Security Analysis of the Micro Transport Protocol with a Misbehaving - - PowerPoint PPT Presentation

▶
security analysis of the micro transport protocol with a
SMART_READER_LITE
LIVE PREVIEW

Security Analysis of the Micro Transport Protocol with a Misbehaving - - PowerPoint PPT Presentation

Jun 04, 2023 163 likes •559 views

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver Florian Adamsky, Syed Ali Khayam, Rudolf Jger and Muukrishnan Rajarajan The 4th

slide-1
SLIDE 1

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver

Florian Adamsky, Syed Ali Khayam, Rudolf Jäger and Muukrishnan Rajarajan

florian@adamsky.it http://florian.adamsky.it

The 4th International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery 2012

  • B. Sc. Florian Adamsky | CyberC 2012

1 / 26

slide-2
SLIDE 2

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver

Contents

1 Introduction

Background

2 Aack Details and Results

Aack 1: Lying about the Delay Aack 2: Lazy Opt-Ack Aack 3: Opt-Ack

3 Countermeasures

Randomly Skipped Packets

4 Conclusions

  • B. Sc. Florian Adamsky | CyberC 2012

2 / 26

slide-3
SLIDE 3

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Introduction

Contents

1 Introduction

Background

2 Aack Details and Results

Aack 1: Lying about the Delay Aack 2: Lazy Opt-Ack Aack 3: Opt-Ack

3 Countermeasures

Randomly Skipped Packets

4 Conclusions

  • B. Sc. Florian Adamsky | CyberC 2012

3 / 26

slide-4
SLIDE 4

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Introduction

Introduction

BitTorrent is the most widely used Peer-to-Peer (P2P) application Before December 2008, TCP was its default transfer protocol Since this date, uTorrent switched from TCP to the Micro Transport Protocol (uTP) which is based on UDP

  • B. Sc. Florian Adamsky | CyberC 2012

4 / 26

slide-5
SLIDE 5

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Introduction | Background

What’s the problem with TCP and BitTorrent?

BitTorrent is in most cases background traffic BitTorrent uses multiple connection at once

TCP distributes the available bandwidth evenly across connections The more connections one application uses, the larger the share of bandwidth

Old Solution: Configure bandwidth limit

Requires knowledge about the own Internet connection Oen lets big head room which is unused Bad configured BitTorrent client can harm other people in the network

⇒ Novel transport protocol based on UDP: Micro Transport Protocol (uTP)

  • B. Sc. Florian Adamsky | CyberC 2012

5 / 26

slide-6
SLIDE 6

e next Internet meltdown?

http://www.theregister.co.uk/2008/12/01/richard_bennett_utorrent_udp/print.html

slide-7
SLIDE 7

Why the sky isn’t falling

http: //arstechnica.com/old/content/2008/12/utorrents-switch-to-udp-and-why-the-sky-isnt-falling.ars

slide-8
SLIDE 8

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Introduction | Background

Micro Transport Protocol (uTP)

uTP is a reliable transport protocol which makes use of UDP

Introduces a new congestion control: Low Extra Delay Background Transport (LEDBAT)

Similarities to TCP

Window based flow control Sequence numbers and ACK numbers

Differences to TCP

Sequence numbers and ACKs refer to packets, not bytes SACK uses a 32 bitmask where each bit represents a packet No congestion control (Slow-start, congestion avoidance, …) → LEDBAT

Advantages:

Detects foreground traffic and automatically slows down Scales beer when sending over many connections at once

. . ..

Traffic

. . . Time . Bandwidth . . . uTP traffic . . All Traffic (except uTP)

  • B. Sc. Florian Adamsky | CyberC 2012

8 / 26

slide-9
SLIDE 9

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Introduction | Background

Micro Transport Protocol (uTP)

uTP is a reliable transport protocol which makes use of UDP

Introduces a new congestion control: Low Extra Delay Background Transport (LEDBAT)

Similarities to TCP

Window based flow control Sequence numbers and ACK numbers

Differences to TCP

Sequence numbers and ACKs refer to packets, not bytes SACK uses a 32 bitmask where each bit represents a packet No congestion control (Slow-start, congestion avoidance, …) → LEDBAT

Advantages:

Detects foreground traffic and automatically slows down Scales beer when sending over many connections at once

. . ..

