e)g(A)l(ttac)l(k)e (Against)i(TCP)1553 672 y Fv(Lauren)m(t)33 b(Jonc)m(hera)m(y)1524 905 y Fu(Merit)i(Network,)g(Inc.)1317 1021 y(4251)f(Plymouth)i(R)-5 b(o)g(ad,)34 b(Suite)h(C)1353 1137 y(A)n(nn)f(A)n(rb)-5 b(or,)35 b(MI)g(48105,)e(USA)1376 1370 y(Phone:)45 b(+1)34 b(\(313\))g(936)g(2065)1434 1486 y(F)-7 b(ax:)43 b(+1)35 b(\(313\))f(747)g(3185)1480 1602 y(E-mail:)44 b([email protected])-5 b(du)1648 1798 y Fv(April)31 b(24,)h(1995)1781 2091 y Ft(Abstract)323 2216 y Fs(This)27 b(pap)r(er)f(describ)r(es)h(an)f (activ)n(e)g(attac)n(k)g(against)h(the)f(T)-6 b(ransp)r(ort)27 b(Con)n(trol)g(Proto)r(col)h(\(TCP\))f(whic)n(h)f(allo)n(ws)i(a)208 2307 y(crac)n(k)n(er)21 b(to)g(redirect)h(the)f(TCP)h(stream)f(through) f(his)i(mac)n(hine)e(thereb)n(y)g(p)r(ermitting)h(him)f(to)h(b)n(ypass) g(the)g(protection)208 2399 y(o\013ered)32 b(b)n(y)f(suc)n(h)g(a)h (system)f(as)i(a)f(one-time)f(passw)n(ord)i([SKEY])f(or)g(tic)n(k)n (eting)g(authen)n(tication)h([Kerb)r(eros].)54 b(The)208 2490 y(TCP)30 b(connection)g(is)g(vulnerable)f(to)h(an)n(y)n(one)f (with)h(a)g(TCP)g(pac)n(k)n(et)f(sni\013er)h(and)f(generator)i(lo)r (cated)f(on)g(the)f(path)208 2581 y(follo)n(w)n(ed)g(b)n(y)e(the)g (connection.)41 b(Some)27 b(sc)n(hemes)g(to)h(detect)f(this)h(attac)n (k)f(are)h(presen)n(ted)g(as)g(w)n(ell)h(as)f(some)f(metho)r(ds)208 2673 y(of)f(prev)n(en)n(tion)f(and)g(some)h(in)n(teresting)g(details)g (of)h(the)e(TCP)i(proto)r(col)g(b)r(eha)n(viors.)0 2867 y Fr(1)135 b(In)l(tro)t(duction)0 3085 y Fq(P)n(assiv)n(e)23 b(attac)n(ks)h(using)h(sni\013ers)f(are)h(b)r(ecoming)f(more)h(and)0 3185 y(more)j(frequen)n(t)h(on)f(the)i(In)n(ternet.)40 b(The)29 b(attac)n(k)n(er)e(obtains)0 3285 y(a)33 b(user)f(id)i(and)f (passw)n(ord)e(that)j(allo)n(ws)d(him)j(to)f(logon)f(as)0 3384 y(that)45 b(user.)88 b(In)45 b(order)e(to)i(prev)n(en)n(t)f(suc)n (h)g(attac)n(ks)g(p)r(eo-)0 3484 y(ple)d(ha)n(v)n(e)e(b)r(een)i(using)g (iden)n(ti\014cation)f(sc)n(hemes)g(suc)n(h)g(as)0 3583 y(one-time)26 b(passw)n(ord)e([SKEY)o(])i(or)f(tic)n(k)n(eting)h(iden)n (ti\014cation)0 3683 y([Kerb)r(eros)n(].)65 b(Though)37 b(they)g(prev)n(en)n(t)f(passw)n(ord)f(sni\016ng)0 3783 y(on)c(an)g(unsecure)g(net)n(w)n(ork)f(these)i(metho)r(ds)g(are)e (still)i(vul-)0 3882 y(nerable)k(to)h(an)f(activ)n(e)g(attac)n(k)g(as)g (long)g(as)h(they)g(neither)0 3982 y(encrypt)24 b(nor)g(sign)h(the)g (data)f(stream.)1208 3952 y Fp(1)1280 3982 y Fq(Still)h(man)n(y)g(p)r (eople)0 4082 y(are)f(complacen)n(t)h(b)r(elieving)g(that)h(activ)n(e)e (attac)n(ks)g(are)h(v)n(ery)0 4181 y(di\016cult)j(and)g(hence)f(a)h (lesser)e(risk.)125 4301 y(The)31 b(follo)n(wing)g(pap)r(er)g(describ)r (es)g(an)h(extremely)f(sim-)0 4400 y(ple)c(activ)n(e)f(attac)n(k)f (whic)n(h)i(has)f(b)r(een)h(successfully)f(used)h(to)0 4500 y(break)32 b(in)n(to)i Fo(Unix)f Fq(hosts)f(and)i(whic)n(h)f(can)g (b)r(e)h(done)f(with)0 4600 y(the)h(same)f(resources)e(as)i(for)g(a)h (passiv)n(e)e(sni\016ng)h(attac)n(k.)1872 4569 y Fp(2)0 4699 y Fq(Some)c(uncommon)g(b)r(eha)n(viors)f(of)i(the)f(TCP)g(proto)r (col)g(are)0 4799 y(also)24 b(presen)n(ted)g(as)g(w)n(ell)g(as)h(some)f (real)g(examples)g(and)g(sta-)0 4898 y(tistical)f(studies)g(of)h(the)f (attac)n(k's)f(impact)h(on)g(the)h(net)n(w)n(ork.)0 4998 y(Finally)38 b(some)f(detection)h(and)f(prev)n(en)n(tion)g(sc)n(hemes)g (are)0 5098 y(explained.)77 b(In)41 b(order)e(to)i(help)g(an)n(y)f (reader)g(unfamiliar)1992 2867 y(with)c(the)h(subtleties)g(of)f(the)h (TCP)f(proto)r(col)f(the)i(article)1992 2966 y(starts)26 b(with)i(a)g(short)e(description)h(of)h(TCP)-7 b(.)2116 3067 y(The)23 b(reader)e(can)i(also)e(refers)h(to)h(another)e(attac)n (k)h(b)n(y)h(R.)1992 3166 y(Morris)d(presen)n(ted)i(in)g([Morris85)n (].)35 b(Though)22 b(the)g(follo)n(wing)1992 3266 y(attac)n(k)j(is)h (related)g(to)g(Morris')f(one,)h(it)h(is)f(more)f(widely)h(us-)1992 3366 y(able)e(on)g(an)n(y)g(TCP)g(connection.)36 b(In)25 b(section)f(7)g(w)n(e)h(presen)n(t)1992 3465 y(and)i(compare)f(this)i (attac)n(k)f(with)h(the)g(presen)n(t)f(one.)2116 3566 y(The)44 b(presen)n(tation)f(of)g(the)i(attac)n(k)e(will)h(b)r(e)g (divided)1992 3666 y(in)n(to)c(three)g(parts:)61 b(the)41 b(\\Established)e(State")h(whic)n(h)g(is)1992 3765 y(the)35 b(state)h(where)f(the)h(session)e(is)h(op)r(en)h(and)f(data)g(is)h(ex-) 1992 3865 y(c)n(hanged;)i(the)e(set)f(up)h(\(or)f(op)r(ening\))g(of)h (suc)n(h)f(a)g(session;)1992 3964 y(and)27 b(\014nally)g(some)g(real)g (examples.)1992 4244 y Fr(2)134 b(Established)46 b(State)1992 4444 y Fn(2.1)112 b(The)38 b(TCP)e(proto)s(col)1992 4600 y Fq(This)k(section)g(o\013ers)f(a)h(short)f(description)h(of)g(the)h (TCP)1992 4699 y(proto)r(col.)108 b(F)-7 b(or)51 b(more)g(details)g (the)h(reader)e(can)i(refer)1992 4799 y(to)38 b([RF)n(C)27 b(793)o(].)69 b(TCP)38 b(pro)n(vides)f(a)g(full)i(duplex)g(reliable) 1992 4898 y(stream)33 b(connection)h(b)r(et)n(w)n(een)h(t)n(w)n(o)f (end)g(p)r(oin)n(ts.)58 b(A)35 b(con-)1992 4998 y(nection)27 b(is)h(uniquely)g(de\014ned)g(b)n(y)g(the)g(quadruple)f(\(IP)h(ad-)1992 5098 y(dress)h(of)i(sender,)f(TCP)h(p)r(ort)f(n)n(um)n(b)r(er)g(of)h (the)g(sender,)g(IP)p 0 5165 1560 4 v 92 5218 a Fm(1)127 5242 y Fl(Kerb)r(eros)23 b(also)h(pro)n(vides)g(an)g(encrypted)h(TCP)f (stream)e(option.)92 5298 y Fm(2)127 5321 y Fl(The)27 b(attac)n(ks)h(ha)n(v)n(e)f(b)r(een)h(p)r(erformed)d(with)h(a)h(test)g (soft)n(w)n(are)f(and)h(the)h(users)d(w)n(ere)i(a)n(w)n(are)g(of)f(the) h(attac)n(k.)41 b(Although)27 b(w)n(e)g(do)g(not)g(ha)n(v)n(e)0 5400 y(an)n(y)d(kno)n(wledge)h(of)f(suc)n(h)g(an)g(attac)n(k)i(b)r (eing)e(used)g(on)g(the)g(In)n(ternet,)i(it)d(ma)n(y)g(b)r(e)h(p)r (ossible.)p eop 2 1 bop 0 83 a Fq(address)29 b(of)h(the)g(receiv)n(er,)f(TCP)h(p)r(ort) g(n)n(um)n(b)r(er)g(of)g(the)g(re-)0 183 y(ceiv)n(er\).)44 b(Ev)n(ery)29 b(b)n(yte)h(that)g(is)h(sen)n(t)f(b)n(y)g(a)g(host)g(is)g (mark)n(ed)0 282 y(with)j(a)e(sequence)h(n)n(um)n(b)r(er)g(\(32)f(bits) i(in)n(teger\))e(and)h(is)g(ac-)0 382 y(kno)n(wledged)25 b(b)n(y)g(the)i(receiv)n(er)d(using)h(this)h(sequence)g(n)n(um-)0 482 y(b)r(er.)53 b(The)33 b(sequence)f(n)n(um)n(b)r(er)h(for)f(the)h (\014rst)g(b)n(yte)g(sen)n(t)g(is)0 581 y(computed)26 b(during)g(the)g(connection)g(op)r(ening.)36 b(It)26 b(c)n(hanges)0 681 y(for)37 b(an)n(y)h(new)f(connection)h(based)f(on)h (rules)f(designed)h(to)0 780 y(a)n(v)n(oid)24 b(reuse)g(of)h(the)h (same)f(sequence)f(n)n(um)n(b)r(er)h(for)g(t)n(w)n(o)f(dif-)0 880 y(feren)n(t)j(sessions)g(of)g(a)g(TCP)h(connection.)125 980 y(W)-7 b(e)27 b(shall)g(assume)g(in)g(this)h(do)r(cumen)n(t)f(that) h(one)e(p)r(oin)n(t)0 1079 y(of)i(the)g(connection)f(acts)g(as)g(a)h (serv)n(er)d(\(for)j(instance)f(a)h(tel-)0 1179 y(net)d(serv)n(er\))e (and)i(the)g(other)f(as)h(the)g(clien)n(t.)36 b(The)25 b(follo)n(wing)0 1279 y(terms)i(will)h(b)r(e)g(used:)0 1456 y Fk(SVR)p 203 1456 29 4 v 34 w(SEQ:)41 b Fq(sequence)24 b(n)n(um)n(b)r(er)g(of)h(the)g(next)g(b)n(yte)g(to)f(b)r(e)208 1556 y(sen)n(t)j(b)n(y)g(the)h(serv)n(er;)0 1720 y Fk(SVR)p 203 1720 V 34 w(A)m(CK:)42 b Fq(next)30 b(b)n(yte)h(to)f(b)r(e)h (receiv)n(ed)e(b)n(y)i(the)f(serv)n(er)208 1820 y(\(the)f(sequence)g(n) n(um)n(b)r(er)f(of)h(the)g(last)g(b)n(yte)g(receiv)n(ed)208 1920 y(plus)e(one\);)0 2084 y Fk(SVR)p 203 2084 V 34 w(WIND:)41 b Fq(serv)n(er's)26 b(receiv)n(e)g(windo)n(w;)0 2248 y Fk(CL)-8 b(T)p 190 2248 V 35 w(SEQ:)41 b Fq(sequence)26 b(n)n(um)n(b)r(er)g(of)g(the)h(next)g(b)n(yte)f(to)g(b)r(e)208 2347 y(sen)n(t)h(b)n(y)g(the)h(clien)n(t;)0 2512 y Fk(CL)-8 b(T)p 190 2512 V 35 w(A)m(CK:)42 b Fq(next)27 b(b)n(yte)h(to)f(b)r(e)h (receiv)n(ed)f(b)n(y)g(the)h(clien)n(t;)0 2676 y Fk(CL)-8 b(T)p 190 2676 V 35 w(WIND:)41 b Fq(clien)n(t's)28 b(receiv)n(e)e (windo)n(w;)125 2845 y(A)n(t)48 b(the)h(b)r(eginning)g(when)f(no)g (data)g(has)g(b)r(een)h(ex-)0 2937 y(c)n(hanged)j(w)n(e)g(ha)n(v)n(e)f Fj(S)5 b(V)19 b(R)p 901 2937 25 4 v 30 w(S)5 b(E)g(Q)64 b Fq(=)g Fj(C)6 b(LT)p 1493 2937 V 41 w(AC)g(K)59 b Fq(and)0 3028 y Fj(C)6 b(LT)p 187 3028 V 41 w(S)f(E)g(Q)27 b Fq(=)h Fj(S)5 b(V)19 b(R)p 712 3028 V 30 w(AC)6 b(K)g Fq(.)47 b(These)30 b(equations)g(are)g(also)0 3119 y(true)22 b(when)f(the)h(connection)f(is)h(in)g(a)f('quiet')h(state)f(\(no)h (data)0 3211 y(b)r(eing)34 b(sen)n(t)f(on)h(eac)n(h)e(side\).)56 b(They)33 b(are)g(not)g(true)h(during)0 3302 y(transitory)20 b(states)h(when)g(data)g(is)g(sen)n(t.)35 b(The)21 b(more)g(general)0 3393 y(equations)27 b(are:)9 3551 y Fi(C)5 b(LT)p 181 3551 24 4 v 38 w(AC)g(K)27 b Fh(\024)21 b Fi(S)t(V)c(R)p 671 3551 V 28 w(S)t(E)t(Q)k Fh(\024)g Fi(C)5 b(LT)p 1142 3551 V 39 w(AC)g(K)22 b Fs(+)17 b Fi(C)5 b(LT)p 1619 3551 V 38 w(W)11 b(I)6 b(N)i(D)5 3710 y(S)t(V)17 b(R)p 181 3710 V 28 w(AC)5 b(K)27 b Fh(\024)21 b Fi(C)5 b(LT)p 667 3710 V 38 w(S)t(E)t(Q)21 b Fh(\024)g Fi(S)t(V)c(R)p 1141 3710 V 29 w(AC)5 b(K)22 b Fs(+)17 b Fi(S)t(V)g(R)p 1623 3710 V 28 w(W)11 b(I)6 b(N)i(D)125 3940 y Fq(The)27 b(TCP)g(pac)n(k)n(et)g(header)g(\014elds)g(are:)0 4118 y Fk(Source)32 b(P)m(ort:)42 b Fq(The)28 b(source)e(p)r(ort)h(n)n(um)n (b)r(er;)0 4282 y Fk(Destination)k(P)m(ort:)42 b Fq(The)27 b(destination)h(p)r(ort)f(n)n(um)n(b)r(er;)0 4446 y Fk(Sequence)32 b(n)m(um)m(b)s(er:)40 b Fq(The)48 b(sequence)f(n)n(um)n(b)r(er)g(of)g (the)208 4546 y(\014rst)27 b(b)n(yte)g(in)h(this)g(pac)n(k)n(et;)0 4710 y Fk(Ac)m(kno)m(wledgmen)m(t)j(Num)m(b)s(er:)40 b Fq(The)97 b(exp)r(ected)h(se-)208 4810 y(quence)25 b(n)n(um)n(b)r(er)h(of)g(the)g(next)h(b)n(yte)e(to)h(b)r(e)h(receiv)n (ed;)0 4974 y Fk(Data)33 b(O\013set:)40 b Fq(O\013set)28 b(of)f(the)h(data)f(in)h(the)g(pac)n(k)n(et;)0 5138 y Fk(Con)m(trol)k(Bits:)208 5269 y(UR)m(G:)41 b Fq(Urgen)n(t)27 b(P)n(oin)n(ter;)208 5400 y Fk(A)m(CK:)41 b Fq(Ac)n(kno)n(wledgmen)n (t;)2199 83 y Fk(PSH:)g Fq(Push)27 b(F)-7 b(unction;)2199 222 y Fk(RST:)41 b Fq(Reset)28 b(the)g(connection;)2199 361 y Fk(SYN:)41 b Fq(Sync)n(hronize)27 b(sequence)g(n)n(um)n(b)r(ers;) 2199 501 y Fk(FIN:)41 b Fq(No)28 b(more)e(data)h(from)h(sender;)1992 679 y Fk(Windo)m(w:)40 b Fq(Windo)n(w)27 b(size)h(of)f(the)h(sender;) 1992 858 y Fk(Chec)m(ksum:)40 b Fq(TCP)25 b(c)n(hec)n(ksum)f(of)i(the)g (header)e(and)i(data;)1992 1037 y Fk(Urgen)m(t)32 b(P)m(oin)m(ter:)42 b Fq(TCP)27 b(urgen)n(t)g(p)r(oin)n(ter;)1992 1216 y Fk(Options:)39 b Fq(TCP)27 b(options;)2116 1408 y Fg(\017)41 b Fj(S)5 b(E)g(G)p 2391 1408 25 4 v 30 w(S)g(E)g(Q)44 b Fq(will)g(refer)f(to)h(the)h(pac)n(k)n(et)e(sequence)2199 1508 y(n)n(um)n(b)r(er)27 b(\(as)h(seen)f(in)h(the)g(header\).)2116 1686 y Fg(\017)41 b Fj(S)5 b(E)g(G)p 2391 1686 V 30 w(AC)h(K)27 b Fq(will)21 b(refer)e(to)i(the)g(pac)n(k)n(et)f(ac)n(kno)n(wledg-)2199 1786 y(men)n(t)28 b(n)n(um)n(b)r(er.)2116 1965 y Fg(\017)41 b Fj(S)5 b(E)g(G)p 2391 1965 V 30 w(F)12 b(LAG)28 b Fq(will)f(refer)g (to)h(the)g(con)n(trol)e(bits.)1992 