Advanced Network Inference Techniques Based on Network Protocol - - PowerPoint PPT Presentation

▶
advanced network inference techniques based on network
SMART_READER_LITE
LIVE PREVIEW

Advanced Network Inference Techniques Based on Network Protocol - - PowerPoint PPT Presentation

Oct 27, 2022 248 likes •652 views

Advanced Network Inference Techniques Based on Network Protocol Stack Information Leaks Roya Ensafi October 2013 Still A Peach Attacker Still A Peach Attacker Zombie Victim Attacker What if we could? Scan a firewall port or a hidden

slide-1
SLIDE 1

Advanced Network Inference Techniques Based on Network Protocol Stack Information Leaks

Roya Ensafi October 2013

slide-2
SLIDE 2

Still A Peach Attacker

slide-3
SLIDE 3

Still A Peach Attacker

Attacker Zombie Victim

slide-4
SLIDE 4

ة Scan a firewall port or a hidden machine ة Infer IP­based trust relationships ة Infer communication constraints ة Infer imposed geographical (dis)­connectivity ة Infer intentional packet drops ة…

What if we could?

Attacker Zombie Victim

slide-5
SLIDE 5

Outline

ة Background knowledge ة Brief overview of USENIX’10 paper ء Idle Port Scanning and Non­interference Analysis of Network Protocol Stacks ء SYN backlog idle scan Overview PAM’13(Submitted) paper ء Detecting Bi­Directional Intentional Packet Drops Using Idle Scans ء Real Data examples ة Future work

slide-6
SLIDE 6

Model checking network stack

  • Is there a way we automate finding

inference attacks...

  • Create transition system of network protocol

stack

  • Check all possible scenarios for non­

interference property

slide-7
SLIDE 7

Shared (limited) resources

➔Global IPID variable ➔ Global counter that incremented by one any time

packet is sent out.

➔ Unique numbers used for fragmentations. ➔ At anytime, it shows number of packets has sent to other

destinations.

➔RST rate limiting counter ➔ A machine limits the number of RST packets that it will send in a

given time period.

➔SYN backlog/cache ➔ A cache for holding half­open TCP connections ➔ Waiting for proper ACK or RST to drop it

slide-8
SLIDE 8

Port & port scanning

Host1 Host 2

SYN cache = 0 RST counter = 1 SYN cache = 0 RST counter = 1

Port is open Port is open

slide-9
SLIDE 9

Port & port scanning

Host1 Host 2

SYN cache = 1 SYN Packet RST counter = 1 SYN cache = 0 RST counter = 1

Port is open Port is open

slide-10
SLIDE 10

Port & port scanning

Host1 Host 2

SYN cache = 1 RST counter = 1 SYN cache = 0 RST counter = 1

port is open

SYN Packet

Port is open

slide-11
SLIDE 11

Port & port scanning

Host1 Host 2

SYN cache = 1 RST counter = 1 SYN/ACK Packet SYN cache = 0 RST counter = 1 SYN Packet

Port is open Port is open

slide-12
SLIDE 12

Host1 Host 2

SYN cache = 0 RST counter = 1 SYN/ACK Packet ACK Packet SYN cache = 0 RST counter = 1

Port is open

SYN Packet

TCP hand shake

slide-13
SLIDE 13

Idle scanning

Server1 Client 1 Attacker Client 2 Server2 Attacker

Port is open Port is closed

Senario1 Senario 2

slide-14
SLIDE 14

Idle scanning

Server1 Client 1 Attacker Client 2 Server2 Attacker

Port is open Port is closed

Senario1 Senario 2

slide-15
SLIDE 15

IPID idle scanning

Server1 Client 1 Attacker Client 2 Server2 Attacker

IPID is 3177 SYN/ACK Packet

Attacker

IPID is 3177 SYN/ACK Packet SYN/ACK Packet Port is open Port is closed Spoofed SYN Packet Spoofed SYN Packet RST Packet IPID = 3178 RST Packet IPID=3177 3178 IPID=3177

slide-16
SLIDE 16

IPID idle scanning

Server1 Client 1 Attacker Client 2 Server2 Attacker

IPID is 3178 SYN/ACK Packet

Attacker

IPID is 3179 SYN/ACK Packet Port is open Port is closed IPID=3179 IPID=3178

slide-17
SLIDE 17

Idle scanning with brick wall

First idle scan that allows an attacker to scan firewalled networks and ports and infer trust relationships without routing any packets to the victim

slide-18
SLIDE 18

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker

SYN cache = 0 SYN cache = 0

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

slide-19
SLIDE 19

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker

SYN cache = 0 SYN cache = 0

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

slide-20
SLIDE 20

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker

SYN cache = 1 SYN cache = 1

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

Spoofed SYN packet Spoofed SYN packet

slide-21
SLIDE 21

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

SYN cache = 1 SYN cache = 1 Spoofed SYN packet SYN/ACK Packet SYN/ACK Packet Spoofed SYN packet

slide-22
SLIDE 22

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

SYN cache = 1 Spoofed SYN packet SYN/ACK Packet Spoofed SYN packet RST Packet SYN cache = 1

slide-23
SLIDE 23

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

SYN cache = 0 Spoofed SYN packet SYN/ACK Packet Spoofed SYN packet RST Packet SYN cache = 1

slide-24
SLIDE 24

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

SYN cache = 0 Spoofed SYN packet SYN/ACK Packet Spoofed SYN packet RST Packet SYN cache = 1

slide-25
SLIDE 25

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker

SYN cache = 0 SYN cache = 1

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

SYN Packet SYN Packet

slide-26
SLIDE 26

SYN backlog idle scanning

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is closed

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Zombie2 Victim2 Attacker

SYN cache = 1 SYN cache = 1

Victim2 Victim1 Attacker

Port is open

Zombie1 Victim1 Attacker

Port is open

Victim2 Victim1 Attacker

Port is open

Server1 Client1 Attacker

Port is open

Victim2 Victim1 Attacker Zombie1 Victim1 Attacker Victim2 Victim1 Attacker Server2 Client2 Attacker

SYN Packet SYN Packet SYN Cookie Packet SYN ACK Packet

slide-27
SLIDE 27

Can we combine idle scans?

  • Is there a way that the combination of IPID and

SYN backlog idle scan can give us more information?

  • Can we use our idle scans to figure intentional

packet drops?

– YES, we can.

slide-28
SLIDE 28

Can we detect censorship?

slide-29
SLIDE 29

Can we connect to Server?

slide-30
SLIDE 30

No Direction Blocked

slide-31
SLIDE 31

Server to Client Blocked

00

slide-32
SLIDE 32

Client to Server Blocked

slide-33
SLIDE 33

Simple, Effective, Unobtrusive

  • Requirements:
  • 1. A global IPID machine in the area of target
  • 2. A server IP that has open port and SYN backlog
  • Based on our experience, sending 5 spoofed SYN packets for

120 seconds is more than enough to detect different cases.

slide-34
SLIDE 34

Real Data

slide-35
SLIDE 35

Real Data

1

slide-36
SLIDE 36

Real Data

slide-37
SLIDE 37

No Direction Blocked Then Client to Server Blocked

slide-38
SLIDE 38

No Direction Blocked Then Client to Server Blocked

slide-39
SLIDE 39

Global IPID Machine Selection

slide-40
SLIDE 40

Future work