(Still) Exploiting TCP Timestamps Veit N. Hailperin 1 1 scip AG Hack - - PowerPoint PPT Presentation

▶
still exploiting tcp timestamps
SMART_READER_LITE
LIVE PREVIEW

(Still) Exploiting TCP Timestamps Veit N. Hailperin 1 1 scip AG Hack - - PowerPoint PPT Presentation

May 08, 2023 152 likes •626 views

(Still) Exploiting TCP Timestamps Veit N. Hailperin 1 1 scip AG Hack in Paris, June 2015 Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 1 / 47 About Me Security Consultant & Researcher @ scip AG @fenceposterror

slide-1
SLIDE 1

(Still) Exploiting TCP Timestamps

Veit N. Hailperin1

1scip AG

Hack in Paris, June 2015

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 1 / 47

slide-2
SLIDE 2

About Me

Security Consultant & Researcher @ scip AG @fenceposterror Bug in the matrix

Disclaimer

I will use IP on the slides synonym to IP address for space reasons. Timestamps allows refer to TCP timestamps if not

  • therwise noted.

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 2 / 47

slide-3
SLIDE 3

Outline

1

What are TCP Timestamps?

2

A History of Exploitation and Failed Remediation

3

More Fun with TCP Timestamps

4

What Now?

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 3 / 47

slide-4
SLIDE 4

TCP Timestamps

Introduced in 1992 Described in RFC1323 Extension to provide PAWS and improved RTTM A constant, strictly monotonous increasing number

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 4 / 47

slide-5
SLIDE 5

A TCP Timestamp

Kind: 8 Length: 10 bytes +-------+-------+---------------------+---------------------+ |Kind=8 | 10 | TS Value (TSval) |TS Echo Reply (TSecr)| +-------+-------+---------------------+---------------------+ 1 1 4 4

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 5 / 47

slide-6
SLIDE 6

Attack Vector - Timestamp 2001 - Uptime Calculation

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 6 / 47

slide-7
SLIDE 7

Attack Vector - Timestamp

2001: Uptime Calculation

Timestamp != Uptime Multiple timestamps ⇒ frequency of host ⇒ timestamp & frequency ⇒ uptime Uptime related to patch level

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 7 / 47

slide-8
SLIDE 8

Attack Vector - Timestamp

2001: Uptime Calculation - Remediation

Disable timestamps (bad idea) Randomize timestamps at boot (problems: lack of entropy, determination of initial value easy) Start each new TCP Connection with 0 (problem: still PAWS) Timestamp per IP/port pair (problem: only a question of time) More problems: Might break syn flood protection under linux Timestamp counter for each IP

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 8 / 47

slide-9
SLIDE 9

Attack Vector - Timestamp

2015: Uptime Calculation

Still possible1 . . . Also: timestamps observed over a longer period also lets us know their habits, e.g. when shutting down, when booting, . . .

1It’s a tiny bit more tricky for a small group of systems

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 9 / 47

slide-10
SLIDE 10

Attack Vector - Timestamp 2005 - Host Identification

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 10 / 47

slide-11
SLIDE 11

Attack Vector - Timestamp

2005: Host Identification

= ⇒

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 11 / 47

slide-12
SLIDE 12

Attack Vector - Timestamp

2005: Host Identification - Remediation

Randomizing/Zeroing timestamps (loss of functionality) Use a different counter for each connection and initialize with 0 (problem: PAWS) Like above but with randomized start (problem: PAWS)

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 12 / 47

slide-13
SLIDE 13

Attack Vector - Timestamp

2015: Host Identification

Still possible2. . .