2160 y(On)c(a)h(t)n(ypical)f(pac)n (k)n(et)g(sen)n(t)h(b)n(y)f(the)i(clien)n(t)f(\(no)g(retransmis-)1992 2260 y(sion\))i Fj(S)5 b(E)g(G)p 2385 2260 V 30 w(S)g(E)g(Q)25 b Fq(is)g(set)h(to)f Fj(C)6 b(LT)p 3118 2260 V 41 w(S)f(E)g(Q)p Fq(,)26 b Fj(S)5 b(E)g(G)p 3572 2260 V 30 w(AC)h(K)31 b Fq(to)1992 2359 y Fj(C)6 b(LT)p 2178 2359 V 40 w(AC)g(K)g Fq(.)2116 2462 y(TCP)24 b(uses)g(a)h(\\three-w)n(a)n(y)d(handshak)n(e") h(to)h(establish)g(a)1992 2562 y(new)32 b(connection.)52 b(If)33 b(w)n(e)f(supp)r(ose)h(that)g(the)g(clien)n(t)g(initi-)1992 2661 y(ates)26 b(the)h(connection)f(to)h(the)g(serv)n(er)e(and)i(that)g (no)g(data)f(is)1992 2761 y(exc)n(hanged,)i(the)h(normal)f(pac)n(k)n (et)g(exc)n(hange)g(is)h(\(C.f.)42 b(Fig-)1992 2861 y(ure)27 b(1\):)2116 3056 y Fg(\017)41 b Fq(The)47 b(connection)f(on)g(the)h (clien)n(t)g(side)g(is)f(on)h(the)2199 3156 y(CLOSED)32 b(state.)52 b(The)33 b(one)f(on)h(the)g(serv)n(er)e(side)h(is)2199 3255 y(on)27 b(the)h(LISTEN)g(state.)2116 3434 y Fg(\017)41 b Fq(The)31 b(clien)n(t)h(\014rst)f(sends)g(its)h(initial)f(sequence)g (n)n(um-)2199 3534 y(b)r(er)d(and)f(sets)g(the)h(SYN)h(bit:)2526 3723 y Fj(S)5 b(E)g(G)p 2718 3723 V 30 w(S)g(E)g(Q)83 b Fq(=)f Fj(C)6 b(LT)p 3348 3723 V 41 w(S)f(E)g(Q)3561 3735 y Fp(0)3598 3723 y Fj(;)2465 3847 y(S)g(E)g(G)p 2657 3847 V 30 w(F)12 b(LAG)83 b Fq(=)f Fj(S)5 b(Y)19 b(N)2199 4036 y Fq(Its)28 b(state)f(is)h(no)n(w)f(SYN-SENT)2116 4215 y Fg(\017)41 b Fq(On)d(receipt)g(of)g(this)g(pac)n(k)n(et)f(the)i (serv)n(er)d(ac)n(kno)n(wl-)2199 4315 y(edges)21 b(the)h(clien)n(t)g (sequence)f(n)n(um)n(b)r(er,)i(sends)e(its)h(o)n(wn)2199 4414 y(initial)28 b(sequence)f(n)n(um)n(b)r(er)g(and)h(sets)f(the)h (SYN)g(bit:)2462 4598 y Fj(S)5 b(E)g(G)p 2654 4598 V 30 w(S)g(E)g(Q)82 b Fq(=)h Fj(S)5 b(V)18 b(R)p 3288 4598 V 31 w(S)5 b(E)g(Q)3501 4610 y Fp(0)3537 4598 y Fj(;)2445 4698 y(S)g(E)g(Q)p 2638 4698 V 29 w(AC)h(K)89 b Fq(=)83 b Fj(C)6 b(LT)p 3283 4698 V 40 w(S)f(E)g(Q)3496 4710 y Fp(0)3551 4698 y Fq(+)18 b(1)p Fj(;)2400 4797 y(S)5 b(E)g(G)p 2592 4797 V 30 w(F)12 b(LAG)83 b Fq(=)g Fj(S)5 b(Y)18 b(N)2199 4982 y Fq(and)27 b(set)2494 5171 y Fj(S)5 b(V)19 b(R)p 2686 5171 V 31 w(AC)6 b(K)29 b Fq(=)22 b Fj(C)6 b(LT)p 3212 5171 V 41 w(S)f(E)g(Q)3425 5183 y Fp(0)3480 5171 y Fq(+)18 b(1)2199 5400 y(Its)28 b(state)f(is)h(no)n(w)f (SYN-RECEIVED)p eop 3 2 bop 125 83 a Fg(\017)41 b Fq(On)f(receipt)g(of)h(this)f(pac)n(k)n (et)g(the)h(clien)n(t)g(ac)n(kno)n(wl-)208 183 y(edges)26 b(the)i(serv)n(er)e(sequence)h(n)n(um)n(b)r(er:)448 367 y Fj(S)5 b(E)g(G)p 640 367 25 4 v 30 w(S)g(E)g(Q)82 b Fq(=)h Fj(C)6 b(LT)p 1270 367 V 40 w(S)f(E)g(Q)1482 379 y Fp(0)1538 367 y Fq(+)18 b(1)p Fj(;)431 466 y(S)5 b(E)g(Q)p 624 466 V 29 w(AC)h(K)89 b Fq(=)83 b Fj(S)5 b(V)18 b(R)p 1274 466 V 31 w(S)5 b(E)g(Q)1487 478 y Fp(0)1542 466 y Fq(+)18 b(1)208 652 y(and)27 b(sets)503 841 y Fj(C)6 b(LT)p 690 841 V 41 w(AC)g(K)29 b Fq(=)22 b Fj(S)5 b(V)19 b(R)p 1221 841 V 30 w(S)5 b(E)g(Q)1433 853 y Fp(0)1489 841 y Fq(+)18 b(1)208 1031 y(Its)27 b(state)h(is)f(no)n(w)g(EST)-7 b(ABLISHED)125 1210 y Fg(\017)41 b Fq(On)31 b(receipt)g(of)h(this)f (pac)n(k)n(et)g(the)h(serv)n(er)d(en)n(ters)i(the)208 1310 y(EST)-7 b(ABLISHED)27 b(state.)37 b(W)-7 b(e)28 b(no)n(w)f(ha)n(v)n(e:)462 1478 y Fj(C)6 b(LT)p 649 1478 V 40 w(S)f(E)g(Q)83 b Fq(=)g Fj(C)6 b(LT)p 1278 1478 V 40 w(S)f(E)g(Q)1491 1490 y Fp(0)1546 1478 y Fq(+)18 b(1)445 1577 y Fj(C)6 b(LT)p 632 1577 V 41 w(AC)g(K)89 b Fq(=)83 b Fj(S)5 b(V)18 b(R)p 1283 1577 V 31 w(S)5 b(E)g(Q)1496 1589 y Fp(0)1551 1577 y Fq(+)18 b(1)457 1677 y Fj(S)5 b(V)19 b(R)p 649 1677 V 30 w(S)5 b(E)g(Q)83 b Fq(=)g Fj(S)5 b(V)18 b(R)p 1283 1677 V 31 w(S)5 b(E)g(Q)1496 1689 y Fp(0)1551 1677 y Fq(+)18 b(1)441 1776 y Fj(S)5 b(V)18 b(R)p 632 1776 V 31 w(AC)6 b(K)89 b Fq(=)83 b Fj(C)6 b(LT)p 1278 1776 V 40 w(S)f(E)g(Q)1491 1788 y Fp(0)1546 1776 y Fq(+)18 b(1)125 2002 y(Closing)38 b(a)h(connection)f (can)h(b)r(e)h(done)e(b)n(y)h(using)g(the)0 2102 y(FIN)f(or)f(the)h (RST)g(\015ag.)67 b(If)38 b(the)g(RST)g(\015ag)f(of)g(a)h(pac)n(k)n(et) 0 2201 y(is)h(set)g(the)h(receiving)d(host)i(en)n(ters)g(the)g(CLOSED)g (state)0 2301 y(and)32 b(frees)g(an)n(y)f(resource)g(asso)r(ciated)g (with)h(this)h(instance)0 2401 y(of)f(the)h(connection.)50 b(The)33 b(pac)n(k)n(et)e(is)h(not)h(ac)n(kno)n(wledged.)0 2500 y(An)n(y)25 b(new)g(incoming)g(pac)n(k)n(et)f(for)h(that)g (connection)g(will)g(b)r(e)0 2600 y(dropp)r(ed.)125 2703 y(If)e(the)g(FIN)g(\015ag)f(of)g(a)g(pac)n(k)n(et)g(is)h(set)f(the)h (receiving)f(host)0 2802 y(en)n(ters)37 b(the)i(CLOSE-W)-9 b(AIT)37 b(state)g(and)h(starts)f(the)i(pro-)0 2902 y(cess)31 b(of)g(gracefully)f(closing)g(the)h(connection.)47 b(The)32 b(detail)0 3002 y(of)24 b(that)g(pro)r(cces)f(is)h(b)r(ey)n(ond)f(the)i (scop)r(e)e(of)h(this)g(do)r(cumen)n(t.)0 3101 y(The)g(reader)f(can)h (refer)g(to)g([RF)n(C)k(793)n(])d(for)e(further)i(details.)125 3204 y(In)31 b(the)g(preceding)g(example)g(w)n(e)f(sp)r(eci\014cally)h (a)n(v)n(oided)0 3304 y(an)n(y)38 b(un)n(usual)h(cases)f(suc)n(h)h(as)f (out-of-band)h(pac)n(k)n(ets,)h(re-)0 3404 y(transmission,)60 b(loss)54 b(of)g(pac)n(k)n(et,)61 b(concurren)n(t)53 b(op)r(ening,)0 3503 y(etc...)60 b(These)34 b(can)h(b)r(e)h(ignored)d (in)j(this)f(simple)g(study)h(of)0 3603 y(the)28 b(attac)n(k.)125 3706 y(When)39 b(in)h(EST)-7 b(ABLISHED)39 b(state,)j(a)d(pac)n(k)n(et) f(is)h(ac-)0 3805 y(ceptable)c(if)g(its)h(sequence)e(n)n(um)n(b)r(er)h (falls)g(within)h(the)f(ex-)0 3905 y(p)r(ected)28 b(segmen)n(t)196 4094 y([)p Fj(S)5 b(V)19 b(R)p 411 4094 V 30 w(AC)6 b(K)q(;)14 b(S)5 b(V)19 b(R)p 863 4094 V 31 w(AC)6 b(K)24 b Fq(+)18 b Fj(S)5 b(V)19 b(R)p 1385 4094 V 30 w(W)12 b(I)7 b(N)i(D)r Fq(])0 4284 y(\(for)27 b(the)h(serv)n(er\))e(or)203 4473 y([)p Fj(C)6 b(LT)p 413 4473 V 41 w(AC)g(K)q(;)14 b(C)6 b(LT)p 861 4473 V 41 w(AC)g(K)24 b Fq(+)18 b Fj(C)6 b(LT)p 1378 4473 V 41 w(W)12 b(I)7 b(N)i(D)r Fq(])0 4663 y(\(for)37 b(the)i(clien)n(t\).)67 b(If)38 b(the)h(sequence)e(n)n(um)n(b)r(er)g (is)h(b)r(ey)n(ond)0 4762 y(those)i(limits)h(the)f(pac)n(k)n(et)f(is)i (dropp)r(ed)f(and)g(a)g(ac)n(kno)n(wl-)0 4862 y(edged)21 b(pac)n(k)n(et)f(will)h(b)r(e)g(sen)n(t)g(using)f(the)i(exp)r(ected)f (sequence)0 4962 y(n)n(um)n(b)r(er.)37 b(F)-7 b(or)27 b(example)g(if)602 5151 y Fj(S)5 b(E)g(G)p 794 5151 V 30 w(S)g(E)g(Q)82 b Fq(=)h(200)p Fj(;)586 5275 y(S)5 b(V)19 b(R)p 778 5275 V 30 w(AC)6 b(K)89 b Fq(=)83 b(100)p Fj(;)510 5400 y(S)5 b(V)19 b(R)p 702 5400 V 30 w(W)12 b(I)7 b(N)i(D)85 b Fq(=)e(50)1992 83 y(Then)2168 238 y Fj(S)5 b(E)g(G)p 2360 238 V 30 w(S)g(E)g(Q)22 b(>)h(S)5 b(V)19 b(R)p 2875 238 V 30 w(AC)6 b(K)25 b Fq(+)18 b Fj(S)5 b(V)18 b(R)p 3396 238 V 31 w(W)12 b(I)7 b(N)i(D)r(:)1992 394 y Fq(The)27 b(serv)n(er)f(forms)h(a)g(A)n(CK)g(pac)n(k)n(et)g(with) 2427 549 y Fj(S)5 b(E)g(G)p 2619 549 V 29 w(S)g(E)g(Q)83 b Fq(=)f Fj(S)5 b(V)19 b(R)p 3253 549 V 31 w(S)5 b(E)g(Q)2410 674 y(S)g(E)g(G)p 2602 674 V 30 w(AC)h(K)89 b Fq(=)82 b Fj(S)5 b(V)19 b(R)p 3253 674 V 31 w(AC)6 b(K)1992 829 y Fq(whic)n(h)24 b(is)g(what)h(the)g(serv)n(er)d(exp)r(ects)j(to)f(see) g(in)h(the)g(pac)n(k)n(et.)1992 1057 y Fn(2.2)112 b(A)37 b(desync)m(hronized)h(state)1992 1210 y Fq(The)18 b(term)h(\\desync)n (hronized)e(state")i(will)g(refer)f(to)h(the)g(con-)1992 1310 y(nection)33 b(when)g(b)r(oth)h(sides)f(are)g(in)g(the)h(EST)-7 b(ABLISHED)1992 1410 y(state,)27 b(no)g(data)g(is)h(b)r(eing)g(sen)n(t) f(\(stable)h(state\),)f(and)2419 1565 y Fj(S)5 b(V)18 b(R)p 2610 1565 V 31 w(S)5 b(E)g(Q)82 b Fg(6)p Fq(=)h Fj(C)6 b(LT)p 3240 1565 V 40 w(AC)g(K)2423 1690 y(C)g(LT)p 2610 1690 V 41 w(S)f(E)g(Q)82 b Fg(6)p Fq(=)h Fj(S)5 b(V)18 b(R)p 3244 1690 V 31 w(AC)6 b(K)2116 1845 y Fq(This)30 b(state)g(is)g(stable)g(as)g(long)g(as)f(no)h(data)g(is)g(sen)n(t.)45 b(If)1992 1945 y(some)27 b(data)g(is)g(sen)n(t)h(t)n(w)n(o)e(cases)h (can)g(o)r(ccur:)2093 2100 y(1.)41 b(If)j Fj(C)6 b(LT)p 2485 2100 V 41 w(S)f(E)g(Q)49 b(<)g(S)5 b(V)19 b(R)p 3053 2100 V 30 w(AC)6 b(K)35 b Fq(+)29 b Fj(S)5 b(V)19 b(R)p 3596 2100 V 30 w(W)12 b(I)7 b(N)i(D)2199 2200 y Fq(and)44 b Fj(C)6 b(LT)p 2564 2200 V 41 w(S)f(E)g(Q)50 b(>)h(S)5 b(V)18 b(R)p 3134 2200 V 31 w(AC)6 b(K)50 b Fq(the)45 b(pac)n(k)n(et)e(is)2199 2299 y(acceptable,)i(the)d(data)g (ma)n(y)f(b)r(e)h(stored)f(for)h(later)2199 2399 y(use)23 b(\(dep)r(ending)g(on)f(the)i(implemen)n(tation\))f(but)g(not)2199 2499 y(sen)n(t)49 b(to)g(the)g(user)f(since)h(the)g(b)r(eginning)g(of)g (the)2199 2598 y(stream)27 b(\(sequence)g(n)n(um)n(b)r(er)h Fj(S)5 b(V)18 b(R)p 3342 2598 V 31 w(AC)6 b(K)g Fq(\))28 b(is)g(miss-)2199 2698 y(ing.)2093 2853 y(2.)41 b(If)26 b Fj(C)6 b(LT)p 2467 2853 V 41 w(S)f(E)g(Q)22 b(>)h(S)5 b(V)19 b(R)p 2982 2853 V 30 w(AC)6 b(K)21 b Fq(+)14 b Fj(S)5 b(V)19 b(R)p 3496 2853 V 30 w(W)12 b(I)7 b(N)i(D)28 b Fq(or)2199 2953 y Fj(C)6 b(LT)p 2386 2953 V 41 w(S)f(E)g(Q)23 b(<)g(S)5 b(V)18 b(R)p 2901 2953 V 31 w(AC)6 b(K)34 b Fq(the)28 b(pac)n(k)n(et)f(is)h(not)g(ac-)2199 3052 y(ceptable)e(and)g (will)g(b)r(e)h(dropp)r(ed.)36 b(The)26 b(data)f(is)h(lost.)2116 3208 y(In)g(b)r(oth)g(case)f(data)g(exc)n(hange)g(is)g(not)h(p)r (ossible)f(ev)n(en)h(if)1992 3307 y(the)h(state)h(exists.)1992 3535 y Fn(2.3)112 b(The)38 b(attac)m(k)1992 3688 y Fq(The)21 b(prop)r(osed)f(attac)n(k)g(consists)g(of)h(creating)f(a)h(desync)n (hro-)1992 3788 y(nized)34 b(state)f(on)h(b)r(oth)g(ends)g(of)g(the)g (TCP)f(connection)h(so)1992 3888 y(that)23 b(the)g(t)n(w)n(o)f(p)r(oin) n(ts)g(cannot)h(exc)n(hange)e(data)h(an)n(y)g(longer.)1992 3987 y(A)30 b(third)g(part)n(y)f(host)h(is)g(then)h(used)f(to)g(create) f(acceptable)1992 4087 y(pac)n(k)n(ets)c(for)g(b)r(oth)i(ends)f(whic)n (h)h(mimics)f(the)h(real)e(pac)n(k)n(ets.)2116 4186 y(Assume)32 b(that)h(the)g(TCP)f(session)f(is)h(in)h(a)f(desync)n(hro-)1992 4286 y(nized)27 b(state)h(and)f(that)h(the)g(clien)n(t)g(sends)f(a)g (pac)n(k)n(et)g(with)2429 4442 y Fj(S)5 b(E)g(G)p 2621 4442 V 30 w(S)g(E)g(Q)82 b Fq(=)h Fj(C)6 b(LT)p 3250 4442 V 40 w(S)f(E)g(Q)2412 4566 y(S)g(E)g(G)p 2604 4566 V 30 w(AC)h(K)89 b Fq(=)83 b Fj(C)6 b(LT)p 3250 4566 V 40 w(AC)g(K)1992 4722 y Fq(Since)42 b Fj(C)6 b(LT)p 2410 4722 V 41 w(S)f(E)g(Q)48 b Fg(6)p Fq(=)f Fj(S)5 b(V)19 b(R)p 2975 4722 V 30 w(AC)6 b(K)49 b Fq(the)43 b(data)f(will)h(not)1992 4821 y(b)r(e)37 b(accepted)g(and)g(the)h(pac)n (k)n(et)e(is)i(dropp)r(ed.)66 b(The)37 b(third)1992 4921 y(part)n(y)g(then)j(sends)e(the)h(same)f(pac)n(k)n(et)g(but)h(c)n (hanges)f(the)1992 5020 y Fj(S)5 b(E)g(G)p 2184 5020 V 29 w(S)g(E)g(Q)22 b Fq(and)g Fj(S)5 b(E)g(G)p 2766 5020 V 30 w(AC)h(K)28 b Fq(\(and)22 b(the)g(c)n(hec)n(ksum\))f(suc)n(h) 1992 5120 y(that)2410 5275 y Fj(S)5 b(E)g(G)p 2602 5275 V 30 w(S)g(E)g(Q)83 b Fq(=)f Fj(S)5 b(V)19 b(R)p 3237 5275 V 30 w(AC)6 b(K)q(;)2394 5400 y(S)f(E)g(G)p 2586 5400 V 30 w(AC)h(K)89 