Roya Ensafi, Jong Chun Park, Deepak Kapur, and Jedidiah R. Crandall University of New Mexico, Dept. of Computer Science USENIX 2010

Outline  Introduction  Related Work  Formalizing Non-interference Analysis  Finding Idle Scan  Experimental confirmation of counterexamples 2Advanced Defense Lab

Introduction  Network reconnaissance is the important first step of virtually all network attacks. [Link]Link  Idle scans were introduced by Antirez in a [Link]Link Based on non-random, sequential IPIDs of older network stacks Advanced Defense Lab3

Introduction - Idle Scan Advanced Defense Lab4

Introduction - Idle Scan  IPID-based idle scans have been implemented in nmap [Link]Link  But modern network stacks randomize the IPID [Link]Link  FTP bounce scans are currently the only known way to port scan a victim host or network without routing forged packets to that host or network from the attacker [Link]Link This paper proposes another one Advanced Defense Lab5

Related Work  Staniford et al. use simulated annealing to detect stealthy scans. [Link]Link  Leckie and Kotagiri present a probabilistic approach  Gates and Kang et al. consider the problem of stealth port scans based on using many distributed hosts (e.g., a botnet) to perform the scan. Advanced Defense Lab6

Related Work(cont.)  Non-interference [Link] is a widely used concept of information flow securityLink  Non-interference proved to be a very useful property because it can be specified with Linear Temporal Logic (LTL [Link]).Link Advanced Defense Lab7

Formalizing Non-interference Analysis  A host is viewed to be at the end of the network, i.e., an end host. Advanced Defense Lab8

SYN Cache [Link]Link  The SYN cache is a cache for pending SYN packets for which a SYN/ACK has been sent and the host is waiting for an ACK.  In our model packets are only removed from the SYN cache when a TCP RST is received from the source IP address and port of the original SYN packet Advanced Defense Lab9

Idel Scan model Advanced Defense Lab10

Non-interference Analysis Model Advanced Defense Lab11

Formalizing Non-interference Analysis  Using SAL [Link] for modelingLink SAT-based [Link] bounded model checkerLink Advanced Defense Lab12

Advanced Defense Lab13

Advanced Defense Lab14

Formalizing Non-interference Analysis -- Assumptions  A major abstraction is that we consider the proper reply to SYN/ACK packets to be “drop” for open ports and RST for closed ports.  Another major abstraction is that each of the two buffers in our split SYN cache has only a single entry. Advanced Defense Lab15

Port Status Advanced Defense Lab16

Finding Idle Scan  RST rate limit Advanced Defense Lab17

Finding Idle Scan  SYN cache Advanced Defense Lab18

Experimental confirmation of counterexamples  Setup VirtualBox TUN/TAP [Link]Link Zombie ○ kernel 2.4 host (Fedora Core 1) ○ Windows XP host with no service packs ○ Linux kernel 2.6 host (CentOS 5.2) ○ FreeBSD host Advanced Defense Lab19

Experimental confirmation of counterexamples - RST rate  For a real FreeBSD system, RSTs are limited to a default of 200 per second  Our implementation sends 2000 each of two different types of packets, each at a rate of 180 per second, to the victim and FreeBSD zombie, respectively Advanced Defense Lab20

Experimental confirmation of counterexamples - RST rate Advanced Defense Lab21

Experimental confirmation of counterexamples – SYN cache  Linux kernel 2.4 uses a simple buffer for the SYN cache, with between 128 and 1024 entries depending on the memory available on the system.  our implementation 50 forged SYNs, then 50 each of forged SYNs and SYNs where the attacker uses their own return IP (1000 per second) 200 more forged SYNs (1000 per second) sends 200 each of forged SYNs and SYNs where the attacker uses their own return IP address (400 per second) Advanced Defense Lab22

Experimental confirmation of counterexamples – SYN cache  Result between different OSes Advanced Defense Lab23

Experimental confirmation of counterexamples – SYN cache  Idle port scan 20,000 forged SYN packets (with random return ports that are closed on the zombie) At half the rate, alternating forged SYNs with the target port on the victim as the source port and valid SYNs with the return address of the attacker Advanced Defense Lab24

Experimental confirmation of counterexamples – SYN cache  Result for idle port scan Advanced Defense Lab25