Traffic

. . . Time . Bandwidth . . . uTP traffic . . All Traffic (except uTP)

  • B. Sc. Florian Adamsky | CyberC 2012

8 / 26

slide-10
SLIDE 10

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Introduction | Background

LEDBAT (Congestion Control)

LEDBAT uses one way delay as the main congestion measurement

Will be compared with previous values (not absolute values)

. . Sender . Receiver . t

s n d

[ D a t a ] . ∆t = trcv − tsnd . ∆ t [ A C K ] And also:

Packet loss (max_window = max_window × 0.78) ACKs during one window

IETF just tries to standardize LEDBAT (Dra 09³)

³http://tools.ietf.org/id/draft-ietf-ledbat-congestion-09.txt

  • B. Sc. Florian Adamsky | CyberC 2012

9 / 26

slide-11
SLIDE 11

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results

Contents

1 Introduction

Background

2 Aack Details and Results

Aack 1: Lying about the Delay Aack 2: Lazy Opt-Ack Aack 3: Opt-Ack

3 Countermeasures

Randomly Skipped Packets

4 Conclusions

  • B. Sc. Florian Adamsky | CyberC 2012

10 / 26

slide-12
SLIDE 12

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 1: Lying about the Delay

Aack Idea 1 (Delay Measurement)

..

Idea

. Lying about the one way delay to induce the sender to send more and more packets into the network How to do that? . . Sender . Aacker A . t

s n d

[ D a t a ] . ∆t = 1 ms . ∆ t [ A C K ]

  • B. Sc. Florian Adamsky | CyberC 2012

11 / 26

slide-13
SLIDE 13

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 1: Lying about the Delay

Code Snippet

1

scaled_gain = MAX_CWND_INCREASE_PACKETS_PER_RTT

2

* delay_factor * window_factor;

4

max_window += scaled_gain; Delay Calucation delay_factor = 100 ms − min( ⃗

  • ur_hist)

100 ms delay_factor = 100 ms − 0 100 ms delay_factor = 1

  • B. Sc. Florian Adamsky | CyberC 2012

12 / 26

slide-14
SLIDE 14

Bandwidth Usage (100 MiB File Transfer)

. . . 20 . 40 . 60 . 80 . 100 . 120 . 140 . 160 . 180 . 0 . 1,000 . 2,000 . 3,000 . 4,000 . 5,000 . 6,000 . Time in Seconds . Packets per Second . . . Without Aack . . Delay Aack

slide-15
SLIDE 15

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 2: Lazy Opt-Ack

Aack Idea 2 (Packet loss)

..

Idea

. We do not inform the sender about packet loss How to do that? As an aacker we’re not interested in data integrity Save all packets we got sequentially and not according to there sequence number

  • B. Sc. Florian Adamsky | CyberC 2012

14 / 26

slide-16
SLIDE 16

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 2: Lazy Opt-Ack

Aack Idea 2

Normal packet sorting . . . . 1 . 1 . 2 . Packet Loss . 3 . 3 . 4 . 5 . 6 . 4 Aack: Packet sorting sequentially . . . . 1 . 1 . 3 . 2 . 3 . 4 . 5 . 6 . 4

  • B. Sc. Florian Adamsky | CyberC 2012

15 / 26

slide-17
SLIDE 17

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 2: Lazy Opt-Ack

Aack Idea 2

Normal packet sorting . . . . 1 . 1 . 2 . Packet Loss . 3 . 3 . 4 . 5 . 6 . 4 Aack: Packet sorting sequentially . . . . 1 . 1 . 3 . 2 . 3 . 4 . 5 . 6 . 4

  • B. Sc. Florian Adamsky | CyberC 2012

15 / 26

slide-18
SLIDE 18

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 2: Lazy Opt-Ack

Bandwidth Usage with Loss Aack

. . . . 20 . 40 . 60 . 80 . 100 . 120 . 140 . 160 . 180 . 0 . 2,000 . 4,000 . 6,000 . Time in Seconds . Packets per Second . . . Without Aack . . Delay Aack . . Lazy Opt-Ack Aack

  • B. Sc. Florian Adamsky | CyberC 2012

16 / 26

slide-19
SLIDE 19

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 3: Opt-Ack

Aack Idea 3 (Selective Acknowledgment)

..