b Fq(=)82 b Fj(S)5 b(V)19 b(R)p 3237 5400 V 30 w(S)5 b(E)g(Q)p eop 4 3 bop 615 86 2671 4 v 613 178 4 92 v 935 150 a Ft(Serv)n(er)1541 b(Clien)n(t)p 3284 178 V 613 269 V 3284 269 V 613 360 V 916 333 a Fs(LISTEN)1483 b(CLOSED)p 3284 360 V 613 560 4 200 v 1552 479 a Fh( )1650 364 y Ff(\032)1754 433 y Fi(S)t(Y)16 b(N)t(;)1754 524 y(C)5 b(LT)p 1926 524 24 4 v 38 w(S)t(E)t(Q)2122 532 y Fm(0)p 3284 560 4 200 v 613 651 4 92 v 916 623 a Fs(LISTEN)1446 b(SYN-SENT)p 3284 651 V 613 925 4 274 v 1607 715 a Fi(S)t(Y)17 b(N)t(;)1607 806 y(S)t(V)g(R)p 1783 806 24 4 v 28 w(S)t(E)t(Q)1979 814 y Fm(0)2013 806 y Fi(;)1607 897 y(C)5 b(LT)p 1779 897 V 38 w(S)t(E)t(Q)1975 905 y Fm(0)2027 897 y Fs(+)16 b(1)2183 667 y Ff(\))2272 807 y Fh(!)p 3284 925 4 274 v 613 1016 4 92 v 760 989 a Fs(SYN-RECEIVED)1212 b(EST)-6 b(ABLISHED)p 3284 1016 V 613 1381 4 366 v 2489 1080 a Fi(S)t(V)17 b(R)p 2665 1080 24 4 v 29 w(S)t(E)t(Q)k Fs(=)2655 1171 y Fi(C)5 b(LT)p 2828 1171 V 39 w(S)t(E)t(Q)3024 1179 y Fm(0)3075 1171 y Fs(+)17 b(1)2489 1263 y Fi(C)5 b(LT)p 2662 1263 V 39 w(AC)g(K)26 b Fs(=)2655 1354 y Fi(S)t(V)18 b(R)p 2832 1354 V 28 w(S)t(E)t(Q)3028 1362 y Fm(0)3079 1354 y Fs(+)f(1)p 3284 1381 4 366 v 613 1655 4 274 v 1552 1537 a Fh( )1650 1397 y Ff(\()1758 1445 y Fi(AC)5 b(K)q(;)1758 1537 y(C)g(LT)p 1931 1537 24 4 v 39 w(S)t(E)t(Q)2127 1545 y Fm(0)2178 1537 y Fs(+)17 b(1)1758 1628 y Fi(S)t(V)g(R)p 1934 1628 V 28 w(S)t(E)t(Q)2130 1636 y Fm(0)2182 1628 y Fs(+)f(1)p 3284 1655 4 274 v 613 1747 4 92 v 787 1719 a(EST)-6 b(ABLISHED)p 3284 1747 V 613 2112 4 366 v 706 1811 a Fi(S)t(V)17 b(R)p 882 1811 24 4 v 28 w(S)t(E)t(Q)k Fs(=)872 1902 y Fi(S)t(V)c(R)p 1048 1902 V 28 w(S)t(E)t(Q)1244 1910 y Fm(0)1295 1902 y Fs(+)g(1)706 1993 y Fi(S)t(V)g(R)p 882 1993 V 28 w(AC)5 b(K)27 b Fs(=)872 2085 y Fi(C)5 b(LT)p 1044 2085 V 38 w(S)t(E)t(Q)1240 2093 y Fm(0)1292 2085 y Fs(+)16 b(1)p 3284 2112 4 366 v 615 2115 2671 4 v 1165 2264 a Fq(Figure)27 b(1:)36 b(Example)27 b(of)g(a)h(connection)f(op)r(ening)0 2602 y(whic)n(h)33 b(is)g(acceptable)f(b)n(y)h(the)g(serv)n(er.)51 b(The)33 b(data)g(is)g(pro-)0 2701 y(cessed)27 b(b)n(y)g(the)h(serv)n (er.)125 2794 y(If)166 b Fj(C)6 b(LT)p 532 2794 25 4 v 40 w(T)12 b(O)p 688 2794 V 32 w(S)5 b(V)18 b(R)p 904 2794 V 31 w(O)r(F)12 b(F)g(S)5 b(E)g(T)177 b Fq(refers)165 b(to)0 2885 y Fj(S)5 b(V)19 b(R)p 192 2885 V 30 w(AC)6 b(K)261 b Fg(\000)254 b Fj(C)6 b(LT)p 1181 2885 V 41 w(S)f(E)g(Q)381 b Fq(and)0 2977 y Fj(S)5 b(V)19 b(R)p 192 2977 V 30 w(T)12 b(O)p 347 2977 V 32 w(C)6 b(LT)p 559 2977 V 40 w(O)r(F)12 b(F)g(S)5 b(E)g(T)65 b Fq(refers)53 b(to)g Fj(C)6 b(LT)p 1579 2977 V 41 w(AC)g(K)42 b Fg(\000)0 3068 y Fj(S)5 b(V)19 b(R)p 192 3068 V 30 w(S)5 b(E)g(Q)18 b Fq(then)h(the)g(\014rst)g(part)n(y)e(attac)n(k)n(er)g(has)h(to)g (rewrite)0 3159 y(the)28 b(TCP)f(pac)n(k)n(et)g(from)g(the)h(clien)n(t) g(to)f(the)h(serv)n(er)e(as:)32 3325 y Fi(S)t(E)t(G)p 209 3325 24 4 v 28 w(S)t(E)t(Q)21 b Fh( )g Fi(S)t(E)t(G)p 701 3325 V 28 w(S)t(E)t(Q)16 b Fs(+)h Fi(C)5 b(LT)p 1163 3325 V 39 w(T)11 b(O)p 1307 3325 V 29 w(S)t(V)17 b(R)p 1505 3325 V 29 w(O)r(F)11 b(F)g(S)t(E)t(T)17 3492 y(S)t(E)t(G)p 194 3492 V 28 w(AC)5 b(K)26 b Fh( )21 b Fi(S)t(E)t(G)p 701 3492 V 28 w(AC)5 b(K)22 b Fh(\000)17 b Fi(S)t(V)g(R)p 1182 3492 V 28 w(T)11 b(O)p 1326 3492 V 30 w(C)5 b(LT)p 1521 3492 V 38 w(O)r(F)11 b(F)g(S)t(E)t(T)50 3628 y Fq(Considering)48 b(that)i(the)f(attac)n(k)n(er)f(can)h(listen)h(to)f(an)n(y)0 3727 y(pac)n(k)n(et)40 b(exc)n(hanged)f(b)r(et)n(w)n(een)h(the)h(t)n(w) n(o)f(p)r(oin)n(ts)h(and)f(can)0 3827 y(forge)f(an)n(y)h(kind)h(of)g (IP)f(pac)n(k)n(et)f(\(therefore)h(masquerad-)0 3926 y(ing)j(as)f(either)h(the)h(clien)n(t)f(or)f(the)i(serv)n(er\))e(then)h (ev)n(ery-)0 4026 y(thing)33 b(acts)f(as)f(if)i(the)g(connection)f(go)r (es)g(through)f(the)i(at-)0 4126 y(tac)n(k)n(er)39 b(mac)n(hine.)77 b(This)41 b(one)g(can)f(add)h(or)f(remo)n(v)n(e)f(an)n(y)0 4225 y(data)48 b(to)g(the)g(stream.)98 b(F)-7 b(or)48 b(instance)g(if)h(the)f(connec-)0 4325 y(tion)35 b(is)f(a)h(remote)f (login)g(using)g(telnet)i(the)f(attac)n(k)n(er)e(can)0 4425 y(include)41 b(an)n(y)f(command)g(on)g(b)r(ehalf)h(of)f(the)h (user)f(\()p Fe(echo)0 4524 y(merit.edu)g(lpj)i(>&)h(~)14 b(/.rhosts)h Fq(is)k(an)f(example)g(of)h(suc)n(h)0 4624 y(a)43 b(command\))h(and)f(\014lter)g(out)h(an)n(y)f(un)n(w)n(an)n(ted) g(ec)n(ho)f(so)0 4723 y(that)34 b(the)h(user)e(will)h(not)g(b)r(e)g(a)n (w)n(are)e(of)i(the)g(in)n(truder.)56 b(Of)0 4823 y(course)46 b(in)h(this)h(case)e Fj(C)6 b(LT)p 954 4823 25 4 v 41 w(T)12 b(O)p 1110 4823 V 31 w(S)5 b(V)19 b(R)p 1326 4823 V 30 w(O)r(F)12 b(F)g(S)5 b(E)g(T)59 b Fq(and)0 4923 y Fj(S)5 b(V)19 b(R)p 192 4923 V 30 w(T)12 b(O)p 347 4923 V 32 w(C)6 b(LT)p 559 4923 V 40 w(O)r(F)12 b(F)g(S)5 b(E)g(T)40 b Fq(ha)n(v)n(e)28 b(to)g(c)n(hange.)39 b(The)29 b(new)0 5022 y(v)-5 b(alues)27 b(are)g(let)h(as)f(an)g(exercise)f(for)h (the)h(reader.)1551 4992 y Fp(3)1992 2602 y Fn(2.4)112 b(\\TCP)37 b(Ac)m(k)f(storm")1992 2934 y Fq(A)43 b(\015a)n(w)g(of)g (the)h(attac)n(k)e(is)h(the)h(generation)d(of)j(a)f Fd(lot)g Fq(of)1992 3033 y(TCP)d(A)n(CK)h(pac)n(k)n(ets.)77 b(When)42 b(receiving)e(an)h(unaccept-)1992 3133 y(able)30 b(pac)n(k)n(et)g(the)h (host)f(ac)n(kno)n(wledges)f(it)i(b)n(y)f(sending)h(the)1992 3233 y(exp)r(ected)41 b(sequence)g(n)n(um)n(b)r(er)g(\(As)h(the)g(Ac)n (knolegemen)n(t)1992 3332 y(n)n(um)n(b)r(er.)93 b(C.f.)g(in)n(tro)r (duction)47 b(ab)r(out)f(TCP\))g(and)g(us-)1992 3432 y(ing)36 b(its)i(o)n(wn)e(sequence)h(n)n(um)n(b)r(er.)65 b(This)37 b(pac)n(k)n(et)g(is)g(itself)1992 3532 y(unacceptable)29 b(and)h(will)g(generate)f(an)h(ac)n(kno)n(wledgemen)n(t)1992 3631 y(pac)n(k)n(et)j(whic)n(h)h(in)h(turn)f(will)h(generate)e(an)h(ac) n(kno)n(wledge-)1992 3731 y(men)n(t)24 b(pac)n(k)n(et)e(etc...)36 b(creating)23 b(a)g(supp)r(osedly)h(endless)f(lo)r(op)1992 3830 y(for)k(ev)n(ery)f(data)h(pac)n(k)n(et)g(sen)n(t.)2116 4026 y(Since)40 b(these)g(pac)n(k)n(ets)e(do)h(not)h(carry)e(data)h (they)h(are)1992 4126 y(not)34 b(retransmitted)g(if)h(the)g(pac)n(k)n (et)f(is)g(lost.)58 b(This)35 b(means)1992 4225 y(that)25 b(if)h(one)f(of)h(the)g(pac)n(k)n(ets)e(in)i(the)g(lo)r(op)f(is)g (dropp)r(ed)h(then)1992 4325 y(the)h(lo)r(op)g(ends.)36 b(F)-7 b(ortunately)27 b(\(or)g(unfortunately?\))37 b(TCP)1992 4425 y(uses)20 b(IP)g(on)h(an)f(unreliable)g(net)n(w)n(ork)g(la)n(y)n (er)f(with)i(a)f(non)h(n)n(ull)1992 4524 y(pac)n(k)n(et)28 b(loss)h(rate,)h(making)f(an)h(end)g(to)f(the)h(lo)r(ops.)43 b(More-)1992 4624 y(o)n(v)n(er)23 b(the)i(more)f(pac)n(k)n(ets)g(the)i (net)n(w)n(ork)d(drops,)i(the)g(shorter)1992 4723 y(is)20 b(the)h(Ac)n(k)g(storm)f(\(the)i(lo)r(op\).)34 b(W)-7 b(e)21 b(also)f(notice)h(that)g(these)1992 4823 y(lo)r(ops)e(are)g (self)h(regulating:)32 b(the)21 b(more)e(lo)r(ops)h(w)n(e)f(create)h (the)1992 4923 y(more)29 b(tra\016c)i(w)n(e)f(get,)h(the)g(more)f (congestion)g(and)g(pac)n(k)n(et)1992 5022 y(drops)c(w)n(e)h(exp)r (erience)h(and)f(the)h(more)f(lo)r(ops)g(are)f(killed.)p 0 5086 1560 4 v 92 5140 a Fm(3)127 5163 y Fl(One)i(can)g(turn)f(o\013)h (the)g(ec)n(ho)h(in)e(the)h(telnet)h(connection)g(in)e(order)h(to)f(a)n (v)n(oid)h(the)h(burden)f(of)f(\014ltering)g(the)h(output.)44 b(The)28 b(test)g(w)n(e)g(did)0 5242 y(sho)n(w)n(ed)d(up)f(a)h(bug)f (in)g(the)h(curren)n(t)g(telnet)g(implemen)n(tation)f(\(or)g(ma)n(yb)r (e)g(in)g(the)h(telnet)g(proto)r(col)g(itself)5 b(\).)32 b(If)24 b(a)h(TCP)f(pac)n(k)n(et)i(con)n(tains)f(b)r(oth)0 5321 y(IA)n(C)d(DONT)g(ECHO)g(and)h(IA)n(C)f(DO)g(ECHO)g(the)h(telnet)g (pro)r(cessor)g(will)e(answ)n(er)h(with)g(IA)n(C)h(W)n(ONT)f(ECHO)g (and)h(IA)n(C)f(WILL)h(ECHO.)e(The)0 5400 y(other)j(end)h(p)r(oin)n(t)f (will)e(ac)n(kno)n(wledge)k(IA)n(C)e(DONT)f(ECHO)g(and)h(IA)n(C)g(DO)f (ECHO)h(etc...)31 b(creating)25 b(an)f(endless)g(lo)r(op.)p eop 5 4 bop 125 83 a Fq(The)38 b(lo)r(op)g(is)g(created)g(eac)n(h)f(time)i (the)g(clien)n(t)g(or)e(the)0 183 y(serv)n(er)24 b(sends)h(data.)35 b(If)26 b(no)f(data)g(is)g(sen)n(t)h(no)f(lo)r(op)g(app)r(ears.)0 282 y(If)d(data)e(is)h(sen)n(t)g(and)g(no)g(attac)n(k)n(er)e(is)i (there)g(to)g(ac)n(kno)n(wledge)0 382 y(the)j(data)f(then)h(the)f(data) g(will)h(b)r(e)f(retransmitted,)h(a)f(storm)0 482 y(will)32 b(b)r(e)h(created)f(for)f(eac)n(h)h(retransmission,)f(and)h(ev)n(en)n (tu-)0 581 y(ally)39 b(the)g(connection)g(will)g(b)r(e)h(dropp)r(ed)f (since)g(no)g(A)n(CK)0 681 y(of)29 b(the)h(data)f(is)h(sen)n(t.)42 b(If)30 b(the)g(attac)n(k)n(er)d(ac)n(kno)n(wledges)g(the)0 780 y(data)22 b(then)h(only)g(one)f(storm)g(is)h(pro)r(duced)f(\(in)h (practice)f(the)0 880 y(attac)n(k)n(er)g(often)h(missed)h(the)g(data)f (pac)n(k)n(et)f(due)i(to)f(the)h(load)0 980 y(on)32 b(the)h(net)n(w)n (ork,)g(and)f(ac)n(kno)n(wledge)e(the)j(\014rst)g(of)f(subse-)0 1079 y(quen)n(t)c(retransmission\).)125 1179 y(The)42 b(attac)n(k)g(uses)g(the)h(second)f(t)n(yp)r(e)h(of)f(pac)n(k)n(et)g (de-)0 1279 y(scrib)r(ed)37 b(in)g(Section)g(2.2.)64 b(The)37 b(\014rst)g(case)f(in)h(whic)n(h)g(the)0 1378 y(data)25 b(is)g(stored)g(b)n(y)g(the)h(receiv)n(er)e(for)h(later)g (pro)r(cessing)f(has)0 1478 y(not)h(b)r(een)g(tested.)36 b(It)26 b(has)e(the)h(adv)-5 b(an)n(tage)23 b(of)i(not)g(generat-)0 1577 y(ing)i(the)h(A)n(CK)e(storm)h(but)h(on)f(the)g(other)g(hand)g(it) h(ma)n(y)e(b)r(e)0 1677 y(dangerous)f(if)i(the)g(data)f(is)g(actually)g (pro)r(cessed.)35 b(It)27 b(is)g(also)0 1777 y(di\016cult)h(to)g(use)f (with)h(small)g(windo)n(w)f(connections.)0 2044 y Fr(3)135 b(Setup)44 b(of)i(the)f(session)0 2226 y Fq(This)22 b(pap)r(er)g (presen)n(ts)f(t)n(w)n(o)h(metho)r(ds)h(for)e(desync)n(hronizing)0 2326 y(a)29 b(TCP)f(connection.)40 b(Others)28 b(can)h(b)r(e)g (imagined)g(but)g(will)0 2425 y(not)e(b)r(e)h(describ)r(ed)f(here.)36 b(W)-7 b(e)28 b(supp)r(ose)e(that)i(the)f(attac)n(k)n(er)0 2525 y(can)k(listen)g(to)g(ev)n(ery)e(pac)n(k)n(et)h(sen)n(t)h(b)r(et)n (w)n(een)g(the)g(t)n(w)n(o)f(end)0 2625 y(p)r(oin)n(ts.)0 2850 y Fn(3.1)112 b(Early)37 b(desync)m(hronization)0 3004 y Fq(This)e(metho)r(d)g(consists)f(of)h(breaking)e(the)i (connection)f(in)0 3103 y(its)24 b(early)f(setup)i(stage)e(on)h(the)g (serv)n(er)f(side)h(and)g(creating)f(a)0 3203 y(new)k(one)g(with)g (di\013eren)n(t)g(sequence)f(n)n(um)n(b)r(er.)37 b(Here)26 b(is)h(the)0 3302 y(pro)r(cess)f(\(Figure)i(2)f(summarizes)f(this)i (pro)r(cess\))125 3445 y Fg(\017)41 b Fq(The)j(attac)n(k)n(er)f (listens)h(for)g(a)g(SYN/A)n(CK)h(pac)n(k)n(et)208 3545 y(from)21 b(the)i(serv)n(er)e(to)h(the)g(clien)n(t)h(\(stage)e(2)h(in)h (the)f(con-)208 3645 y(nection)27 b(set)h(up\).)125 3795 y Fg(\017)41 b Fq(On)28 b(detection)h(of)g(that)g(pac)n(k)n(et)f(the)i (attac)n(k)n(er)d(sends)208 3894 y(the)21 b(serv)n(er)e(a)i(RST)g(pac)n (k)n(et)f(and)h(then)h(a)f(SYN)h(pac)n(k)n(et)208 3994 y(with)31 