SLIDE 1
Attack Class: Address Spoofing
- L. Todd Heberlein
Attack Class: Address Spoofing L. Todd Heberlein 23 Oct 1996 Net - - PowerPoint PPT Presentation
Attack Class: Address Spoofing L. Todd Heberlein 23 Oct 1996 Net - - PowerPoint PPT Presentation
Attack Class: Address Spoofing L. Todd Heberlein 23 Oct 1996 Net Squared Inc. todd@NetSQ.com Overview of Talk l Introduction l Background material l Attack class l Example attack l Popular questions l Extensions UCD Vulnerabilities Group l
SLIDE 2
SLIDE 3
UCD Vulnerabilities Group
l UCDÕs vulnerabilities group studies
attacks and their underlying vulnerabilities for the purpose of modeling them. We believe a sufficiently complete model will allow us to both predict new instances of general attack classes and build generic schemes for detecting exploitations of general vulnerability classes.
SLIDE 4
Address Masquerading
l Many of todayÕs network services use
host names or addresses for both identification AND authentication.
l Examples: rlogin, rsh, mountd,
wrappers, firewalls
l Higher level services use these lower
level services (e.g., backups)
SLIDE 5
History of Talk
l R.T. Morris, 85 l S. Bellovin, 89 l UCD Discussed,
- Feb. 94
l UCD Presented,
Mar 94
l Mitnick-Tsutomu,
Dec 94
l UCD paper,
spring 95
l Mendax, Rbone,
summer 95
l Wee (UCD), fall 95 l USAF project,
- Jan. 96
SLIDE 6
Orders and Dialogues
l Need better names
È asynchronous vs. synchronous È connectionless vs. connection-oriented
l An order is a request requiring only a
single ÒmessageÓ.
l A dialogue is a request which requires
the exchange of several, interdependent ÒmessagesÓ.
l From recipientÕs point of view
SLIDE 7
Connectionless Communication (Orders)
l Connectionless communication (e.g.,
supplied by UDP), does not keep state information
l No guarantee of delivery or order l Efficient in many environments l RPC on UDP (NFS)
SLIDE 8
Connection-oriented Communication (Dialogues)
l Additional state information kept,
representing a limited history of communication
l Provides ÒguaranteeÓ that information
will both arrive and arrive in order
l May require more resources and be
less efficient in some environments
SLIDE 9
TCP/IP Example
l Three phases: set-
up, data exchange, tear-down
l set-up is a three-
way handshake
l Third packet
requires information from second packet.
SYN Seq #: X Ack #: 0 SYN, ACK Seq #: Y Ack #: X+1 ACK Seq #: X+1 Ack #: Y+1
Time Host A Host B Time
Connection Established
Connection Set-up
SLIDE 10
Routing in an internet
l Host constructs packet and simply places it
- n the network
l As the packet travels across the internet, only
the destination address is used
B A
From: A To: B
G E
SLIDE 11
The Attack
l Definition of what an attack is l Restrictions to be concerned with l Strategy of the attacker
SLIDE 12
Definition of Attack
l Players: Alice (A),
Bob (B), and Eve (E)
l Bob grants Alice
special privileges by listing AliceÕs address or name in a special file
l Eve is the villain l EveÕs goal: To get
Bob to perform a specific action that he would perform for Alice but not Eve
SLIDE 13
Restrictions
l The placement of Alice, Bob, and Eve
(the topology)
l The nature of the communication
required by Eve to carry out the attack.
l These restrictions will help define EveÕs
strategy
SLIDE 14
Architecture (or Topology)
l Alice and Bob on separate networks; Eve in
- ne of four locations
l Other architectures are simply special cases
- f this one
B E2 E1 A E4 E3
Cloud 1 Cloud 2
SLIDE 15
Nature of Communication
l EveÕs communication must be
indistinguishable from AliceÕs communication with Bob
l Order communication
È request is carried out immediately È No role-backs
l Dialogue communication
È must make sense to Bob È Alice cannot be allowed to interfere
SLIDE 16
EveÕs Strategy
l Establish a forged communication with
Bob
l Prevent Alice from alerting Bob until it is
too late
SLIDE 17
Establishing a Forged Communication
l Construct packet, and place it on the network.
The network will deliver it for Eve
l For order-based communication, the
communication is done
l For dialogue-based communication, further
messages must be exchanged
È if Eve is in E1, E2, or E3, further communication is easy È if Eve is in E4, she must either modify the messagesÕ routes, or predict what the messages will contain
SLIDE 18
Prevent Alice from Interfering
l Prevent BobÕs packets from reaching
Alice (or AliceÕs from reaching Bob)
l Take away AliceÕs ability to respond
È wait for Alice to go down for maintenance È force Alice to crash È block part of AliceÕs operating system from processing BobÕs packets (graceful ??)
l Complete communication before Alice
can respond
SLIDE 19
Example Attack
l Used against Tsutomu Shimamura, attributed
to Kevin Mitnick
l Detailed ten years earlier by R.T. Morris E A B
adversary server X-client Prevent Alice From Responding Probe for sequence number prediction Forge communication
1 2 3 Players Steps A B E
non-existent address 1 2 3
SLIDE 20
Questions
l CouldnÕt this attack
be stopped by simply configuring routers not to forward obviously forged packets?
Point of Convergence E A G G B Route
SLIDE 21
Questions cont.
l CouldnÕt we require all ÒtrustedÓ hosts to
belong to the same physical network and use lower level addresses (e.g., ethernet)?
ie(7D) Devices ie(7D) NAME ie - Intel 82586 Ethernet device driver SYNOPSIS /dev/ie DESCRIPTION ... The DL_SET_PHYS_ADDR_REQ primitive changes the 6 octet Eth- ernet address currently associated (attached) to this
- stream. The credentials of the process which originally
SLIDE 22
Questions cont.
l CouldnÕt we simply write a more
secure algorithm for choosing initial sequence numbers?
l Only if Eve is NOT is position E1, E2, or E3,
and Eve is NOT able to alter the path of BobÕs messages to Alice (e.g., source routing or routing table modification). Also, this solution does not apply to order-based communications.
SLIDE 23
Extensions to this Attack: Session Hijacking
l One-time authentication services are
vulnerable
l Commercial programs exist which do
session hijacking
l Demonstrated against systems with
challenge-response authentication
SLIDE 24
Extensions cont.
l EveÕs goal: To get Bob to accept
information he would only accept from Alice
B A1 Bob NFS-Alice NIS-Alice DNS-Alice A3 A2 Rlogin Connection Request Reply Forged Reply