Idea

. Pretend that we got all packets always via SACK How to do that? Again: As an aacker we’re not interested in data interested Set all bits of the SACK bitmask to the value 1 Replace that code:

1

uint m = 0; // SACK bitmask with this code

1

uint m = UINT_MAX; // SACK bitmask

  • B. Sc. Florian Adamsky | CyberC 2012

17 / 26

slide-20
SLIDE 20

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 3: Opt-Ack

Bandwidth Usage with SACK Aack

. . . . 20 . 40 . 60 . 80 . 100 . 120 . 140 . 160 . 180 . 0 . 2,000 . 4,000 . 6,000 . Time in Seconds . Packets per Second . . . Without Aack . . Delay Aack . . Lazy Opt-Ack Aack . . Opt-Ack Aack

  • B. Sc. Florian Adamsky | CyberC 2012

18 / 26

slide-21
SLIDE 21

Bandwidth from all Aacks

. . . 5 . 10 . 15 . 20 . 25 . 5.43 . 6.2 . 15.39 . 23.84 . Average Bandwidth Usage in Mbit/s

. . . w/o Aack . . Delay Aack . . . Lazy Opt-ACK . . . Opt-ACK

slide-22
SLIDE 22

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 3: Opt-Ack

Can we create Congestion?

Congestion Experiment

Constant 50 Mbit/s UDP stream with iPerf Parallel to this file transfer via uTP

Results Client Packet loss Without Aack 0 % Delay Aack 0 % Lazy Opt-Ack Aack 7 % Opt-Ack Aack 42 %

  • B. Sc. Florian Adamsky | CyberC 2012

20 / 26

slide-23
SLIDE 23

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 3: Opt-Ack

Can we create Congestion?

Congestion Experiment

Constant 50 Mbit/s UDP stream with iPerf Parallel to this file transfer via uTP

Results Client Packet loss Without Aack 0 % Delay Aack 0 % Lazy Opt-Ack Aack 7 % Opt-Ack Aack 42 %

  • B. Sc. Florian Adamsky | CyberC 2012

20 / 26

slide-24
SLIDE 24

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 3: Opt-Ack

Can we create Congestion?

Congestion Experiment

Constant 50 Mbit/s UDP stream with iPerf Parallel to this file transfer via uTP

Results Client Packet loss Without Aack 0 % Delay Aack 0 % Lazy Opt-Ack Aack 7 % Opt-Ack Aack 42 %

  • B. Sc. Florian Adamsky | CyberC 2012

20 / 26

slide-25
SLIDE 25

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Aack Details and Results | Aack 3: Opt-Ack

Can we create Congestion?

Congestion Experiment

Constant 50 Mbit/s UDP stream with iPerf Parallel to this file transfer via uTP

Results Client Packet loss Without Aack 0 % Delay Aack 0 % Lazy Opt-Ack Aack 7 % Opt-Ack Aack 42 %

  • B. Sc. Florian Adamsky | CyberC 2012

20 / 26

slide-26
SLIDE 26

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Countermeasures

Contents

1 Introduction

Background

2 Aack Details and Results

Aack 1: Lying about the Delay Aack 2: Lazy Opt-Ack Aack 3: Opt-Ack

3 Countermeasures

Randomly Skipped Packets

4 Conclusions

  • B. Sc. Florian Adamsky | CyberC 2012

21 / 26

slide-27
SLIDE 27

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Countermeasures | Randomly Skipped Packets

Randomly Skipped Packets

..