b(exactly)g(the)g(same)g(parameters)e(\(TCP)i(p)r(ort\))208 4094 y(but)26 b(a)g(di\013eren)n(t)g(sequence)g(n)n(um)n(b)r(er)g (\(referred)f(to)h(as)208 4193 y Fj(AT)12 b(K)p 413 4193 25 4 v 34 w(AC)6 b(K)634 4205 y Fp(0)699 4193 y Fq(in)28 b(the)g(rest)f(of)h(the)g(pap)r(er\).)125 4343 y Fg(\017)41 b Fq(The)29 b(serv)n(er)f(will)i(close)f(the)i(\014rst)e(connection)g (when)208 4443 y(it)h(receiv)n(es)f(the)h(RST)g(pac)n(k)n(et)f(and)h (then)h(reop)r(ens)e(a)208 4543 y(new)39 b(one)g(on)f(the)i(same)f(p)r (ort)g(but)g(with)h(a)f(di\013er-)208 4642 y(en)n(t)31 b(sequence)h(n)n(um)n(b)r(er)f(\()p Fj(S)5 b(V)19 b(R)p 1231 4642 V 31 w(S)5 b(E)g(Q)1444 4612 y Fc(0)1444 4663 y Fp(0)1480 4642 y Fq(\))32 b(on)g(receipt)208 4742 y(of)27 b(the)h(SYN)h(pac)n(k)n(et.)36 b(It)28 b(sends)f(bac)n(k)g(a)g(SYN/A)n (CK)208 4841 y(pac)n(k)n(et)f(to)i(the)g(clien)n(t.)125 4992 y Fg(\017)41 b Fq(On)28 b(detection)h(of)g(that)g(pac)n(k)n(et)f (the)i(attac)n(k)n(er)d(sends)208 5091 y(the)k(serv)n(er)f(a)h(A)n(CK)f (pac)n(k)n(et.)47 b(The)32 b(serv)n(er)d(switc)n(hes)208 5191 y(to)e(the)h(EST)-7 b(ABLISHED)28 b(state.)2116 83 y Fg(\017)41 b Fq(The)49 b(clien)n(t)h(has)e(already)g(switc)n(hed)h (to)g(the)h(ES-)2199 183 y(T)-7 b(ABLISHED)44 b(state)f(when)g(it)h (receiv)n(es)e(the)h(\014rst)2199 282 y(SYN/A)n(CK)27 b(pac)n(k)n(et)g(from)g(the)h(serv)n(er.)2116 444 y(This)d(diagram)f (do)r(es)h(not)g(sho)n(w)g(the)g(unacceptable)g(ac-)1992 535 y(kno)n(wledgemen)n(t)31 b(pac)n(k)n(et)h(exc)n(hanges.)50 b(Both)33 b(ends)f(are)g(in)1992 627 y(the)27 b(desync)n(hronized)g (EST)-7 b(ABLISHED)27 b(state)h(no)n(w.)1998 779 y Fi(S)t(V)17 b(R)p 2174 779 24 4 v 29 w(T)11 b(O)p 2319 779 V 29 w(C)5 b(LT)p 2514 779 V 39 w(O)r(F)11 b(F)g(S)t(E)t(T)31 b Fs(=)22 b Fi(S)t(V)17 b(R)p 3163 779 V 28 w(S)t(E)t(Q)3359 787 y Fm(0)3410 779 y Fh(\000)g Fi(S)t(V)g(R)p 3663 779 V 28 w(S)t(E)t(Q)3859 743 y Fb(0)3859 792 y Fm(0)2019 931 y Fq(is)28 b(\014xed)f(b)n(y)h(the)g(serv)n(er.)1994 1082 y Fi(C)5 b(LT)p 2167 1082 V 39 w(T)11 b(O)p 2311 1082 V 30 w(S)t(V)17 b(R)p 2510 1082 V 28 w(O)r(F)11 b(F)g(S)t(E)t(T)32 b Fs(=)21 b Fi(AT)11 b(K)p 3172 1082 V 32 w(S)t(E)t(Q)3367 1090 y Fm(0)3418 1082 y Fh(\000)17 b Fi(C)5 b(LT)p 3667 1082 V 38 w(S)t(E)t(Q)3863 1090 y Fm(0)2019 1243 y Fq(is)28 b(\014xed)f(b)n(y)h(the)g(attac)n(k)n(er.) 2116 1342 y(The)43 b(success)e(of)h(the)h(attac)n(k)f(relies)g(on)g (the)g(correct)1992 1442 y(v)-5 b(alue)395 b(b)r(eing)i(c)n(hosen)e (for)1992 1542 y Fj(C)6 b(LT)p 2178 1542 25 4 v 40 w(T)12 b(O)p 2334 1542 V 32 w(S)5 b(V)18 b(R)p 2550 1542 V 31 w(O)r(F)12 b(F)g(S)5 b(E)g(T)12 b Fq(.)54 b(W)-7 b(rong)33 b(v)-5 b(alue)34 b(ma)n(y)f(mak)n(e)1992 1641 y(the)k(clien)n(t's)h (pac)n(k)n(et)f(acceptable)f(and)i(can)f(pro)r(duce)g(un-)1992 1741 y(w)n(an)n(ted)26 b(e\013ects.)1992 1971 y Fn(3.2)112 b(Null)35 b(data)k(desync)m(hronization)1992 2124 y Fq(This)e(metho)r (d)i(consists)e(for)g(the)h(attac)n(k)n(er)e(in)i(sending)f(a)1992 2224 y(large)27 b(amoun)n(t)h(of)g(data)g(to)h(the)g(serv)n(er)d(and)j (to)f(the)h(clien)n(t.)1992 2324 y(The)k(data)g(sen)n(t)g(shouldn't)h (a\013ect)g(nor)e(b)r(e)i(visible)f(to)h(the)1992 2423 y(clien)n(t)39 b(or)g(sev)n(er,)i(but)g(will)f(put)g(b)r(oth)g(end)g (of)g(the)g(TCP)1992 2523 y(session)26 b(in)i(the)g(desync)n(hronized)e (state.)2116 2622 y(The)35 b(follo)n(wing)f(sc)n(heme)g(can)h(b)r(e)g (used)g(with)g(a)f(telnet)1992 2722 y(session:)2116 2892 y Fg(\017)41 b Fq(The)30 b(attac)n(k)n(er)f(w)n(atc)n(hs)g(the)h (session)f(without)i(in)n(ter-)2199 2992 y(fering.)2116 3145 y Fg(\017)41 b Fq(When)h(appropriate)d(the)i(attac)n(k)n(er)e (sends)i(a)g(large)2199 3236 y(amoun)n(t)j(of)h(\\n)n(ull)g(data")e(to) i(the)g(serv)n(er.)87 b(\\Null)2199 3327 y(data")38 b(refers)g(to)h (data)f(that)h(will)g(not)g(a\013ect)g(an)n(y-)2199 3418 y(thing)63 b(on)g(the)h(serv)n(er)d(side)i(b)r(esides)g(c)n(hanging) 2199 3510 y(the)50 b(TCP)e(ac)n(kno)n(wledgmen)n(t)f(n)n(um)n(b)r(er.) 102 b(F)-7 b(or)48 b(in-)2199 3601 y(stance)31 b(with)i(a)e Fd(telnet)g Fq(session)g(the)h(attac)n(k)n(er)e(sends)2199 3692 y Fj(AT)12 b(K)p 2404 3692 V 35 w(S)5 b(V)18 b(R)p 2619 3692 V 31 w(O)r(F)12 b(F)g(S)5 b(E)g(T)49 b Fq(b)n(ytes)37 b(consisting)g(of)h(the)2199 3784 y(sequence)43 b Fd(IA)n(C)h(NOP)g(IA) n(C)g(NOP...)84 b Fq(Ev)n(ery)42 b(t)n(w)n(o)2199 3875 y(b)n(ytes)30 b Fd(IA)n(C)h(NOP)f Fq(will)g(b)r(e)h(in)n(terpreted)e(b) n(y)h(the)g(tel-)2199 3966 y(net)i(daemon,)g(remo)n(v)n(ed)e(from)h (the)h(stream)e(of)i(data)2199 4058 y(and)f(nothing)g(will)g(b)r(e)g (a\013ected.)3250 4028 y Fp(4)3335 4058 y Fq(No)n(w)f(the)i(Serv)n(er) 2199 4149 y(has)2199 4301 y Fi(S)t(V)17 b(R)p 2375 4301 24 4 v 28 w(AC)5 b(K)27 b Fs(=)21 b Fi(C)5 b(LT)p 2861 4301 V 38 w(S)t(E)t(Q)13 b Fs(+)f Fi(AT)f(K)p 3331 4301 V 32 w(S)t(V)17 b(R)p 3529 4301 V 29 w(O)r(F)11 b(F)g(S)t(E)t(T)2227 4461 y Fq(whic)n(h)27 b(of)h(course)e(is)i(desync)n(hronized.)2116 4622 y Fg(\017)41 b Fq(The)49 b(attac)n(k)n(er)e(do)r(es)i(the)g(same)g (thing)g(with)h(the)2199 4722 y(clien)n(t.)2116 4892 y(The)22 b(metho)r(d)h(is)f(useful)h(if)g(the)g(session)e(can)h(carry)e (\\n)n(ull)1992 4992 y(data".)34 b(The)22 b(time)h(when)g(the)g(attac)n (k)n(er)e(sends)h(that)h(data)f(is)1992 5091 y(also)29 b(v)n(ery)g(di\016cult)i(to)g(determine)f(and)g(ma)n(y)g(cause)g(some) 1992 5191 y(unpredictable)d(side)g(e\013ects.)p 0 5244 1560 4 v 92 5298 a Fm(4)127 5321 y Fl(The)21 b(telnet)g(proto)r(col)g ([RF)n(C)j(854])c(de\014nes)i(the)f(NOP)f(command)f(as)h(\\No)h(Op)r (eration".)31 b(In)21 b(other)g(w)n(ords,)f(do)g(nothing,)i(just)e (ignore)h(those)0 5400 y(b)n(ytes.)p eop 6 5 bop 592 86 2716 4 v 590 178 4 92 v 918 150 a Ft(Serv)n(er)1581 b(Clien)n(t)p 3306 178 V 590 269 V 3306 269 V 590 360 V 900 333 a Fs(LISTEN)1522 b(CLOSED)p 3306 360 V 590 560 4 200 v 1541 479 a Fh( )1639 364 y Ff(\032)1743 433 y Fi(S)t(Y)17 b(N)t(;)1743 524 y(C)5 b(LT)p 1915 524 24 4 v 38 w(S)t(E)t(Q)2111 532 y Fm(0)p 3306 560 4 200 v 590 651 4 92 v 744 623 a Fs(SYN-RECEIVED)1327 b(SYN-SENT)p 3306 651 V 590 925 4 274 v 1629 715 a Fi(S)t(Y)17 b(N)t(;)1629 806 y(S)t(V)g(R)p 1805 806 24 4 v 29 w(S)t(E)t(Q)2002 814 y Fm(0)2036 806 y Fi(;)1629 897 y(C)5 b(LT)p 1802 897 V 39 w(S)t(E)t(Q)1998 905 y Fm(0)2049 897 y Fs(+)17 b(1)2206 667 y Ff(\))2294 807 y Fh(!)p 3306 925 4 274 v 590 1016 4 92 v 2593 989 a Fs(EST)-6 b(ABLISHED)p 3306 1016 V 590 1381 4 366 v 2512 1080 a Fi(S)t(V)17 b(R)p 2688 1080 24 4 v 28 w(S)t(E)t(Q)k Fs(=)2678 1171 y Fi(C)5 b(LT)p 2850 1171 V 38 w(S)t(E)t(Q)3046 1179 y Fm(0)3098 1171 y Fs(+)16 b(1)2512 1263 y Fi(C)5 b(LT)p 2684 1263 V 38 w(AC)g(K)27 b Fs(=)2678 1354 y Fi(S)t(V)17 b(R)p 2854 1354 V 28 w(S)t(E)t(Q)3050 1362 y Fm(0)3101 1354 y Fs(+)g(1)p 3306 1381 4 366 v 590 1581 4 200 v 1541 1500 a Fh(\()1639 1385 y Ff(\032)1743 1454 y Fi(R)q(S)t(T)6 b(;)1743 1545 y(C)f(LT)p 1915 1545 24 4 v 38 w(S)t(E)t(Q)2111 1553 y Fm(0)2163 1545 y Fs(+)16 b(1)p 3306 1581 4 200 v 590 1672 4 92 v 883 1645 a(CLOSED)p 3306 1672 V 590 1871 4 200 v 1541 1790 a Fh(\()1639 1675 y Ff(\032)1743 1744 y Fi(S)t(Y)h(N)t(;)1743 1836 y(AT)11 b(K)p 1932 1836 24 4 v 32 w(S)t(E)t(Q)2127 1844 y Fm(0)p 3306 1871 4 200 v 590 1963 4 92 v 3306 1963 V 590 2237 4 274 v 1614 2027 a Fi(S)t(Y)17 b(N)t(;)1614 2118 y(S)t(V)g(R)p 1790 2118 24 4 v 28 w(S)t(E)t(Q)1986 2086 y Fb(0)1986 2132 y Fm(0)2020 2118 y Fi(;)1614 2209 y(AT)11 b(K)p 1803 2209 V 32 w(S)t(E)t(Q)1998 2217 y Fm(0)2049 2209 y Fs(+)17 b(1)2206 1978 y Ff(\))2294 2118 y Fh(!)p 3306 2237 4 274 v 590 2328 4 92 v 744 2301 a Fs(SYN-RECEIVED)p 3306 2328 V 590 2602 4 274 v 1541 2484 a Fh(\()1639 2344 y Ff(\()1748 2392 y Fi(S)t(Y)f(N)t(;)1748 2483 y(AT)11 b(K)p 1937 2483 24 4 v 32 w(S)t(E)t(Q)2132 2491 y Fm(0)2183 2483 y Fs(+)17 b(1)p Fi(;)1748 2575 y(S)t(V)g(R)p 1924 2575 V 28 w(S)t(E)t(Q)2120 2543 y Fb(0)2120 2588 y Fm(0)2171 2575 y Fs(+)g(1)p 3306 2602 4 274 v 590 2693 4 92 v 770 2666 a(EST)-6 b(ABLISHED)p 3306 2693 V 590 3059 4 366 v 683 2757 a Fi(S)t(V)17 b(R)p 859 2757 24 4 v 29 w(S)t(E)t(Q)k Fs(=)849 2848 y Fi(S)t(V)d(R)p 1026 2848 V 28 w(S)t(E)t(Q)1222 2817 y Fb(0)1222 2862 y Fm(0)1273 2848 y Fs(+)f(1)683 2940 y Fi(S)t(V)g(R)p 859 2940 V 29 w(AC)5 b(K)26 b Fs(=)849 3031 y Fi(AT)11 b(K)p 1038 3031 V 33 w(S)t(E)t(Q)1234 3039 y Fm(0)1285 3031 y Fs(+)16 b(1)p 3306 3059 4 366 v 592 3062 2716 4 v 665 3211 a Fq(Figure)27 b(2:)36 b(A)28 b(attac)n(k)f(sc)n(heme.)36 b(The)28 b(attac)n(k)n(er's)e(pac)n(k)n (ets)g(are)h(mark)n(ed)f(with)i Fg(\()0 3561 y Fr(4)135 b(Examples)0 3743 y Fq(The)28 b(follo)n(wing)e(logs)h(are)f(pro)n (vided)h(b)n(y)g(running)h(a)f(hac)n(k)n(ed)0 3843 y(v)n(ersion)g(of)h (tcp)r(dump)h([TCPDUMP])f(on)g(the)h(lo)r(cal)e(ether-)0 3942 y(net)f(where)f(the)h(clien)n(t)g(resides.)35 b(Commen)n(ts)25 b(are)g(preceded)1992 3561 y(b)n(y)i(`##'.)2116 3726 y(The)d(\014rst)g(example)g(is)g(a)g(normal)f(telnet)i(session)e(op)r (en-)1992 3826 y(ing)31 b(b)r(et)n(w)n(een)h(35.42.1.56)d(\(the)k (clien)n(t\))f(and)g(198.108.3.13)1992 3926 y(\(the)c(serv)n(er\).)0 4121 y Fa(##)40 b(The)g(client)g(sends)h(a)e(SYN)h(packet,)h (1496960000)g(is)f(its)g(initial)h(sequence)g(number.)0 4213 y(11:07:14.934093)i(35.42.1.56.1374)f(>)e(198.108.3.13.23:)j(S)c (1496960000:1496960000\(0\))45 b(win)40 b(4096)0 4304 y(##)g(The)g(server)g(answers)h(with)f(its)g(initial)h(sequence)g (number)g(and)e(the)h(SYN)g(flag.)0 4395 y(11:07:14.936345)j (198.108.3.13.23)f(>)e(35.42.1.56.1374:)j(S)c (1402880000:1402880000\(0\))45 b(ack)40 b(1496960001)h(win)f(4096)0 4487 y(##)g(The)g(client)g(acknowledges)i(the)e(SYN)g(packet.)0 4578 y(11:07:14.937068)j(35.42.1.56.1374)f(>)e(198.108.3.13.23:)j(.)c (1496960001:1496960001\(0\))45 b(ack)40 b(1402880001)h(win)f(4096)0 4669 y(##)g(Now)g(the)g(two)f(end)h(points)h(are)f(in)g(the)f (ESTABLISHED)j(state.)0 4761 y(##)e(The)g(client)g(sends)h(6)e(bytes)h (of)g(data.)0 4852 y(11:07:15.021817)j(35.42.1.56.1374)f(>)e (198.108.3.13.23:)j(P)c(1496960001:1496960007\(6\))314 4943 y(ack)h(1402880001)h(win)f(4096)g(255)g(253)g(/C)g(255)g(251)g(/X) 0 5035 y([...])0 5126 y(##)g(The)g(rest)g(of)f(the)h(log)g(is)g(the)g (graceful)h(closing)g(of)e(the)h(connection)0 5217 y(11:07:18.111596)j (198.108.3.13.23)f(>)e(35.42.1.56.1374:)j(F)c (1402880059:1402880059\(0\))45 b(ack)40 b(1496960025)h(win)f(4096)0 5309 y(11:07:18.112304)j(35.42.1.56.1374)f(>)e(198.108.3.13.23:)j(.)c (1496960025:1496960025\(0\))45 b(ack)40 b(1402880060)h(win)f(4096)0 5400 y(11:07:18.130610)j(35.42.1.56.1374)f(>)e(198.108.3.13.23:)j(F)c (1496960025:1496960025\(0\))45 b(ack)40 b(1402880060)h(win)f(4096)p eop 7 6 bop 0 83 a Fa(11:07:18.132935)43 b(198.108.3.13.23)f(>)e (35.42.1.56.1374:)j(.)c(1402880060:1402880060\(0\))45 b(ack)40 b(1496960026)h(win)f(4095)125 266 y Fq(The)26 b(next)h(example)g(is)f(the)h(same)f(session)g(with)h(an)g(in-)0 