Off-path Attacker Research Articles

Efficient Key Exchange Using Identity-Based Encryption in Multipath TCP Environment

Across the globe, wireless devices with Internet facilities such as smartphones and tablets have become essential assets for communication and entertainment alike for everyday life for millions of people, which increases the network traffic and the demand for low-latency communication networks. The fourth-generation (4G)/long-term evolution (LTE)/ fifth-generation (5G) communication technology offers higher bandwidth and low latency services, but resource utilization and resiliency cannot be achieved, as transmission control protocol (TCP) is the most common choice for most of the state-of-art applications for the transport layer. An extension of TCP—multipath TCP (MPTCP)—offers higher bandwidth, resiliency, and stable connectivity by offering bandwidth aggregation and smooth handover among multiple paths. However, MPTCP uses multiple disjointed paths for communication to offer multiple benefits. A breach in the security of one of the paths may have a negative effect on the overall performance, fault-tolerance, robustness, and quality of service (QoS). In this paper, the research focuses on how MPTCP options such as MP_CAPABLE, ADD_ADDR, etc., can be used to exploit the vulnerabilities to launch various attacks such as session hijacking, traffic diversion, etc., to compromise the availability, confidentiality, and integrity of the data and network. The probable security solutions for securing MPTCP connections are analyzed, and the secure key exchange model for MPTCP (SKEXMTCP) based on identity-based encryption (IBE) is proposed and implemented. The parameters exchanged during the initial handshake are encrypted using IBE to prevent off-path attacks by removing the requirement for key exchange before communication establishment by allowing the use of arbitrary strings as a public key for encryption. The experiments were performed with IBE and an elliptic curve cryptosystem (ECC), which show that IBE performs better, as it does not need to generate keys while applying encryption. The experimental evaluation of SKEXMTCP in terms of security and performance is carried out and compared with existing solutions.

Off-Path TCP Hijacking Attacks via the Side Channel of Downgraded IPID

In this paper, we uncover a new off-path TCP hijacking attack that can be used to terminate victim TCP connections or inject forged data into victim TCP connections by manipulating the new mixed IPID assignment method, which is widely used in Linux kernel version 4.18 and beyond. Our attack has three steps. First, an off-path attacker can downgrade the IPID assignment for TCP packets from the more secure per-socket-based policy to the less secure hash-based policy, thus building a shared IPID counter that forms a side channel in the victim. Second, the attacker detects the presence of TCP connections by observing the side channel of the shared IPID counter. Third, the attacker infers sequence and acknowledgment numbers of the detected connection by observing the side channel. Consequently, the attacker can completely hijack the connection, e.g., resetting the connection or poisoning the data stream. We evaluate the impacts of our attack in the real world, and we uncover that more than 20% of Alexa top 100k websites are vulnerable to our attack. Our case studies of SSH DoS, manipulating web traffic, and poisoning BGP routing tables show its threat on a wide range of applications. Moreover, we demonstrate that our attack can be further extended to exploit IPv4/IPv6 dual-stack networks on increasing the hash collisions and enlarging vulnerable populations. Finally, we analyze the root cause and develop a new IPID assignment method to defeat this attack. We prototype our defense in Linux 4.18 and confirm its effectiveness in the real world.

Transmission Control Protocol Off Path Exploits in Web

The network community in the current scenario has faced lot of potential threats like restricted access to unauthorized network; break in through other organizations, making the system unavailable and so on. An off-path attacker can perform various attacks like Browser page read, Web phishing, website Spoofing and defacement to know the 4 tuples in Transmission Control Protocol. The attacker can also carry out Cross Site Scripting to know the sensitive information on websites. Cross Site Request Forgery which performs defective exploit on web. This helps in detecting the four tuples Sequence number, Acknowledgement number, Global IPID Counter and ports.

Exploiting the Remote Server Access Support of CoAP Protocol

The constrained application protocol (CoAP) is a specially designed Web transfer protocol for use with constrained nodes and low-power networks. The widely available CoAP implementations have failed to validate the remote CoAP clients. Each CoAP client generates a random source port number when communicating with the CoAP server. However, we observe that in such implementations it is difficult to distinguish the regular packet and the malicious packet, opening a door for a potential off-path attack. The off-path attack is considered a weak attack on a constrained network and has received a less attention from the research community. However, the consequences resulting from such an attack cannot be ignored in practice. In this article, we exploit the combination of IP spoofing vulnerability and the remote server access support of CoAP is to be launch an off-path attack. The attacker injects a fake request message to change the credentials of the 6LoWPAN smart door keypad lock system. This creates a request spoofing vulnerability in CoAP, and the attacker exploits this vulnerability to gain full access to the system. Through our implementation, we demonstrated the feasibility of the attack scenario on the 6LoWPAN-CoAP network using smart door keypad lock. We proposed a machine learning (ML)-based approach to mitigate such attacks. To the best of our knowledge, we believe that this is the first article to analyze the remote CoAP server access support and request spoofing vulnerability of CoAP to launch an off-path attack and demonstrate how an ML-based approach can be deployed to prevent such attacks.