2It’s a tiny bit more tricky for a small group of systems

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 13 / 47

slide-14
SLIDE 14

Attack Vector - Clock Skew

Let’s assume we did fix the aforementioned issues, are we done? no :( (Mainly) due to physical properties (heat, fabrication, . . . ) clock isn’t exact This slight imperfection of clock can be used as identifier (clock skew)

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 14 / 47

slide-15
SLIDE 15

Attack Vector - Clock Skew 2005 - Host Identification

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 15 / 47

slide-16
SLIDE 16

Attack Vector - Clock Skew

2005: Host Identification

Possible even if host/port tuple TCP timestamp solution got implemented Multiple IPs virtually hosted not possible with timestamp (because TS per OS) With clock skew not a problem, because they share hardware Interesting to track users

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 16 / 47

slide-17
SLIDE 17

Attack Vector - Clock Skew

2005: Host Identification - Remediation

Reduce device’s clock skew (difficult!) Mask clock skew by multiplying timestamp with random value (breaks RFC) mod skewmask: Mask clock skew with constant Encrypt timestamps (breaks RFC) Table mapping between random 32-bit values and internal representation of real timestamps (breaks RFC)

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 17 / 47

slide-18
SLIDE 18

Attack Vector - Clock Skew

2015: Host Identification

Still possible3 . . .

3Some honeypots try to avoid it

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 18 / 47

slide-19
SLIDE 19

Attack Vector - Clock Skew 2005 - Network Layout Information Gathering

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 19 / 47

slide-20
SLIDE 20

Attack Vector - Clock Skew

2005: Network Layout Information Gathering

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 20 / 47

slide-21
SLIDE 21

Attack Vector - Clock Skew

2005: Network Layout Information Gathering - Remediation

Same as for host identification

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 21 / 47

slide-22
SLIDE 22

Attack Vector - Clock Skew

2015: Network Layout Information Gathering

Still possible . . .

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 22 / 47

slide-23
SLIDE 23

Attack Vector - Clock Skew 2006 - Reveal Hidden Services

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 23 / 47

slide-24
SLIDE 24

Attack Vector - Clock Skew

2006: Reveal Hidden Services

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 24 / 47

slide-25
SLIDE 25

Attack Vector - Clock Skew

2006: Reveal Hidden Services - Remediation

Dummy Traffic Fixed QoS for all connections ⇒ No anonymous stream affects another (problem: potential DoS if connections idle) Oven Controlled Crystal Oscillators (OCXO) Always run at maximum CPU load

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 25 / 47

slide-26
SLIDE 26

Attack Vector - Clock Skew

2015: Reveal Hidden Services

Still possible . . .

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 26 / 47

slide-27
SLIDE 27

Possible Targets

Users Servers

Conclusion

More or less everyone/everything is affected

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 27 / 47

slide-28
SLIDE 28

More Fun with TCP Timestamps 2015 - Reveal Active-Active Loadbalancing

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 28 / 47

slide-29
SLIDE 29

More Fun with TCP Timestamps

2015 Load-Balanced Check!

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 29 / 47

slide-30
SLIDE 30

More Fun with TCP Timestamps

2015 Load-Balanced Check!

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 30 / 47

slide-31
SLIDE 31

More Fun with TCP Timestamps 2007/2015 - Network Layout Information Gathering

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 31 / 47

slide-32
SLIDE 32

More Fun with TCP Timestamps

2015: Network Layout Information Gathering

DEMO4

4https://github.com/luh2/timestamps

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 32 / 47

slide-33
SLIDE 33

More Fun with TCP Timestamps

2015: Network Layout Information Gathering

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 33 / 47

slide-34
SLIDE 34

More Fun with TCP Timestamps

2015: Network Layout Information Gathering

Count IPs behind a NAT (if you are the receiving end of connections) (2007) Identify hosts behind a NAT (if you have multiple ports open) (2015) TCP timestamp is the same ⇒ services on same host TCP timestamp is different ⇒ services on different hosts Some ports answer with no timestamp ⇒ Can’t tell

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 34 / 47

slide-35
SLIDE 35

More Fun with TCP Timestamps

2015: Network Layout Information Gathering

No tool that exploits this knowledge Does someone want to write a Nmap script?

