Off-‑Path ¡TCP ¡Exploits: ¡Global ¡Rate ¡Limit ¡ Considered ¡Dangerous Yue ¡Cao , ¡Zhiyun ¡Qian, ¡Zhongjie ¡Wang, ¡Tuan ¡Dao, ¡ Srikanth ¡Krishnamurthy, ¡Lisa ¡M. ¡Marvel† † USENIX Security 2016 Yue Cao 1
Our TCP Attack • Discovered a subtle TCP side channel vulnerability in Linux 3.6+ (CVE-2016-5696) • Given any two arbitrary hosts on the internet, blind attacker can infer: • Existence of communication • Sequence number • ACK number • Can be used towards: • TCP connection termination attack • Malicious data injection attack USENIX Security 2016 Yue Cao 2
Outline • Threat Model • Background • Vulnerability • Our Attacks • Evaluation • Defense & Conclusion 3 USENIX Security 2016 Yue Cao
Outline • Threat Model • Background • Vulnerability • Our Attack • Evaluation • Defense & Conclusion 4 USENIX Security 2016 Yue Cao
Threat Model • Consists of: • An arbitrary pair of client and server • A blind o ff-path attacker(no eavesdropping capability) • Assumption: the attacker can send spoofed packets with the victim (client or server)’s IP address Client Server Attacker Threat Model USENIX Security 2016 Yue Cao 5
Outline • Thread Model • Background • History of RFC 5961 • 3 modifications in RFC 5961 • Why does this vulnerability exist? • Vulnerability • Our Attack • Evaluation • Defense & Conclusion USENIX Security 2016 Yue Cao 6
Background • Traditional blind in-window attacks (brute force): • Connection termination & data injection attack • Success requirement (spoofed packet with): • Known 4-tuple <src IP , dst IP , src port, dst port> • Guessed SEQ # is in-window (recv window) • RFC 5961 (Aug 2010) • Mitigate blind in-window attacks • Modification of receiving scheme • SYN receiving scheme • RST receiving scheme • Data receiving scheme • Ironically , Linux implementation introduced the side channel vulnerability USENIX Security 2016 Yue Cao 7
SYN Receiving Scheme • Before RFC 5961: blind RST Attack by sending spoofed SYN packet RCV.NXT Before RFC 5961 After RFC 5961 SEQ #: RCV_Window Out-of-Window ACK back Challenge ACK RCV.NXT+RCV.WND In_Window Challenge ACK Reset Connection SEQ # Space Challenge ACK: ask sender to confirm if it indeed restarted SYN Sender Receiver USENIX Security 2016 Yue Cao 8
RST Receiving Scheme • Before RFC 5961: blind RST Attack by sending spoofed RST packet RCV.NXT After RFC 5961 SEQ #: Before RFC 5961 0/4G RCV_Window Out-of-Window Drop the Packet Drop the Packet In-Window Reset Connection Challenge ACK RCV.NXT+RCV.WND Reset Connection Exactly match SEQ # Space tell sender to confirm if it indeed terminated Challenge ACK: RST the connection Sender Receiver USENIX Security 2016 Yue Cao 9
Data Receiving Scheme • Before RFC 5961: blind Data Injection Attack by injecting spoofed DATA packet Challenge Accept Before RFC 5961 After RFC 5961 ACK #: Window Window SND.UNA Out-of-Window Drop Drop SND.UNA-2G SND.NXT In-Accpt_Window Process Data Process Data Challenge Window Challenge ACK (Old ACK) ACK # Space RCV.NXT SEQ #: In-RCV_Window —> Check ACK # RCV_Window RCV.NXT+RCV.WND SEQ # Space USENIX Security 2016 Yue Cao 10
Why Does This Vulnerability Exist? • RFC 5961: a much stricter check on incoming packets • Challenge ACK is triggered in a established connection: • SYN packet with correct 4-tuples <srcIP, dstIP, srcPort, dstPort> (any SEQ #) • RST packet with 4-tuples, in-window SEQ # • Data packet with 4-tuples, in-window SEQ #, old ACK #(in challenge window) SYN-triggered RST-triggered ACK-triggered challenge ACK challenge ACK challenge ACK Rate limit of challenge ACK Side-Channel Side-Channel Side-Channel (recommended by RFC 5961) Port number SEQ number ACK number Linux followed faithfully SYN RST Data USENIX Security 2016 Yue Cao 11
Outline • Thread Model • Background • Vulnerability • Side channel vulnerability • Guess-Then-Check Method • Optimizations • Our Attack • Evaluation • Defense & Conclusion USENIX Security 2016 Yue Cao 12
Side Channel Vulnerability • sysctl_tcp_challenge_ack_limit: implemented in Linux 3.6+ • Global limit of all challenge ACK per sec, shared across all connections • Default value: 100 ( reset per second) Client Server Any OS at Client! T S R 0 0 1 K C A e g n e l l a h c 0 0 1 Attacker Side-Channel Vulnerability Example USENIX Security 2016 Yue Cao 13