366 y(trusion)38 b(b)n(y)h(the)h(attac)n(k)n(er.)69 b(The)39 b(desync)n(hronized)f(state)0 465 y(is)e(created)f(in)h(the)g(early)f (stage)f(of)i(the)g(session)f(\(subsec-)0 565 y(tion)g(3.1\).)58 b(The)35 b(attac)n(k)n(er)e(will)i(add)f(the)h(command)g(')p Fk(ls;)p Fq(')1992 266 y(to)26 b(the)i(stream)e(of)h(data.)36 b(The)27 b(user)f(uses)h(sk)n(ey)f(to)h(iden)n(tify)1992 366 y(himself)k(to)g(the)h(serv)n(er.)45 b(F)-7 b(rom)31 b(the)h(user's)e(p)r(oin)n(t)h(of)g(view)1992 465 y(the)c(session)g(lo) r(oks)g(lik)n(e)g(this:)0 754 y Fa()c(telnet)i(198.108.3.13)0 846 y(Trying)g(198.108.3.13)h(...)0 937 y(Connected)f(to)f(198.108.3.13.)0 1028 y(Escape)h(character)g(is)f ('^]'.)0 1211 y(SunOS)g(UNIX)h(\(_host\))0 1394 y(login:)g(lpj)0 1485 y(s/key)f(70)g(cn33287)0 1576 y(\(s/key)h(required\))0 1668 y(Password:)0 1759 y(Last)f(login:)h(Wed)f(Nov)g(30)f(11:28:21)i (from)f(homefries.merit.edu)0 1850 y(SunOS)g(Release)h(4.1.3_U1)g (\(GENERIC\))h(#2:)d(Thu)h(Jan)g(20)g(15:58:03)h(PST)f(1994)0 1942 y(\(lpj@_host:)i(1\))d(pwd)0 2033 y(Mail/)433 b(mbox)471 b(src/)0 2124 y(elm*)h(resize*)354 b(traceroute*)0 2216 y(/usr/users/lpj)0 2307 y(\(lpj@_host:)42 b(2\))d(history)196 2398 y(1)79 b(13:18)119 b(ls)39 b(;)h(pwd)196 2490 y(2)79 b(13:18)119 b(history)0 2581 y(\(lpj@_host:)42 b(3\))d (logoutConnection)k(closed)e(by)f(foreign)g(host.)0 2672 y()125 2866 y Fq(The)25 b(user)g(t)n(yp)r(es)g (only)g(one)g(command)g Fk(p)m(wd)h Fq(and)f(then)0 2965 y(asks)f(for)g(the)h(history)f(of)g(the)h(session.)35 b(The)25 b(history)f(sho)n(ws)0 3065 y(that)g(a)f Fk(ls)g Fq(has)g(also)g(b)r(eing)g(issued.)36 b(The)24 b Fk(ls)e Fq(command)i(pro-)0 3165 y(duces)f(an)g(output)h(whic)n(h)f(has)f(not)i (b)r(een)f(\014ltered.)36 b(The)23 b(fol-)0 3264 y(lo)n(wing)i(log)g (sho)n(ws)f(the)i(TCP)g(pac)n(k)n(et)f(exc)n(hanges)f(b)r(et)n(w)n(een) 0 3364 y(the)31 b(clien)n(t)f(and)g(the)h(serv)n(er.)44 b(Unfortunately)30 b(some)g(pac)n(k-)0 3463 y(ets)d(are)g(missing)g (from)g(this)h(log)e(b)r(ecause)h(they)h(ha)n(v)n(e)e(b)r(een)0 3563 y(dropp)r(ed)48 b(b)n(y)f(the)h(sni\013er's)g(ethernet)g(in)n (terface)f(driv)n(er.)0 3663 y(One)36 b(m)n(ust)h(see)g(that)g(log)f (lik)n(e)g(a)g(snapshot)g(of)h(a)g(few)g(in-)1992 2866 y(stan)n(ts)24 b(of)g(the)h(exc)n(hange)e(more)h(than)h(the)g(full)g (transaction)1992 2965 y(log.)47 b(The)31 b(attac)n(k)n(er's)e(windo)n (w)i(size)g(has)g(b)r(een)h(set)f(to)g(un-)1992 3065 y(common)40 b(v)-5 b(alues)41 b(\(400,)j(500,)f(1000\))c(in)j(order)e (to)h(mak)n(e)1992 3165 y(its)29 b(pac)n(k)n(ets)e(more)h(easily)g (traceable.)40 b(The)29 b(attac)n(k)n(er)e(is)h(on)1992 3264 y(35.42.1,)21 b(three)i(hops)g(a)n(w)n(a)n(y)f(from)g(the)i(serv)n (er,)e(on)h(the)h(path)1992 3364 y(from)38 b(the)i(clien)n(t)f(to)g (the)g(serv)n(er.)70 b(The)39 b(names)g(and)g(ad-)1992 3463 y(dresses)34 b(of)h(the)h(hosts)f(ha)n(v)n(e)f(b)r(een)i(c)n (hanged)e(for)h(securit)n(y)1992 3563 y(reasons.)0 3847 y Fa(##)40 b(The)g(client)g(sends)h(a)e(SYN)h(packet,)h(896896000)g(is) f(its)g(initial)g(sequence)h(number.)0 3939 y(11:25:38.946119)i (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(S)c (896896000:896896000\(0\))45 b(win)39 b(4096)0 4030 y(##)h(The)g (server)g(answers)h(with)f(its)g(initial)h(sequence)g(number)g (\(1544576000\))g(and)f(the)g(SYN)g(flag.)0 4121 y(11:25:38.948408)j (198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(S)c (1544576000:1544576000\(0\))45 b(ack)40 b(896896001)h(win)f(4096)0 4213 y(##)g(The)g(client)g(acknowledges)i(the)e(SYN)g(packet.)h(It)e (is)h(in)g(the)g(ESTABLISHED)h(state)g(now.)0 4304 y(11:25:38.948705)i (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896001:896896001\(0\))45 b(ack)39 b(1544576001)j(win)e(4096)0 4395 y(##)g(The)g(client)g(sends)h(some)f(data)0 4487 y(11:25:38.962069)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (896896001:896896007\(6\))314 4578 y(ack)h(1544576001)h(win)f(4096)g (255)g(253)g(/C)g(255)g(251)g(/X)0 4669 y(##)g(The)g(attacker)h(resets) f(the)g(connection)i(on)d(the)h(server)h(side)0 4761 y(11:25:39.015717)i(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(R)c (896896101:896896101\(0\))45 b(win)39 b(0)0 4852 y(##)h(The)g(attacker) h(reopens)f(the)g(connection)i(with)e(an)g(initial)h(sequence)g(number) f(of)g(601928704)0 4943 y(11:25:39.019402)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(S)c(601928704:601928704\(0\))45 b(win)39 b(500)0 5035 y(##)h(The)g(server)g(answers)h(with)f(a)g(new)g(initial)g (sequence)h(number)g(\(1544640000\))h(and)e(the)g(SYN)g(flag.)0 5126 y(11:25:39.022078)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(S)c (1544640000:1544640000\(0\))45 b(ack)40 b(601928705)h(win)f(4096)0 5217 y(##)g(Since)g(the)g(last)g(packet)h(is)e(unacceptable)j(for)e (the)g(client,)h(it)f(acknowledges)i(it)0 5309 y(##)e(with)g(the)g (expected)h(sequence)g(number)f(\(1544576001\))0 5400 y(11:25:39.022313)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896007:896896007\(0\))45 b(ack)39 b(1544576001)j(win)e(4096)p eop 8 7 bop 0 83 a Fa(##)40 b(Retransmission)i(to)e(the)g(SYN)g(packet)g (triggered)h(by)f(the)g(unacceptable)i(last)e(packet)0 174 y(11:25:39.023780)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(S)c (1544640000:1544640000\(0\))45 b(ack)40 b(601928705)h(win)f(4096)0 266 y(##)g(The)g(ACK)g(storm)g(loop)0 357 y(11:25:39.024009)j (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896007:896896007\(0\))45 b(ack)39 b(1544576001)j(win)e(4096)0 448 y(11:25:39.025713)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(S)c (1544640000:1544640000\(0\))45 b(ack)40 b(601928705)h(win)f(4096)0 540 y(11:25:39.026022)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896007:896896007\(0\))45 b(ack)39 b(1544576001)j(win)e(4096)0 631 y([...])0 722 y(11:25:39.118789)j(198.108.3.13.23)f(>)e (35.42.1.146.1098:)j(S)c(1544640000:1544640000\(0\))45 b(ack)40 b(601928705)h(win)f(4096)0 814 y(11:25:39.119102)j (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896007:896896007\(0\))45 b(ack)39 b(1544576001)j(win)e(4096)0 905 y(11:25:39.120812)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(S)c (1544640000:1544640000\(0\))45 b(ack)40 b(601928705)h(win)f(4096)0 996 y(11:25:39.121056)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896007:896896007\(0\))45 b(ack)39 b(1544576001)j(win)e(4096)0 1088 y(##)g(Eventually)h(the)f(attacker)h(acknowledges)h(the)e(server)h (SYN)f(packet)g(with)g(the)g(attacker's)i(new)0 1179 y(##)e(sequence)h(number)f(\(601928705\).)i(The)e(data)g(in)g(this)g (packet)h(is)e(the)h(one)g(previously)0 1270 y(##)g(sent)g(by)g(the)f (client)i(but)f(never)g(received.)0 1362 y(11:25:39.122371)j (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (601928705:601928711\(6\))314 1453 y(ack)h(1544640001)h(win)f(400)g (255)g(253)g(/C)g(255)f(251)h(/X)0 1544 y(##)g(Some)g(ACK)g(storm)0 1636 y(11:25:39.124254)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640001:1544640001\(0\))45 b(ack)40 b(601928711)h(win)f(4090)0 1727 y(11:25:39.124631)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896007:896896007\(0\))45 b(ack)39 b(1544576001)j(win)e(4096)0 1818 y(11:25:39.126217)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640001:1544640001\(0\))45 b(ack)40 b(601928711)h(win)f(4090)0 1910 y(11:25:39.126632)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896007:896896007\(0\))45 b(ack)39 b(1544576001)j(win)e(4096)0 2001 y([...])0 2092 y(11:25:41.261885)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(601928728:601928728\(0\))45 b(ack)39 b(1544640056)j(win)e(1000)0 2183 y(##)g(A)f(retransmission)k(by)c(the)h (client)0 2275 y(11:25:41.422727)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(P)c(896896018:896896024\(6\))314 2366 y(ack)h(1544576056)h(win)f(4096)g(255)g(253)g(/A)g(255)g(252)g(/A) 0 2457 y(11:25:41.424108)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.) c(1544640059:1544640059\(0\))45 b(ack)40 b(601928728)h(win)f(4096)0 2549 y([...])0 2640 y(11:25:42.323262)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896025:896896025\(0\))45 b(ack)39 b(1544576059)j(win)e(4096)0 2731 y(11:25:42.324609)j(198.108.3.13.23)f (>)e(35.42.1.146.1098:)j(.)c(1544640059:1544640059\(0\))45 b(ack)40 b(601928728)h(win)f(4096)0 2823 y(##)g(The)g(user)g(ID)f (second)i(character.)0 2914 y(11:25:42.325019)i(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(P)c(896896025:896896026\(1\))314 3005 y(ack)h(1544576059)h(win)f(4096)g(p)0 3097 y(11:25:42.326313)j (198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640059:1544640059\(0\))45 b(ack)40 b(601928728)h(win)f(4096)0 3188 y([...])0 3279 y(11:25:43.241191)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(601928731:601928731\(0\))45 b(ack)39 b(1544640060)j(win)e(1000)0 3371 y(##)g(Retransmission)0 3462 y(11:25:43.261287)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544640059:1544640061\(2\))314 3553 y(ack)h(601928730)h(win)f(4096)g (l)g(p)0 3645 y(11:25:43.261598)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896027:896896027\(0\))45 b(ack)39 b(1544576061)j(win)e(4096)0 3736 y([...])0 3827 y(11:25:43.294192)j (198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640061:1544640061\(0\))45 b(ack)40 b(601928730)h(win)f(4096)0 3919 y(11:25:43.922438)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (896896026:896896029\(3\))314 4010 y(ack)h(1544576061)h(win)f(4096)g(j) g(/M)f(/@)0 4101 y(11:25:43.923964)k(198.108.3.13.23)f(>)e (35.42.1.146.1098:)j(.)c(1544640061:1544640061\(0\))45 b(ack)40 b(601928730)h(win)f(4096)0 4193 y([...])0 4284 y(11:25:43.957528)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640061:1544640061\(0\))45 b(ack)40 b(601928730)h(win)f(4096)0 4375 y(##)g(The)g(attacker)h(rewrites)g(the)f(packet)g(sent)g(by)g(the) g(server)h(containing)g(the)f(skey)g(challenge)0 4467 y(11:25:44.495629)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544576064:1544576082\(18\))314 4558 y(ack)h(896896029)h(win)f(1000)g (s)g(/)f(k)g(e)h(y)118 b(7)39 b(0)118 b(c)40 b(n)f(3)h(3)f(2)g(8)h(7)f (/M)h(/J)0 4649 y(11:25:44.502533)j(198.108.3.13.23)f(>)e (35.42.1.146.1098:)j(P)c(1544576082:1544576109\(27\))314 4741 y(ack)h(896896029)h(win)f(1000)g(\()g(s)f(/)g(k)h(e)f(y)118 b(r)40 b(e)f(q)h(u)f(i)h(r)f(e)g(d)h(\))f(/M)h(/J)g(P)f(a)h(s)f(s)h(w)f (o)g(r)h(d)f(:)0 4832 y(11:25:44.522500)k(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896029:896896029\(0\))45 b(ack)39 b(1544576109)j(win)e(4096)0 4923 y([...])0 5015 y(11:25:44.558320)j (198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640109:1544640109\(0\))45 b(ack)40 b(601928733)h(win)f(4096)0 5106 y(##)g(Beginning)h(of)f(the)g(skey)g(password)h(sent)f(by)g(the)f (user)i(\(client\))0 5197 