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 35 / 47

slide-36
SLIDE 36

More Fun with TCP Timestamps

2007/2015: Network Layout Information Gathering - Remediation

Increment randomly (defeats RTTM) Rewrite timestamp on NAT device

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 36 / 47

slide-37
SLIDE 37

More Fun with TCP Timestamps 2015 - Improve OS Fingerprints of NAT-ed Devices

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 37 / 47

slide-38
SLIDE 38

More Fun with TCP Timestamps

2015 Improve OS Fingerprints

Repeat: What is a OS Fingerprint? Nmap doesn’t assume aforementioned scenario, but direct fingerprinting Use knowledge which ports belong together Don’t use closed ports

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 38 / 47

slide-39
SLIDE 39

More Fun with TCP Timestamps

2015 Improve Fingerprints!

DEMO

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 39 / 47

slide-40
SLIDE 40

Proposed Solutions

Terminate TCP connection at firewall

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 40 / 47

slide-41
SLIDE 41

Why Haven’t We Fixed This?

Quote: Kohno et al.

[. . . ] it is possible to extract security-relevant signals from data canonically considered to be noise. ”There are other ways to gather the same intel”-excuse Not considered important Not many good solutions so far

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 41 / 47

slide-42
SLIDE 42

More Timestamps

ICMP Timestamp (CVE-1999-0524) TLS Timestamp (Tor Bug #7277) HTTP Timestamp (Murdoch, 2013) . . .

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 42 / 47

slide-43
SLIDE 43

Summary of (presented) Attacks

TCP Timestamps

◮ 2001 - Uptime Calculation ◮ 2005 - Host Identification ◮ 2015 - Network Layout Information Gathering ◮ 2015 - Reveal Active-Active Loadbalancing ◮ 2015 - Improve OS Fingerprints of NAT-ed Devices

Clock Skew

◮ 2005 - Host Identification / User Tracking ◮ 2005 - Network Layout Information Gathering ◮ 2006 - Reveal Hidden Services Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 43 / 47

slide-44
SLIDE 44

What Now? Good solutions/suggestions welcome!

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 44 / 47

slide-45
SLIDE 45

For Further Reading

  • B. Ransford and E. Rosensweig.

SkewMask: Frustrating ClockSkew Fingerprinting Attempts. December, 2007

  • T. Kohno, A. Broid and K. Claffy.

Remote physical device fingerprinting IEEE Transactions on Dependable and Secure Computing, vol. 2, no. 2, pp. 93–108, May 2005.

  • S. Sharma, A. Hussain and H. Saran.

Experience with heterogenous clock-skew based device fingerprinting Proceeding LASER ’12 Proceedings of the 2012 Workshop on Learning from Authoritative Security Experiment Results, Pages 9-18.

  • B. McDanel.

TCP Timestamping - Obtaining System Uptime Remotely http://www.securiteam.com/securitynews/5NP0C153PI.html, March 14, 2001

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 45 / 47

slide-46
SLIDE 46

For Further Reading 2

  • V. Jacobson, R. Braden and D. Borman.

TCP Extensions for High Performance. Network Working Group, Request for Comments: 1323, May 1992

  • S. Bellovin.

Defending Against Sequence Number Attacks. Network Working Group, Request for Comments: 1948, May 1996

  • M. Silbersack.

Improving TCP/IP security through randomization without sacrificing interoperability. University of Wisconsin – Milwaukee, 2005

  • S. Murdoch.

Hot or not: revealing hidden services by their clock skew. Proceeding CCS ’06 Proceedings of the 13th ACM conference on Computer and communications security, Pages 27 - 36

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 46 / 47

slide-47
SLIDE 47

So Long and Thanks For All The Fish

Me: @fenceposterror Thanks to people who inspired or helped: Krzysztof Kotowicz, Stefan Friedli, Max Hailperin

Veit N. Hailperin (scip AG) (Still) Exploiting TCP Timestamps HiP 2015 47 / 47