Off-Path TCP Exploits of the Challenge ACK Global Rate Limit

In this paper, we report a subtle yet serious side channel vulnerability (CVE-2016-5696) introduced in a recent transmission control protocol (TCP) specification. The specification is faithfully implemented in Linux kernel version 3.6 (from 2012) and beyond, and affects a wide range of devices and hosts. In a nutshell, the vulnerability allows a blind off-path attacker to infer if any two arbitrary hosts on the Internet are communicating using a TCP connection. Further, if the connection is present, such an off-path attacker can also infer the TCP sequence numbers in use, from both sides of the connection; this in turn allows the attacker to cause connection termination and perform data injection attacks. We illustrate how the attack can be leveraged to disrupt or degrade the privacy guarantees of an anonymity network such as Tor, and perform web connection hijacking. Through extensive experiments, we show that the attack is fast and reliable. On average, it takes about 40 to 60 s to finish and the success rate is 88% to 97%. Finally, we propose changes to both the TCP specification and implementation to eliminate the root cause of the problem.

Investigation of the 2016 Linux TCP Stack Vulnerability at Scale

To combat blind in-window attacks against TCP, changes proposed in RFC 5961 have been implemented by Linux since late 2012. While successfully eliminating the old vulnerabilities, the new TCP implementation was reported in August 2016 to have introduced a subtle yet serious security flaw. Assigned CVE-2016-5696, the flaw exploits the challenge ACK rate limiting feature that could allow an off-path attacker to infer the presence/absence of a TCP connection between two arbitrary hosts, terminate such a connection, and even inject payload into an unsecured TCP connection. In this work, we perform a comprehensive measurement of the impact of the new vulnerability. This includes (1) tracking the vulnerable Internet servers, (2) monitoring the patch behavior over time, (3) picturing the overall security status of TCP stacks at scale. Towards this goal, we design a scalable measurement methodology to scan the Alexa top 1 million websites for almost 6 months. We also present how notifications impact the patching behavior, and compare the result with the Heartbleed and the Debian PRNG vulnerability. The measurement represents a valuable data point in understanding how Internet servers react to serious security flaws in the operating system kernel.

Investigation of the 2016 Linux TCP Stack Vulnerability at Scale

To combat blind in-window attacks against TCP, changes proposed in RFC 5961 have been implemented by Linux since late 2012. While successfully eliminating the old vulnerabilities, the new TCP implementation was reported in August 2016 to have introduced a subtle yet serious security flaw. Assigned CVE-2016-5696, the flaw exploits the challenge ACK rate limiting feature that could allow an off-path attacker to infer the presence/absence of a TCP connection between two arbitrary hosts, terminate such a connection, and even inject malicious payload. In this work, we perform a comprehensive measurement of the impact of the new vulnerability. This includes (1) tracking the vulnerable Internet servers, (2) monitoring the patch behavior over time, (3) picturing the overall security status of TCP stacks at scale. Towards this goal, we design a scalable measurement methodology to scan the Alexa top 1 million websites for almost 6 months. We also present how notifications impact the patching behavior, and compare the result with the Heartbleed and the Debian PRNG vulnerability. The measurement represents a valuable data point in understanding how Internet servers react to serious security flaws in the operating system kernel.

Attacking NTP's Authenticated Broadcast Mode

We identify two attacks on the Network Time Protocol (NTP)'s cryptographically-authenticated broadcast mode. First, we present a replay attack that allows an on-path attacker to indefinitely stick a broadcast client to a specific time. Second, we present a denial-of-service (DoS) attack that allows an off-path attacker to prevent a broadcast client from ever updating its system clock; to do this, the attacker sends the client a single malformed broadcast packet per query interval. Our DoS attack also applies to all other NTP modes that are `ephemeral' or `preemptable' (including manycast, pool, etc). We then use network measurements to give evidence that NTP's broadcast and other ephemeral/preemptable modes are being used in the wild. We conclude by discussing why NTP's current implementation of symmetric-key cryptographic authentication does not provide security in broadcast mode, and make some recommendations to improve the current state of affairs.

Security for multipath TCP: a constructive approach

Multipath TCP (MPTCP) is a new protocol being developed in the IETF|s MPTCP working group in order to provide higher communication availability and to improve the throughput between two multi-addressed endpoints by using multiple paths. Due to the multipath nature and specifically its path management, some new security threats arise apart from those that are already present in standard single-path TCP. These new attacks include flooding and hijacking attacks performed by an off-path attacker. In this paper, we explore different solutions in order to cover the identified security flaws. The main proposal is based on hash chains, which significantly reduces the initial set of threats resulting in a residual group of vulnerabilities, which are also identified.