y(11:25:57.356323)i(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(P)c(896896029:896896030\(1\))314 5289 y(ack)h(1544576109)h(win)f(4096)g(T)0 5380 y(11:25:57.358220)j (198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640109:1544640109\(0\))45 b(ack)40 b(601928733)h(win)f(4096)p eop 9 8 bop 0 83 a Fa([...])0 174 y(11:25:57.412103)43 b(198.108.3.13.23)f (>)e(35.42.1.146.1098:)j(.)c(1544640109:1544640109\(0\))45 b(ack)40 b(601928733)h(win)f(4096)0 266 y(##)g(Echo)g(of)g(the)f (beginning)j(of)d(the)h(skey)g(password)h(sent)g(by)e(the)h(server)0 357 y(11:25:57.412456)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (601928733:601928734\(1\))314 448 y(ack)h(1544640109)h(win)f(1000)g(T)0 540 y(11:25:57.412681)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896030:896896030\(0\))45 b(ack)39 b(1544576109)j(win)e(4096)0 631 y([...])0 722 y(11:25:57.800953)j(198.108.3.13.23)f(>)e (35.42.1.146.1098:)j(.)c(1544640109:1544640109\(0\))45 b(ack)40 b(601928734)h(win)f(4096)0 814 y(##)g(The)g(attacker)h (rewrites)g(the)f(skey)g(password)h(packet)0 905 y(11:25:57.801254)i (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (601928734:601928762\(28\))314 996 y(ack)h(1544640109)h(win)f(1000)g(A) g(U)f(T)118 b(S)40 b(H)f(I)g(M)118 b(L)40 b(O)f(F)h(T)118 b(V)39 b(A)h(S)f(E)118 b(M)39 b(O)h(O)118 b(R)39 b(I)h(D)f(/M)h(/@)0 1088 y(11:25:57.801486)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896058:896896058\(0\))45 b(ack)39 b(1544576109)j(win)e(4096)0 1179 y([...])0 1270 y(11:25:58.358275)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896058:896896058\(0\))45 b(ack)39 b(1544576109)j(win)e(4096)0 1362 y(11:25:58.360109)j(198.108.3.13.23)f (>)e(35.42.1.146.1098:)j(P)c(1544640263:1544640278\(15\))314 1453 y(ack)h(601928762)h(win)f(4096)g(\()g(l)f(p)g(j)h(@)f(\\_)h(r)f(a) h(d)f(b)h(:)118 b(1)39 b(\))0 1544 y(11:25:58.360418)k (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896058:896896058\(0\))45 b(ack)39 b(1544576109)j(win)e(4096)0 1636 y([...])0 1727 y(11:26:00.919976)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896058:896896058\(0\))45 b(ack)39 b(1544576278)j(win)e(4096)0 1818 y(##)g(The)g('p')g(of)f(the)h('pwd')g (command)h(typed)g(by)e(the)h(user.)0 1910 y(11:26:01.637187)j (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (896896058:896896059\(1\))314 2001 y(ack)h(1544576278)h(win)f(4096)g(p) 0 2092 y(11:26:01.638832)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.) c(1544640278:1544640278\(0\))45 b(ack)40 b(601928762)h(win)f(4096)0 2183 y([...])0 2275 y(11:26:03.183200)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896063:896896063\(0\))45 b(ack)39 b(1544576280)j(win)e(4096)0 2366 y(11:26:03.921272)j(35.42.1.146.1098)g (>)c(198.108.3.13.23:)k(P)c(896896060:896896063\(3\))314 2457 y(ack)h(1544576280)h(win)f(4096)g(d)g(/M)f(/@)0 2549 y(11:26:03.922886)k(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640283:1544640283\(0\))45 b(ack)40 b(601928767)h(win)f(4096)0 2640 y([...])0 2731 y(11:26:04.339186)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896063:896896063\(0\))45 b(ack)39 b(1544576280)j(win)e(4096)0 2823 y(11:26:04.340635)j(198.108.3.13.23)f (>)e(35.42.1.146.1098:)j(P)c(1544640288:1544640307\(19\))314 2914 y(ack)h(601928770)h(win)f(4096)g(M)g(a)f(i)g(l)h(/)f(/I)h(/I)g(m)f (b)h(o)f(x)h(/I)f(/I)h(s)f(r)h(c)f(/)h(/M)f(/J)0 3005 y(11:26:04.342872)k(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544640307:1544640335\(28\))314 3097 y(ack)h(601928770)h(win)f(4096)g (e)g(l)f(m)g(*)h(/I)g(/I)f(r)h(e)f(s)h(i)f(z)h(e)f(*)g(/I)h(/I)g(t)f(r) h(a)f(c)h(e)f(r)h(o)f(u)g(t)h(e)f(*)h(/M)39 3188 y(/J)0 3279 y(11:26:04.345480)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896063:896896063\(0\))45 b(ack)39 b(1544576280)j(win)e(4096)0 3371 y(11:26:04.346791)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544640335:1544640351\(16\))314 3462 y(ack)h(601928770)h(win)f(4096)g (/)g(u)f(s)g(r)h(/)f(u)h(s)f(e)h(r)f(s)h(/)f(l)h(p)f(j)g(/M)h(/J)0 3553 y(11:26:04.347094)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896063:896896063\(0\))45 b(ack)39 b(1544576280)j(win)e(4096)0 3645 y(11:26:04.348402)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544640351:1544640366\(15\))314 3736 y(ack)h(601928770)h(win)f(4096)g (\()g(l)f(p)g(j)h(@)f(\\_)h(r)f(a)h(d)f(b)h(:)118 b(2)39 b(\))0 3827 y(11:26:04.378571)k(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896063:896896063\(0\))45 b(ack)39 b(1544576280)j(win)e(4096)0 3919 y([...])0 4010 y(11:26:09.791045)j (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (601928773:601928775\(2\))314 4101 y(ack)h(1544640369)h(win)f(1000)g(t) g(o)0 4193 y(11:26:09.794653)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:) j(P)c(1544640369:1544640371\(2\))314 4284 y(ack)h(601928775)h(win)f (4096)g(t)g(o)0 4375 y(11:26:09.794885)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896068:896896068\(0\))45 b(ack)39 b(1544576366)j(win)e(4096)0 4467 y([...])0 4558 y(11:26:12.420397)j (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (896896068:896896072\(4\))314 4649 y(ack)h(1544576368)h(win)f(4096)g(r) g(y)f(/M)h(/@)0 4741 y(11:26:12.422242)j(198.108.3.13.23)f(>)e (35.42.1.146.1098:)j(.)c(1544640371:1544640371\(0\))45 b(ack)40 b(601928775)h(win)f(4096)0 4832 y([...])0 4923 y(11:26:12.440765)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896072:896896072\(0\))45 b(ack)39 b(1544576368)j(win)e(4096)0 5015 y(##)g(The)g('ry')g(of)f(the)h('history')i(command)e(sent)h(by)e (the)h(client)0 5106 y(11:26:16.420287)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(P)c(896896068:896896072\(4\))314 5197 y(ack)h(1544576368)h(win)f(4096)g(r)g(y)f(/M)h(/@)0 5289 y(11:26:16.421801)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640371:1544640371\(0\))45 b(ack)40 b(601928775)h(win)f(4096)0 5380 y([...])p eop 10 9 bop 0 83 a Fa(11:26:16.483943)43 b(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896072:896896072\(0\))45 b(ack)39 b(1544576368)j(win)e(4096)0 174 y(##)g(The)g(same)g(packet)g(rewritten) i(by)d(the)h(attacker.)0 266 y(11:26:16.505773)j(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(P)c(601928775:601928779\(4\))314 357 y(ack)h(1544640371)h(win)f(1000)g(r)g(y)f(/M)h(/@)0 448 y(##)g(answer)g(to)g(the)g(history)h(command)g(sent)f(by)f(the)h (server.)h(We)f(can)g(notice)g(the)g('ls)g(;')g(inclusion)0 540 y(##)g(before)g(the)g('pwd')0 631 y(11:26:16.514225)j (198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544640371:1544640437\(66\))314 722 y(ack)h(601928779)h(win)f(4096)g (r)g(y)f(/M)h(/@)f(/M)h(/J)432 b(1)39 b(/I)h(1)g(1)f(:)g(2)h(8)f(/I)h (l)g(s)117 b(;)h(p)40 b(w)314 814 y(d)f(/M)h(/J)432 b(2)39 b(/I)h(1)g(1)f(:)g(2)h(8)f(/I)h(/@)g(/@)f(/@)h(L)g(/@)f(/@)h(/@)g(T)f (.)g(220)h(167)g(168)g(/@)g(/G)275 905 y(/@)f(/@)h(/@)g(/X)f(/@)h(/H)g (137)g(148)g(/@)f(/@)0 996 y(11:26:16.514465)k(35.42.1.146.1098)g(>)c (198.108.3.13.23:)k(.)c(896896072:896896072\(0\))45 b(ack)39 b(1544576368)j(win)e(4096)0 1088 y([...])0 1179 y(11:26:16.575344)j (35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896072:896896072\(0\))45 b(ack)39 b(1544576368)j(win)e(4096)0 1270 y(##)g(The)g(same)g(packet)g(rewritten)i(by)d(the)h(attacker.)0 1362 y(11:26:16.577183)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544576368:1544576434\(66\))314 1453 y(ack)h(896896072)h(win)f(1000)g (r)g(y)f(/M)h(/@)f(/M)h(/J)432 b(1)39 b(/I)h(1)g(1)f(:)g(2)h(8)f(/I)h (l)g(s)117 b(;)h(p)40 b(w)0 1544 y(d)f(/M)h(/J)432 b(2)40 b(/I)f(1)h(1)f(:)h(2)f(8)h(/I)f(/@)h(/@)g(/@)f(L)h(/@)f(/@)h(/@)g(T)f (.)h(220)g(167)f(168)h(/@)g(/H)g(/@)f(/@)h(/@)314 1636 y(/X)g(/@)f(/H)h(137)g(148)g(/@)f(/@)0 1727 y(11:26:16.577490)k (198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640437:1544640437\(0\))45 b(ack)40 b(601928779)h(win)f(4096)0 1818 y([...])0 1910 y(##)g(The)g(user)g(log)g(out.)0 2001 y(11:26:20.236907)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (601928781:601928782\(1\))45 b(ack)39 b(1544640437)j(win)e(1000)g(g)0 2092 y(11:26:20.247288)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544576438:1544576438\(0\))45 b(ack)40 b(896896074)h(win)f(1000)0 2183 y(11:26:20.253500)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544576435:1544576436\(1\))45 b(ack)40 b(896896074)h(win)f(1000)g(o)0 2275 y(11:26:20.287513)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(P)c (1544640439:1544640440\(1\))45 b(ack)40 b(601928782)h(win)f(4096)g(g)0 2366 y(11:26:20.287942)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(P)c (896896075:896896076\(1\))45 b(ack)39 b(1544576436)j(win)e(4096)g(o)0 2457 y(11:26:20.289312)j(198.108.3.13.23)f(>)e(35.42.1.146.1098:)j(.)c (1544640440:1544640440\(0\))45 b(ack)40 b(601928782)h(win)f(4096)0 2549 y(11:26:20.289620)j(35.42.1.146.1098)g(>)c(198.108.3.13.23:)k(.)c (896896076:896896076\(0\))45 b(ack)39 b(1544576436)j(win)e(4096)125 2738 y Fq(Almost)32 b(all)h(of)f(the)i(pac)n(k)n(ets)d(with)i(the)g(A)n (CK)g(\015ag)f(set)0 2837 y(but)f(with)g(no)f(data)g(are)f(ac)n(kno)n (wledgemen)n(t)g(of)h(unaccept-)0 2937 y(able)j(pac)n(k)n(ets.)54 b(A)34 b(lot)g(of)f(retransmission)f(o)r(ccurs)h(due)h(to)0 3037 y(the)24 b(load)e(on)h(the)h(net)n(w)n(ork)d(and)j(on)e(the)i (attac)n(k)n(er)e(host)h(cre-)0 3136 y(ated)31 b(b)n(y)g(the)h(A)n(CK)e (storm.)47 b(The)32 b(real)e(log)g(\(including)i(all)0 3236 y(A)n(CK)i(pac)n(k)n(ets\))g(is)h(ab)r(out)f(3000)f(lines)i(long)f (whereas)f(the)0 3335 y(one)25 b(sho)n(wn)f(here)h(has)g(b)r(een)g (stripp)r(ed)h(to)f(ab)r(out)g(100)f(lines.)0 3435 y(A)j(lot)g(of)g (pac)n(k)n(ets)f(ha)n(v)n(e)f(also)h(b)r(een)i(lost)e(and)h(do)g(not)f (sho)n(w)0 3535 y(up)39 b(in)g(this)g(log.)69 b(The)39 b(data)f(collected)h(during)f(the)h(test)0 3634 y(sho)n(ws)22 b(that)i(one)e(real)h(pac)n(k)n(et)f(sen)n(t)h(can)g(generate)f(b)r(et) n(w)n(een)0 3734 y(10)31 b(and)h(300)f(empt)n(y)h(Ac)n(k)g(pac)n(k)n (ets.)49 b(Those)32 b(n)n(um)n(b)r(ers)g(are)0 3834 y(of)c(course)e (highly)h(v)-5 b(ariable.)0 4123 y Fr(5)135 b(Detection)46 b(and)f(Side)g(E\013ects)0 4310 y Fq(Sev)n(eral)39 b(\015a)n(ws)g(of)g (that)i(attac)n(k)e(can)g(b)r(e)h(used)g(to)g(detect)0 4409 y(it.)d(Three)27 b(will)h(b)r(e)f(describ)r(ed)g(here)g(but)h(one) f(can)g(imagine)0 4509 y(some)g(other)g(w)n(a)n(ys)f(to)i(detect)g(the) g(in)n(trusion.)125 4703 y Fg(\017)41 b Fq(Desync)n(hronized)26 b(state)i(detection.)38 b(By)28 b(comparing)208 4802 y(the)h(sequence)f(n)n(um)n(b)r(ers)g(of)h(b)r(oth)g(ends)g(of)f(the)h (con-)208 4902 y(nection)f(the)h(user)f(can)g(tell)h(if)h(the)f (connection)f(is)g(in)208 5001 y(the)k(desync)n(hronized)f(state.)51 b(This)33 b(metho)r(d)g(is)f(fea-)208 5101 y(sible)j(if)g(w)n(e)g (assume)f(that)h(the)h(sequence)e(n)n(um)n(b)r(ers)208 5201 y(can)40 b(b)r(e)g(transmitted)h(through)f(the)g(TCP)g(stream)208 