Exploit The Vulnerability • Guess-then-Check method: SYN-triggered RST-triggered Data-triggered challenge ACK challenge ACK challenge ACK • Send spoofed packets with guessed values • Example: to guess correct client-port number Port number SEQ number ACK number Inference Inference Inference • If it’s a correct guess: 1 challenge ACK Spoofed SYN packets with c lient’s IP and a guessed src port Guess Phase Server Client T S R 0 0 K 1 C A e g n e l l a h c 9 9 Check Phase Attacker USENIX Security 2016 Yue Cao 14
Guess-Then-Check Method • Send spoofed packets with guessed values • Example: to guess correct client-port number • If it’s a wrong guess: No challenge ACK Spoofed SYN packets with c lient’s IP and a guessed src port Client Server T S R 0 0 1 K C A e g n e l l a h c 0 0 1 Attacker USENIX Security 2016 Yue Cao 15 15
Guess-Then-Check Method • Challenge: expensive time cost • N: maximum spoofed probing packets in one second • Bandwidth dependent Spoofed SYN packets with c lient’s IP and guessed src port Client Server Attacker USENIX Security 2016 Yue Cao 16 16
Guess-Then-Check Method • Same process works for guessing SEQ SYN-triggered RST-triggered Data-triggered challenge ACK challenge ACK challenge ACK number and ACK number • Correct guess: Port number SEQ number ACK number Inference Inference Inference • SEQ number RST packet with correct 4-tuples, SEQ # in-window • ACK number Data packet with 4-tuples, SEQ # in-window, old ACK # s ’ t n e i l c h t i w Q E s t S e d k e c s a s P e u T S g R d n d a e f t o r o o p p S c Server : r Q s s E ’ n t S w n e o Client i R n l C k O h , K P t C I i w A d s t e e s k s c e a u p g T d S n R a d Q e E f S o o , t p r S o p : K c C r A s n w o n k , P I Attacker USENIX Security 2016 Yue Cao 17 17
Guess-Then-Check Method • Guess is correct when: • Src Port SYN packet with correct 4-tuples(src Port) • SEQ number RST packet with correct 4-tuples, SEQ # in-window • ACK number Data packet with correct 4-tuples, SEQ # in-window, old ACK • Traditional brute-force attack: 10 4 •10 9 •10 9 =10 22 different combinations • Our attack: Time cost is additive instead of multiplicative Possible to finish within 1 minute! Src Port SEQ number ACK number Dst IP, Src IP 10 4 10 9 10 9 Dst Port USENIX Security 2016 Yue Cao 18 18
Optimizations • Binary-style search • Reduce the number of probing rounds • Multi-bin search • Further improvement • Redundancy-encoded search • Account for packet loss USENIX Security 2016 Yue Cao 19
Binary-style Search • Send spoofed packet for all the ports in the 1st half range. • Narrow down the search space by half and proceed to the next round …… If Challenge ACK # < 100 If Challenge ACK # ==100 If Challenge ACK # < 100 If Challenge ACK # ==100 …… Binary Search Algorithm USENIX Security 2016 Yue Cao 20
Outline • Thread Model • Background • Vulnerability • Our Attack • Attack overview • Time synchronization • Inference of possible TCP connection • TCP connection termination attack • TCP hijacking attack • Evaluation • Defense & Conclusion USENIX Security 2016 Yue Cao 21
Attack Overview • Given client and server, we already know: • Src IP address: client IP • Dst IP address: server IP • Dst Port number: service at server(e.g. 80) Pre-process: Src Port SEQ number ACK number Time Inference Inference Inference Synchronization Inference of Connection Hijacking existence of a Termination Attack TCP connection Attack USENIX Security 2016 Yue Cao 22
Time Synchronization • Challenge: • Challenge ACK count resets each second • All the spoofed and non-spoofed packets MUST be within the same 1-second interval at server 200 time slots • Our own method: • A time synchronization strategy based on …………. RST RST RST this side channel …………. 1 second Time synchronization example USENIX Security 2016 Yue Cao 23
Inference Of Possible TCP Connection • Given src IP , dst IP and expected dst port: • To see if client opened a port Range size: N Src Port # • To infer src port: • 1. Throughout all port number[probe N ports in 1 sec] • To infer connection exists or not Step1: Identify Port Range • 2. Find exact correct port number[Binary/Multi-bin search] • To be used for termination attacker or hijacking attack Src Port # Step2: Identify Exact Port 24 USENIX Security 2016 Yue Cao
Recommend
More recommend
