Zhiyun Qian, Zhuoqing Morley Mao University of Michigan 33 rd Security & Privacy (May, 2012)

Outline  Introduction  Fundamentals of the TCP Sequence Number Inference Attack  TCP Attack Analysis and Design  Attack Implementation and Experimental Results  Vulnerable Networks  Discussion 2012/4/302A Seminar at Advanced Defense Lab

Introduction  TCP was initially designed without many security considerations. 4-tuple: local IP, local Port, foreign IP, foreign Port  Off-path spoofing attacks 2012/4/30A Seminar at Advanced Defense Lab3

Off-Path Spoofing Attacks  One of the critical patches is the randomization of TCP initial sequence numbers (ISN) RFC 6528 [link]link  Firewall vendors soon realized that they can in fact perform sequence number checking at network-based firewalls and actively drop invalid packets even before they can reach end-hosts 2012/4/30A Seminar at Advanced Defense Lab4

Fundamentals of the TCP Sequence Number Inference Attack  Sequence-Number-Checking Firewalls 2012/4/30A Seminar at Advanced Defense Lab5

Sequence-Number-Checking Firewalls  Window size Fixed 64K x 2 N, N is the window scaling factor in SYN and SYN-ACK packet.  Left-only or right-only window  Window moving behavior Window advancing Window shifting 2012/4/30A Seminar at Advanced Defense Lab6

Threat Model  On-site TCP injection/hijacking An unprivileged malware runs on the client with access to network and the list of active connections through standard OS interface.  Off-site TCP injection only when the target connection is long-lived  Establish TCP connection using spoofed IPs 2012/4/30A Seminar at Advanced Defense Lab7

Obtaining Feedback – Side Channels  OS packet counters  IPIDs from responses of intermediate middleboxes An attacker can craft packets with TTL values large enough to reach the firewall middlebox, but small enough that they will terminate at an intermediate middlebox instead of the end-host, triggering the TTL- expired messages. 2012/4/30A Seminar at Advanced Defense Lab8

Sequence Number Inference 2012/4/30A Seminar at Advanced Defense Lab9

Timing of Inference and Injection — TCP Hijacking  For the TCP sequence number inference and subsequent data injection to be successful, a critical challenge is timing.  To address the challenge, we design and implement a number of TCP hijacking attacks. 2012/4/30A Seminar at Advanced Defense Lab10

TCP Attack Analysis and Design  Two base requirements for all attacks The ability to spoof legitimate server’s IP A sequence-number-checking firewall deployed 2012/4/30A Seminar at Advanced Defense Lab11

Attack Requirements 2012/4/30A Seminar at Advanced Defense Lab12

On-site TCP Hijacking  Reset-the-server 2012/4/30A Seminar at Advanced Defense Lab13

On-site TCP Hijacking  Preemptive-SYN Hijacking 2012/4/30A Seminar at Advanced Defense Lab14

On-site TCP Hijacking  Hit-and-run Hijacking 2012/4/30A Seminar at Advanced Defense Lab15

Off-site TCP Injection/Hijacking  URL phishing An attacker can also acquire target four tuples by luring a user to visit a malicious webpage that subsequently redirects the user to a legitimate target website. But it is not implemented in this paper. 2012/4/30A Seminar at Advanced Defense Lab16

Off-site TCP Injection/Hijacking  Long-lived connection inference An approach we discover is through sending a single ICMP error message (e.g., network or port unreachable) to query a four-tuple. Pass through firewall and trigger TTL- expired message 2012/4/30A Seminar at Advanced Defense Lab17

Establish Spoofed Connections  We found that there are many such unresponsive IPs in the nation-wide cellular network that we tested. 2012/4/30A Seminar at Advanced Defense Lab18

Attack Implementation and Experimental Results  Client platform Android 2.2 and TCP window scaling factor: 2 and 4 Vendors: HTC, Samsung, and Motorola  Network An anonymized nation-wide carrier that widely deploys firewall middleboxes at the GGSN-level 2012/4/30A Seminar at Advanced Defense Lab19

Side-channel  /proc/net/snmp: InSegs the number of incoming TCP packets received  /proc/net/netstat: PAWSEstab packets with an old timestamp is received  IPID side-channel the noise level is quite tolerable. 2012/4/30A Seminar at Advanced Defense Lab20

Sequence Number Inference  Assuming a cellular RTT of 200ms  32 times for binary search (4G) About 10s in practice  N-way search  Mix all methods It takes only about 4–5 seconds to complete the inference 2012/4/30A Seminar at Advanced Defense Lab21

On-site TCP Hijacking  Android m.facebook.com + Planetlab server [link]link 2012/4/30A Seminar at Advanced Defense Lab22

Reset-the-server [Demo]Demo  We leverage requirement C4 which tells the attacker that the victim connection’s ISN is at most 2 24 away from the ISN of the attacker-initiated connection.  Since RST packets with any sequence number that falls in the receive window can terminate the connection. P. A. Watson. “Slipping in the Window: TCP Reset Attacks,” /4/30A Seminar at Advanced Defense Lab23

Reset-the-server  The max number of required RST  server_init_window m.facebook.com: 4380  require 7661 RST twitter.com: 5840  require 5746 RST chase.com: /4/30A Seminar at Advanced Defense Lab24

Reset-the-server  Bandwidth requirements  327 Kbps ~ 12 Mbps 2012/4/30A Seminar at Advanced Defense Lab25

Hit-and-run  Bandwidth requirements WIN is 64K x 2 window_scaling_factor For the two Oses is 26Mbps and 6.6Mbps 2012/4/30A Seminar at Advanced Defense Lab26

On-site TCP Hijacking 2012/4/30A Seminar at Advanced Defense Lab27

Off-site TCP Injection  URL phishing No implement Because NAT is deployed.  long-lived connection inference a particular push server IP and port 5228 About 7.8% of the IPs have a connection with the server 2012/4/30A Seminar at Advanced Defense Lab28

Establish Spoofed Connections  Find unresponsive IP We send a SYN packet with a spoofed IP from the attack phone inside the cellular network to our attack server which responds with a legitimate SYN-ACK back. There are 80% of IPs are unresponsive.  We can make about 0.6 successful connection per second on average with more than 90% success rate 2012/4/30A Seminar at Advanced Defense Lab29

Vulnerable Networks  We deployed a mobile application (referred to as MobileApp) on the Android market.  The data are collected between Apr 25th, 2011 and Oct 17th, 2011 over 149 carriers uniquely identified 2012/4/30A Seminar at Advanced Defense Lab30

Firewall Implementation Types  Overall, out of the 149 carriers, we found 47 carriers (31.5%) that deploy sequence-number-checking firewalls. 2012/4/30A Seminar at Advanced Defense Lab31

Intermediate Hop Feedback  24 carriers have responsive intermediate hops that reply with TTL- expired ICMP packets.  8 carriers have NAT that allow single ICMP packet probing to infer active four tuples. 2012/4/30A Seminar at Advanced Defense Lab32

Discussion  Firewall design  Side-channels  HTTPS-only world 2012/4/30A Seminar at Advanced Defense Lab33

2012/4/30A Seminar at Advanced Defense Lab34