5300 y(without)d(b)r(eing)h(compromised)e(\(c)n(hanged\))h(b)n(y)g(the) 208 5400 y(attac)n(k)n(er.)2116 2738 y Fg(\017)k Fq(Ac)n(k)g(storm)f (detection.)76 b(Some)41 b(statistics)f(on)h(the)2199 2837 y(TCP)j(tra\016c)g(conducted)g(on)g(our)g(lo)r(cal)g(ethernet)2199 2937 y(segmen)n(t)26 b(outside)g(the)g(attac)n(k)g(sho)n(w)f(that)i (the)f(a)n(v)n(er-)2199 3037 y(age)19 b(ratio)g(of)h(A)n(CK)g(without)h (data)e(pac)n(k)n(ets)g(p)r(er)h(total)2199 3136 y(telnet)h(pac)n(k)n (ets)e(is)g(around)g(45\045.)34 b(On)20 b(a)g(more)f(loaded)2199 3236 y(transit)31 b(ethernet)f(the)i(a)n(v)n(erage)c(is)i(ab)r(out)h (33\045)f(\(C.f)2199 3335 y(T)-7 b(able)27 b(1\).)2199 3492 y(The)22 b(total)g(n)n(um)n(b)r(er)g(of)g(TCP)f(pac)n(k)n(ets)g (as)g(w)n(ell)h(as)g(the)2199 3592 y(total)h(n)n(um)n(b)r(er)g(of)g(A)n (CK)f(and)h(telnet)h(pac)n(k)n(ets)e(\015uctu-)2199 3692 y(ate)h(a)g(lot)h(on)f(the)h(lo)r(cal)f(ethernet.)35 b(The)24 b(table)f(sho)n(ws)2199 3791 y(the)h(limits.)36 b(The)23 b(p)r(ercen)n(tage)f(of)h(A)n(CK)g(telnet)h(pac)n(k-)2199 3891 y(ets)39 b(is)h(v)n(ery)e(stable,)k(around)d(45\045.)71 b(This)40 b(can)f(b)r(e)2199 3990 y(explained)30 b(b)n(y)g(the)g(fact)g (that)h(the)f(telnet)h(session)e(is)2199 4090 y(an)20 b(in)n(teractiv)n(e)f(session)g(and)h(ev)n(ery)f(c)n(haracter)f(t)n(yp) r(ed)2199 4190 y(b)n(y)27 b(the)g(user)f(m)n(ust)h(b)r(e)h(ec)n(ho)r (ed)e(and)h(ac)n(kno)n(wledged.)2199 4289 y(The)43 b(v)n(olume)e(of)i (exc)n(hanged)e(data)h(is)g(v)n(ery)f(small)2199 4389 y(eac)n(h)36 b(pac)n(k)n(et)g(usually)g(con)n(tains)g(one)g(c)n (haracter)f(or)2199 4489 y(one)27 b(text)h(line.)2199 4645 y(The)35 b(data)f(for)g(the)h(transit)g(ethernet)g(is)f(v)n(ery)g (con-)2199 4745 y(sisten)n(t.)48 b(Due)31 b(to)g(the)h(high)f(load)f (on)h(that)h(segmen)n(t)2199 4845 y(a)j(few)h(pac)n(k)n(ets)f(ma)n(y)g (ha)n(v)n(e)g(b)r(een)h(dropp)r(ed)f(b)n(y)h(the)2199 4944 y(collecting)27 b(host.)2199 5101 y(When)22 b(the)g(attac)n(k)f (is)g(conducted)h(some)f(of)g(these)h(\014g-)2199 5201 y(ures)31 b(c)n(hange.)47 b(The)32 b(next)g(table)f(sho)n(ws)g(the)h (results)2199 5300 y(for)39 b(t)n(w)n(o)g(t)n(yp)r(es)h(of)f(session.) 73 b(The)39 b(data)g(has)h(b)r(een)2199 5400 y(collected)27 b(on)h(the)g(lo)r(cal)f(ethernet)g(only)-7 b(.)p eop 11 10 bop 1609 183 4 100 v 1694 153 a Fd(L)l(o)l(c)l(al)31 b(Ethernet)p 2302 183 V 133 w(T)-6 b(r)l(ansit)30 b(Ethernet)p 895 186 2110 4 v 1091 256 a Fq(T)-7 b(otal)27 b(TCP/s)p 1609 286 4 100 v 99 w(80-100)96 b(\(60-80\))p 2302 286 V 98 w(1400)i(\(87\))1201 355 y(T)-7 b(otal)27 b(Ac)n(k)p 1609 385 V 141 w(25-75)97 b(\(25-45\))p 2302 385 V 140 w(500)h(\(35\))1113 455 y(T)-7 b(otal)28 b(T)-7 b(elnet)p 1609 485 V 141 w(10-20)97 b(\(10-25\))p 2302 485 V 140 w(140)h(\(10\))945 555 y(T)-7 b(otal)27 b(T)-7 b(elnet)28 b(Ac)n(k)p 1609 584 V 183 w(5-10)97 b(\(45-55\))p 2302 584 V 181 w(45)i(\(33\))924 733 y(T)-7 b(able)27 b(1:)37 b(P)n(ercen)n(tage)25 b(of)i(A)n(CK)h(pac)n(k)n(ets)e(without)i(the)g (attac)n(k.)208 1082 y(In)36 b(T)-7 b(able)37 b(2)f(the)h(`Lo)r(cal)f (connection')g(is)g(a)h(session)208 1181 y(with)e(a)g(host)g(at)g(a)f (few)i(IP)e(hops)h(from)g(the)g(clien)n(t.)208 1281 y(The)23 b(Round)g(T)-7 b(rip)23 b(Dela)n(y)f(\(R)-7 b(TD\))24 b(is)f(appro)n(ximately)208 1381 y(3ms)32 b(and)h(the)g(actual)f(n)n (um)n(b)r(er)h(of)f(hops)h(is)f(4.)53 b(The)208 1480 y('Remote)24 b(connection')h(is)f(a)h(session)e(with)j(a)e(R)-7 b(TD)26 b(of)208 1580 y(ab)r(out)k(40ms)f(and)g(9)h(hops)g(a)n(w)n(a)n (y)-7 b(.)42 b(In)30 b(the)h(\014rst)e(case)208 1679 y(the)36 b(attac)n(k)g(is)g(clearly)f(visible.)64 b(Ev)n(en)35 b(if)i(it's)g(v)n(ery)208 1779 y(\015uctuan)n(t,)30 b(the)g(p)r(ercen)n (tage)f(of)g(TCP)h(A)n(CK)f(is)g(near)208 1879 y(100\045.)37 b(Almost)28 b(all)g(of)g(the)h(tra\016c)e(is)h(ac)n(kno)n(wledge-)208 1978 y(men)n(t)f(pac)n(k)n(ets.)208 2115 y(In)c(the)h(second)e(case)h (the)g(detection)h(of)f(the)g(attac)n(k)g(is)208 2215 y(less)d(ob)n(vious.)34 b(The)21 b(data)g(has)f(to)h(b)r(e)h(compared)e (with)208 2314 y(the)30 b(\014rst)g(column)h(of)f(T)-7 b(able)30 b(1)g(\(lo)r(cal)g(tra\016c\).)46 b(The)208 2414 y(p)r(ercen)n(tage)28 b(of)h(TCP)h(A)n(CK)f(sligh)n(tly)g (increases)f(but)208 2513 y(not)38 b(signi\014can)n(tly)-7 b(.)68 b(One)38 b(can)f(explain)h(this)h(result)208 2613 y(b)n(y)e(the)g(long)g(R)-7 b(TD)38 b(whic)n(h)f(decreases)f(the)i (rate)f(of)208 2713 y(A)n(CK)31 b(pac)n(k)n(ets)g(sen)n(t.)49 b(The)32 b(underlying)f(net)n(w)n(ork)g(is)208 2812 y(also)26 b(used)h(to)f(exp)r(erience)h(b)r(et)n(w)n(een)g(a)g(5\045)f(and)h (10\045)208 2912 y(pac)n(k)n(et)36 b(loss)h(whic)n(h)g(helps)g(in)h (breaking)e(the)i(A)n(CK)208 3012 y(lo)r(op.)125 3185 y Fg(\017)j Fq(Increase)32 b(of)i(the)h(pac)n(k)n(et)e(loss)g(and)h (retransmission)208 3285 y(for)d(that)g(particular)g(session.)47 b(Though)31 b(no)h(data)f(is)208 3385 y(a)n(v)-5 b(ailable)32 b(to)i(enligh)n(ten)g(us)g(on)f(that)i(b)r(eha)n(vior)d(the)208 3484 y(log)37 b(pro)r(duced)g(during)g(the)i(attac)n(k)d(sho)n(ws)h(an) h(un-)208 3584 y(usually)25 b(high)g(lev)n(el)h(of)f(pac)n(k)n(et)g (loss)g(and)g(so)g(retrans-)208 3683 y(mission.)43 b(Therefore)29 b(this)h(implies)h(a)e(deterioration)208 3783 y(of)k(the)g(resp)r(onse) g(time)g(for)g(the)h(user.)53 b(The)34 b(pac)n(k)n(et)208 3883 y(loss)26 b(increase)h(is)g(caused)g(b)n(y:)301 4075 y Fk({)41 b Fq(The)31 b(extra)f(load)g(of)h(the)g(net)n(w)n(ork)e (due)i(to)g(the)390 4175 y(A)n(CK)c(storms.)301 4311 y Fk({)41 b Fq(The)34 b(pac)n(k)n(et)g(dropp)r(ed)g(b)n(y)f(the)i (sni\013er)f(of)g(the)390 4411 y(attac)n(k)n(er.)69 b(The)38 b(drops)g(tend)h(to)g(increase)e(as)390 4510 y(the)28 b(load)f(on)g(the)h(net)n(w)n(ork)f(increases.)125 4703 y Fg(\017)41 b Fq(Some)h(unexp)r(ected)i(connection)e(reset.)82 b(The)43 b(fol-)208 4802 y(lo)n(wing)24 b(b)r(eha)n(vior)h(has)g(not)g (b)r(een)i(fully)f(in)n(v)n(estigated)208 4902 y(since)19 b(the)i(attac)n(k)n(er)d(program)g(dev)n(elop)r(ed)h(w)n(as)g(to)h(try) 208 5001 y(the)35 b(v)-5 b(alidit)n(y)35 b(of)g(the)g(concept)g(more)f (than)h(making)208 5101 y(the)26 b(attac)n(k)g(transparen)n(t)f(to)h (the)h(clien)n(t)g(and)f(serv)n(er.)208 5201 y(These)34 b(are)g(lik)n(ely)g(to)g(disapp)r(ear)g(with)h(a)g(more)f(so-)208 5300 y(phisticated)24 b(attac)n(k)n(er)f(program.)34 b(The)24 b(user)g(can)g(ex-)208 5400 y(p)r(erience)i(a)g(connection)g (reset)g(of)h(its)f(session)g(at)g(the)2199 1082 y(early)j(stage)g(of)h (the)g(connection)g(if)g(the)g(proto)r(col)f(of)2199 1181 y(the)j(attac)n(k)e(is)i(not)f(correctly)f(executed.)49 b(A)32 b(loss)e(of)2199 1281 y(the)j(attac)n(k)n(er's)e(RST)i(or)f(SYN) h(pac)n(k)n(ets)e(ma)n(y)h(lea)n(v)n(e)2199 1381 y(the)26 b(serv)n(er)d(side)i(of)h(the)f(connection)g(in)h(a)e(unde\014ned)2199 1480 y(state)36 b(\(usually)f(CLOSED)g(or)g(SYN-RECEIVED\))2199 1580 y(and)41 b(ma)n(y)g(mak)n(e)f(the)i(clien)n(t)f(pac)n(k)n(ets)f (acceptable.)2199 1679 y(Ab)r(out)33 b(10\045)e(of)h(the)g(attac)n(ks)f (p)r(erformed)g(w)n(ere)g(un-)2199 1779 y(successful,)i(ending)f (either)f(b)n(y)h(a)f(connection)h(close)2199 1879 y(\(v)n(ery)e (visible\))h(or)f(a)g(non-desync)n(hronized)f(connec-)2199 1978 y(tion)22 b(\(the)h(attac)n(k)n(er)d(failed)i(to)g(redirect)f(the) i(stream\).)2116 2244 y(Some)33 b(side)h(e\013ects)f(and)h(notes)f(ab)r (out)g(TCP)g(and)h(the)1992 2344 y(attac)n(k.)2116 2610 y Fg(\017)41 b Fq(TCP)c(implemen)n(tation.)67 b(The)38 b(desync)n(hronization)2199 2710 y(pro)r(cess)g(describ)r(ed)i(here)f (failed)g(on)h(certain)f(TCP)2199 2809 y(implemen)n(tations.)90 b(According)44 b(to)i([RF)n(C)27 b(793)o(])45 b(a)2199 2909 y(RST)36 b(pac)n(k)n(et)e(is)h(not)h(ac)n(kno)n(wledged)d(and)i (just)h(de-)2199 3008 y(stro)n(ys)j(the)i(TCB.)f(Some)g(TCP)g(implemen) n(tations)2199 3108 y(do)19 b(when)h(in)g(a)f(certain)f(state)i(ac)n (kno)n(wledge)d(the)j(RST)2199 3208 y(pac)n(k)n(et)33 b(b)n(y)h(sending)g(bac)n(k)f(a)h(RST)h(pac)n(k)n(et.)56 b(When)2199 3307 y(the)23 b(attac)n(k)n(er)e(sends)h(the)h(RST)f(pac)n (k)n(et)g(to)g(the)h(serv)n(er)2199 3407 y(the)28 b(RST)h(is)e(sen)n(t) h(bac)n(k)f(to)h(the)g(clien)n(t)g(whic)n(h)g(closes)2199 3507 y(its)48 b(connection)e(and)i(ends)f(the)h(session.)95 b(Other)2199 3606 y(desync)n(hronization)28 b(mec)n(hanisms)h(ma)n(y)g (b)r(e)h(in)n(v)n(esti-)2199 3706 y(gated)d(whic)n(h)h(do)f(not)h (reset)f(the)h(connection.)2116 3955 y Fg(\017)41 b Fq(The)27 b(clien)n(t)g(and)f(the)i(attac)n(k)n(er)d(w)n(ere)g(alw)n(a)n(ys)g(on) i(the)2199 4055 y(same)45 b(ethernet)g(segmen)n(t)f(when)h(p)r (erforming)g(the)2199 4154 y(test.)66 b(This)37 b(mak)n(es)f(the)h (attac)n(k)f(more)g(di\016cult)i(to)2199 4254 y(run)i(b)r(ecause)g(of)g (a)g(high)g(load)g(on)g(that)h(segmen)n(t.)2199 4354 y(The)34 b(collision)g(rate)f(increases)g(and)h(the)h(attac)n(k)n(er's) 2199 4453 y(sni\013er)28 b(bu\013er)f(are)g(o)n(v)n(er\015o)n(w)n(ed)e (b)n(y)i(the)h(tra\016c.)2116 4703 y Fg(\017)41 b Fq(One)27 b(can)f(think)i(of)f(just)g(w)n(atc)n(hing)f(the)h(session)f(and)2199 4802 y(sending)34 b(some)f(data)h(to)g(the)h(serv)n(er,)f(without)g (car-)2199 4902 y(ing)19 b(ab)r(out)g(creating)f(the)i(desync)n (hronized)d(state)i(and)2199 5001 y(forw)n(arding)37 b(the)i(TCP)g(pac)n(k)n(ets.)70 b(Though)38 b(it)i(will)2199 5101 y(succeed)25 b(in)g(corrupting)e(the)j(host)e(that)h(approac)n(h)e (is)2199 5201 y(lik)n(ely)29 b(to)h(b)r(e)g(detected)g(early)f(b)n(y)g (the)h(user.)43 b(Indeed)2199 5300 y(the)35 b(TCP)g(session)f(will)h (not)g(b)r(e)g(able)g(to)g(exc)n(hange)2199 5400 y(data)27 b(once)g(the)h(command)f(sen)n(t.)p eop 12 11 bop 1566 183 4 100 v 1617 153 a Fd(L)l(o)l(c)l(al)30 b(c)l(onne)l(ction)p 2263 183 V 100 w(R)l(emote)f(c)l(onne)l(ction)p 852 186 2197 4 v 1070 256 a Fq(T)-7 b(otal)27 b(T)-7 b(elnet)p 1566 286 4 100 v 100 w(80-400)97 b(\(60-85\))p 2263 286 V 102 w(30-40)g(\(30-35\))902 355 y(T)-7 b(otal)27 b(T)-7 b(elnet)28 b(Ac)n(k)p 1566 385 V 99 w(75-400)97 b(\(90-99\))p 2263 385 V 102 w(20-25)g(\(60-65\))961 534 y(T)-7 b(able)27 b(2:)37 b(P)n(ercen)n(tage)25 b(of)i(A)n(CK)g(pac) n(k)n(ets)g(during)g(an)g(attac)n(k.)0 882 y Fr(6)135 b(Prev)l(en)l(tion)0 1064 y Fq(The)33 b(only)f(w)n(a)n(ys)f(kno)n(wn)g (b)n(y)i(the)f(writer)g(curren)n(tly)g(a)n(v)-5 b(ail-)0 1164 y(able)25 b(to)f(prev)n(en)n(t)h(suc)n(h)f(an)h(attac)n(k)f(on)h (a)f(telnet)i(session)e(are)0 1264 y(the)43 b(encrypted)g(Kerb)r(eros)d (sc)n(heme)j(\(application)f(la)n(y)n(er\))0 1363 y(or)27 b(the)i Fd(TCP)j(crypt)d Fq(implemen)n(tation)f([TCPcrypt)o(])h(\(TCP)0 1463 y(la)n(y)n(er\).)43 b(Encryption)30 b(of)g(the)h(data)e(\015o)n(w) h(prev)n(en)n(ts)f(an)n(y)h(in-)0 1562 y(trusion)i(or)f(mo)r (di\014cation)h(of)g(the)h(con)n(ten)n(t.)50 b(Signature)32 b(of)0 1662 y(the)25 b(data)e(can)h(also)f(b)r(e)i(used.)35 b([PGP])24 