Idea

. A sender randomly skips packets and checks if the receivers acknowledge those packets. Countermeasure only against the lazy opt-ack and opt-ack aack This countermeasure will reduce the performance a lile bit

  • B. Sc. Florian Adamsky | CyberC 2012

22 / 26

slide-28
SLIDE 28

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Countermeasures | Randomly Skipped Packets

Performance Analysis

. . . 5 . 10 . 15 . 20 . 25 . 10 . 20 . 30 . 40 . Time (s) . Bandwidth in Mbps . . .

uTP without Countermeasure

. .

uTP with Countermeasure

  • B. Sc. Florian Adamsky | CyberC 2012

23 / 26

slide-29
SLIDE 29

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Conclusions

Contents

1 Introduction

Background

2 Aack Details and Results

Aack 1: Lying about the Delay Aack 2: Lazy Opt-Ack Aack 3: Opt-Ack

3 Countermeasures

Randomly Skipped Packets

4 Conclusions

  • B. Sc. Florian Adamsky | CyberC 2012

24 / 26

slide-30
SLIDE 30

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Conclusions

Conclusion

e main contributions of our paper are: Proposed the following three aacks against the novel uTP:

delay aack lazy optimistic aack

  • ptimistic aack

Shown a detail evaluation and shown the severity of those aacks Presented a countermeasure against those aacks

  • B. Sc. Florian Adamsky | CyberC 2012

25 / 26

slide-31
SLIDE 31

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver | Conclusions

ank You

estions?

florian@adamsky.it http://florian.adamsky.it

Institutions:

  • B. Sc. Florian Adamsky | CyberC 2012

26 / 26

slide-32
SLIDE 32

Delay Comparison

. . . 20 . 40 . 60 . 80 . 100 . 120 . 140 . 160 . 180 . 200 . 0.85 . 0.9 . 0.95 . 1 . 1.05 . Packets . delay_factor . . . Without Aack . . With Aack

slide-33
SLIDE 33

Delay Comparison

. . . 5 . 10 . 15 . 20 . 25 . 30 . 35 . 40 . 45 . . 10 . 20 . 30 . 40 . 50 . 60 . Delay in ms with 5ms Variance . Bandwidth in Mbit/s . . . uTP without aack . . uTP with aack

slide-34
SLIDE 34

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver

libutp

1

uint m = 0; // SACK bitmask

3

for (size_t i = 0; i < window; i++) {

4

if (inbuf.get(ack_nr + i + 2) != NULL) {

5

m |= 1 << i;

6

}

7

}

  • B. Sc. Florian Adamsky | CyberC 2012

3 / 7

slide-35
SLIDE 35

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver

libutp

1

uint m = UINT_MAX; // SACK bitmask

3

for (size_t i = 0; i < window; i++) {

4

if (inbuf.get(ack_nr + i + 2) != NULL) {

5

m |= 1 << i;

6

}

7

}

  • B. Sc. Florian Adamsky | CyberC 2012

4 / 7

slide-36
SLIDE 36

Congestion Experiment (w/o Aack)

. . . 10 . 20 . 30 . 40 . 50 . 60 . 70 . 0 . 2,000 . 4,000 . 6,000 . Time (s) . Packets per Second . . .

Constant UDP Stream

. .

Normal uTP Transfer

slide-37
SLIDE 37

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver

Congestion Experiment (Lazy Opt-ACK)

. . . 10 . 20 . 30 . 40 . 50 . 60 . 0 . 2,000 . 4,000 . 6,000 . Time (s) . Packets per Second . . .

Constant UDP Stream

. .

Lazy Opt-ACK Aack

  • B. Sc. Florian Adamsky | CyberC 2012

6 / 7

slide-38
SLIDE 38

Security Analysis of the Micro Transport Protocol with a Misbehaving Receiver

Congestion Experiment (Opt-ACK Aack)

. . . 10 . 20 . 30 . 40 . 50 . 60 . 0 . 2,000 . 4,000 . 6,000 . Time (s) . Packets per Second . . .

Constant UDP Stream

. .

Opt-ACK Aack

  • B. Sc. Florian Adamsky | CyberC 2012

7 / 7