b(is)g(an)g(example)g(of)g(an)0 1762 y(a)n(v)-5 b(ailable)26 b(w)n(a)n(y)h(to)g(secure)g(electronic)g(mail)g (transmission.)0 2036 y Fr(7)135 b(Morris')45 b(A)l(ttac)l(k)h(Review)l (ed)0 2218 y Fq(Morris')f(attac)n(k)g(as)h(describ)r(ed)g(in)h ([Morris85)m(])g(assumes)0 2317 y(that)21 b(the)g(attac)n(k)n(er)e(can) h(predict)h(the)g(next)g(initial)g(sequence)0 2417 y(n)n(um)n(b)r(er)44 b(used)g(b)n(y)g(the)h(serv)n(er)e(\(noted)h Fj(S)5 b(V)19 b(R)p 1546 2417 25 4 v 30 w(S)5 b(E)g(Q)1758 2429 y Fp(0)1839 2417 y Fq(in)0 2516 y(this)43 b(do)r(cumen)n(t\))g(and)g(that)g(the)g (iden)n(ti\014cation)f(sc)n(heme)0 2616 y(is)33 b(based)f(on)g Fd(truste)l(d)i(hosts)f Fq(\(whic)n(h)g(means)f(only)g(certain)0 2716 y(hosts)27 b(are)f(allo)n(w)n(ed)g(to)h(p)r(erform)f(some)h (commands)f(on)h(the)0 2815 y(serv)n(er)f(without)h(an)n(y)g(other)g (iden)n(ti\014cation)g(pro)r(cess)f(b)r(eing)0 2915 y(needed\).)125 3015 y(In)j(this)h(attac)n(k)e(the)i(crac)n(k)n(er)d(initiates)j(the)g (session)e(b)n(y)0 3114 y(sending)k(a)f(SYN)i(pac)n(k)n(et)e(to)g(the)i (serv)n(er)d(using)h(the)h(clien)n(t)0 3214 y(\(trusted)f(host\))g(as)f (the)h(source)f(address.)45 b(The)30 b(serv)n(er)f(ac-)0 3313 y(kno)n(wledge)35 b(the)i(SYN)g(with)g(a)f(SYN/A)n(CK)g(pac)n(k)n (et)f(with)0 3413 y Fj(S)5 b(E)g(G)p 192 3413 V 30 w(S)g(E)g(Q)41 b Fq(=)h Fj(S)5 b(V)18 b(R)p 744 3413 V 31 w(S)5 b(E)g(Q)957 3425 y Fp(0)994 3413 y Fq(.)71 b(The)39 b(attac)n(k)n(er)e(then)i(ac-)0 3513 y(kno)n(wledges)19 b(that)j(pac)n(k)n(et)e(in)h(guessing)f Fj(S)5 b(V)19 b(R)p 1459 3513 V 30 w(S)5 b(E)g(Q)1671 3525 y Fp(0)1708 3513 y Fq(.)35 b(The)0 3612 y(crac)n(k)n(er)f(do)r(es) j(not)f(need)h(to)g(sni\013)g(the)g(clien)n(t)g(pac)n(k)n(ets)e(as)0 3712 y(long)i(as)g(he)h(can)g(predict)f Fj(S)5 b(V)19 b(R)p 1069 3712 V 31 w(S)5 b(E)g(Q)1282 3724 y Fp(0)1356 3712 y Fq(in)38 b(order)f(to)g(ac-)0 3812 y(kno)n(wledge)26 b(it.)38 b(This)27 b(attac)n(k)g(has)g(t)n(w)n(o)g(main)g(\015a)n(ws:) 125 3975 y Fg(\017)41 b Fq(The)24 b(clien)n(t)h(whom)f(the)h(attac)n(k) n(er)e(masquerades)f(will)208 4075 y(receiv)n(e)34 b(the)i(SYN/A)n(CK)f (pac)n(k)n(et)g(from)g(the)h(serv)n(er)208 4175 y(and)e(then)h(could)f (generate)f(a)i(RST)f(pac)n(k)n(et)g(to)g(the)208 4274 y(serv)n(er)d(since)i(in)h(the)g(clien)n(t's)f(view)g(no)g(session)g(y) n(et)208 4374 y(exists.)52 b(Morris)32 b(supp)r(oses)g(that)h(one)g (can)f(stop)h(the)208 4474 y(RST)20 b(generation)f(b)n(y)h(either)g(p)r (erforming)f(the)h(attac)n(k)208 4573 y(when)33 b(the)i(clien)n(t)e(is) h(do)n(wn)f(or)g(b)n(y)g(o)n(v)n(er\015o)n(wing)e(the)208 4673 y(clien)n(t's)40 b(TCP)g(queue)h(so)e(the)i(SYN/A)n(CK)g(pac)n(k)n (et)208 4772 y(will)27 b(b)r(e)h(lost.)125 4937 y Fg(\017)41 b Fq(The)55 b(attac)n(k)n(er)e(cannot)h(receiv)n(e)g(data)h(from)f(the) 208 5037 y(serv)n(er.)62 b(But)37 b(he)g(can)g(send)g(data)f(whic)n(h)h (is)f(some-)208 5137 y(time)28 b(enough)f(to)g(compromise)f(a)i(host.) 125 5300 y(The)22 b(are)f(four)h(principal)g(di\013erences)h(b)r(et)n (w)n(een)f(Morris')0 5400 y(attac)n(k)27 b(and)g(the)h(presen)n(t)f (one:)2116 882 y Fg(\017)41 b Fq(Morris's)18 b(relies)h(on)g(the)h Fd(truste)l(d)h(hosts)f Fq(iden)n(ti\014cation)2199 982 y(sc)n(heme)j(whereas)g(the)h(presen)n(t)f(attac)n(k)g(lets)h(the)g (user)2199 1082 y(conduct)31 b(the)h(iden)n(ti\014cation)f(stage)f(of)h (the)h(connec-)2199 1181 y(tion.)2116 1361 y Fg(\017)41 b Fq(The)21 b(presen)n(t)g(attac)n(k)f(is)h(a)f(full)i(duplex)f(TCP)g (stream.)2199 1461 y(The)28 b(attac)n(k)n(er)e(can)h(send)g(and)h (receiv)n(e)e(data.)2116 1640 y Fg(\017)41 b Fq(The)119 b(presen)n(t)f(attac)n(k)g(uses)g(the)i(ether-)2199 1740 y(net)109 b(sni\013er)g(to)f(predict)h(\(or)f(just)h(get\))2199 1839 y Fj(S)5 b(V)19 b(R)p 2391 1839 V 30 w(S)5 b(E)g(Q)2603 1851 y Fp(0)2640 1839 y Fq(.)2116 2019 y Fg(\017)41 b Fq(The)19 b(presen)n(t)f(attac)n(k)g(can)h(b)r(e)g(used)g(against)f(an) n(y)g(kind)2199 2119 y(of)28 b(host)f(b)r(esides)h(Unix)f(hosts.)1992 2295 y(Morris')22 b(attac)n(k)i(can)f(easily)h(b)r(e)g(exten)n(ted)h (in)f(regard)f(of)h(the)1992 2395 y(presen)n(t)i(attac)n(k:)2116 2571 y Fg(\017)41 b Fq(The)27 b(sni\013er)g(is)f(used)h(to)g(get)g(the) g(serv)n(er's)e(initial)i(se-)2199 2670 y(quence)19 b(n)n(um)n(b)r(er.) 34 b(Morris')19 b(attac)n(k)f(can)h(then)i(b)r(e)e(p)r(er-)2199 2770 y(formed)26 b(against)f(the)i(serv)n(er.)35 b(The)26 b(attac)n(k)n(er)f(do)h(not)2199 2870 y(need)i(to)f(w)n(ait)g(for)h(a)f (clien)n(t)g(to)h(connect.)2116 3049 y Fg(\017)41 b Fq(Considering)32 b(that)h(the)g(clien)n(t)f(will)h(not)g(send)g(RST)2199 3149 y(pac)n(k)n(ets)j(\(for)i(example)f(it)g(is)h(do)n(wn\))f(the)h (attac)n(k)n(er)2199 3249 y(can)19 b(establish)g(a)g(full)h(duplex)f (TCP)g(connection)g(with)2199 3348 y(the)35 b(serv)n(er.)56 b(It)34 b(can)h(send)f(data)g(and)g(receiv)n(e)g(data)2199 3448 y(on)h(b)r(ehalf)g(of)f(the)i(clien)n(t.)58 b(Of)35 b(course)e(the)j(crac)n(k)n(er)2199 3547 y(still)k(has)e(to)h(pass)g (the)h(iden)n(ti\014cation)f(barrier.)70 b(If)2199 3647 y(the)24 b(iden)n(ti\014cation)f(is)h(based)f(on)g(trusted)g(hosts)g (\(lik)n(e)2199 3747 y Fd(NFS)g Fq(or)g Fd(rlo)l(gin)p Fq(\))h(the)g(crac)n(k)n(er)d(has)h(full)i(access)e(to)i(the)2199 3846 y(host's)j(services.)2116 4023 y(Stev)n(en)37 b(M.)h(Bello)n(vin)f (in)h([Bello)n(vin89)n(])g(also)e(presen)n(ts)1992 4122 y(ho)n(w)e(ICMP)h(pac)n(k)n(ets)f(can)g(b)r(e)i(used)f(to)g(disable)f (one)h(side)1992 4222 y(of)30 b(the)g(connection.)45 b(In)30 b(this)h(case)e(the)i(attac)n(k)n(er)e(gets)g(full)1992 4321 y(con)n(trol)g(of)i(the)g(session)f(\(p)r(eople)h(ha)n(v)n(e)e (referred)h(to)h('TCP)1992 4421 y(session)d(hijac)n(king'\),)h(but)g (this)h(is)f(to)r(o)g(easily)f(detected)h(b)n(y)1992 4521 y(the)e(user.)1992 4813 y Fr(8)134 b(Conclusion)1992 5001 y Fq(Although)36 b(easy)f(to)i(detect)f(when)h(used)f(on)g(a)g(lo) r(cal)g(net-)1992 5101 y(w)n(ork,)d(the)g(attac)n(k)f(presen)n(ted)h (here)g(is)g(quite)g(e\016cien)n(t)g(on)1992 5201 y(long)k(distance,)42 b(lo)n(w)37 b(bandwidth,)42 b(high)d(dela)n(y)f(net)n(w)n(orks)1992 5300 y(\(usually)31 b(W)-9 b(AN\).)33 b(It)f(can)g(b)r(e)g(carried)f (with)h(the)h(same)e(re-)1992 5400 y(sources)38 b(as)h(for)h(a)g (passiv)n(e)e(sni\016ng)i(attac)n(k)f(whic)n(h)h(ha)n(v)n(e)p eop 13 12 bop 0 83 a Fq(o)r(ccurred)32 b(so)h(frequen)n(tly)f(on)h(the)h (In)n(ternet.)53 b(This)33 b(attac)n(k)0 183 y(has)21 b(also)f(the)i(dangerous)e(adv)-5 b(an)n(tage)20 b(of)h(b)r(eing)h(in)n (visible)f(to)0 282 y(the)g(user.)34 b(While)22 b(crac)n(king)d(in)n (to)h(a)h(host)f(on)h(the)g(In)n(ternet)g(is)0 382 y(b)r(ecoming)j (more)f(and)i(more)e(frequen)n(t,)i(the)g(stealthfulness)0 482 y(of)30 b(the)g(attac)n(k)f(is)h(no)n(w)f(a)g(v)n(ery)g(imp)r (ortan)n(t)h(parameter)e(for)0 581 y(the)h(success)g(of)g(the)g(attac)n (k)f(and)h(mak)n(es)f(it)i(more)e(di\016cult)0 681 y(to)f(detect.)125 780 y(When)f(ev)n(eryb)r(o)r(dy's)f(atten)n(tion)h(in)h(the)g(In)n (ternet)f(is)g(fo-)0 880 y(cused)k(on)f(the)h(emerging)f(new)h(IPv6)e (proto)r(col)h(to)h(replace)0 980 y(the)c(curren)n(t)e(IPv4,)h (increasing)f(attac)n(ks)g(and)h(the)h(need)f(for)0 1079 y(secure)31 b(systems)g(press)g(us)h(to)g(dev)n(elop)f(and)g(use)h(a)f (secure)0 1179 y(transp)r(ort)d(la)n(y)n(er)f(for)h(the)h(In)n(ternet)f (comm)n(unit)n(y)-7 b(.)40 b(Options)0 1279 y(should)24 b(b)r(e)i(a)n(v)-5 b(ailable)23 b(to)i(send)f(signed)g(and)h(ev)n(en)n (tually)f(en-)0 1378 y(crypted)e(data)g(to)h(pro)n(vide)e(priv)-5 b(acy)e(.)35 b(And)23 b(since)f(the)h(signa-)0 1478 y(ture)30 b(of)h(the)g(data)f(implies)g(reliabilit)n(y)g(the)h(signature)e(can)0 1577 y(b)r(e)f(substituted)g(to)g(the)g(curren)n(t)f(TCP)g(c)n(hec)n (ksum.)125 1677 y(This)j(pap)r(er)g(do)r(es)g(not)g(attempt)h(to)g (explain)f(all)g(cases)0 1777 y(of)j(activ)n(e)f(attac)n(ks)g(using)h (a)g(sni\013er.)53 b(It)33 b(is)g(more)f(a)h(w)n(arn-)0 1876 y(ing)38 b(for)f(p)r(eople)h(using)g(s/k)n(ey)f(or)g(Kerb)r(eros)f (against)h(the)0 1976 y(danger)30 b(of)g(someone)g(sni\016ng)h(the)g (ethernet.)47 b(It)31 b(pro)n(vides)0 2076 y(a)36 b(few)g(ideas)g(and)g (starting)g(p)r(oin)n(ts)g(whic)n(h)g(can)g(b)r(e)g(more)0 2175 y(deeply)26 b(studied.)37 b(The)27 b(metho)r(d)g(presen)n(ted)e (has)h(b)r(een)h(suc-)0 2275 y(cessfully)c(used)f(during)h(our)f(test)h (ev)n(en)f(with)h(a)g(v)n(ery)e(simple)0 2374 y(attac)n(k)n(er's)26 b(soft)n(w)n(are.)0 2642 y Fr(References)0 2824 y Fq([Bello)n(vin89])40 b Fd("Se)l(curity)26 b(Pr)l(oblems)i(in)f(the)g(TCP/IP)i(Pr)l(o-)88 2923 y(to)l(c)l(ol)36 b(Suite")p Fq(,)e(Bello)n(vin,)h(S.,)h(Computer)e (Comm)n(unica-)88 3023 y(tions)27 b(Review,)h(April)f(1989.)1992 83 y([Kerb)r(eros])39 b Fd("Kerb)l(er)l(os:)e(A)n(n)26 b(A)n(uthentic)l(ation)f(Servic)l(e)i(for)2079 183 y(Op)l(en)k(Network) h(Systems")p Fq(,)e(Steiner,)g(J.,)g(Neuman,)h(C.,)2079 282 y(Sc)n(hiller,)e(J.,)g(USENIX)g(Conference)g(Pro)r(ceeding,)e(Dal-) 2079 382 y(las,)g(T)-7 b(exas,)27 b(F)-7 b(ebruary)26 b(1989.)1992 573 y([Morris85])39 b Fd("A)73 b(We)l(akness)h(in)g(the)g (4.2BSD)h(UNIX)2079 672 y(TCP/IP)24 b(Softwar)l(e")p Fq(,)d(Morris,)e(R.,)i(Computing)e(Science)2079 772 y(T)-7 b(ec)n(hnical)18 b(Rep)r(ort)h(No)f(117,)h(A)-7 b(T&T)19 b(Bell)g(Lab)r(oratories,)2079 872 y(Murra)n(y)26 b(Hill,)i(New)g (Jersey)-7 b(,)26 b(1985.)1992 1063 y([PGP])40 b Fd(Pr)l(etty)55 b(Go)l(o)l(d)h(Privacy)i Fq(V)-7 b(ersion)54 b(2.6.1,)61 b(Philip)2079 1162 y(Zimmermann,)27 b(August)h(1994.)1992 1353 y([RF)n(C)f(793])40 b(Request)k(F)-7 b(or)42 b(Commen)n(t)i(793,)h Fd(\\T)-6 b(r)l(ansmis-)2079 1453 y(sion)29 b(Contr)l(ol)g(Pr)l(oto)l (c)l(ol")p Fq(,)e(Septem)n(b)r(er)f(1981,)e(J.)i(P)n(ostel.)1992 1644 y([RF)n(C)h(854])40 b(Request)31 b(F)-7 b(or)30 b(Commen)n(t)h(854,)f Fd(\\T)-6 b(elnet)33 b(Pr)l(o-)2079 1743 y(to)l(c)l(ol)66 b(Sp)l(e)l(ci\014c)l(ation)-8 b(")p Fq(,)77 b(Ma)n(y)66 b(1983,)74 b(J.)67 b(P)n(ostel,)75 b(J.)2079 1843 y(Reynolds)1992 2034 y([SKEY])41 b Fd("The)46 b(S/Key)g(One-time)f(Passwor)l(d)i(System")p Fq(,)2079 2134 y(Haller,)32 b(N.,)g(Pro)r(ceeding)e(of)h(the)h(Symp)r(osium)f(on) g(Net-)2079 2233 y(w)n(ork)20 b(&)h(Distributed)h(Systems,)h(Securit)n (y)-7 b(,)22 b(In)n(ternet)g(So-)2079 2333 y(ciet)n(y)-7 b(,)28 b(San)f(Diego,)g(CA,)h(F)-7 b(ebruary)27 b(1994.)1992 2524 y([TCPcrypt])40 b Fd("Public)67 b(Key)f(Encryption)g(Supp)l(ort)g (for)2079 2623 y(TCP")p Fq(,)26 b(Jonc)n(hera)n(y)-7 b(,)22 b(L.,)i(W)-7 b(ork)23 b(in)h(progress,)e(Ma)n(y)h(1995.)1992 2814 y([TCPDUMP])41 b Fk(tcp)s(dump\(8\))g Fq(V)-7 b(ersion)42 b(2.2.1,)j(V)-7 b(an)42 b(Ja-)2079 2914 y(cobson,)f(Craig)c(Leres,)j (Stev)n(en)f(Berk)n(eley)-7 b(,)40 b(Univ)n(ersit)n(y)2079 3013 y(of)28 b(California,)e(Berk)n(eley)-7 b(,)26 b(CA.)p eop end userdict /end-hook known{end-hook}if

Internet highlights

Casino Not On Gamstop