TIME IS POWER - QUANTUMINSERT 1 Learning Goals The Following - PowerPoint PPT Presentation

create your own exercise Mario Silaci, Lucas Wolf TIME IS POWER - QUANTUMINSERT 1

Learning Goals The Following Learning Goals are Covered in the Lecture PreLab Lab What are requirements to perform the QUANTUM X X X INSERT (QI)? How does the QI work in general? X X X Background: NSA, FISC and Snowden X X Which protocols are used in the QI? X X X Which tools are necessary for the QI? X X How do you forge correct packets? X X Related Work? X X 2

Connection via Internet 0 3

QUANTUMINSERT: Requirements 0 4

QUANTUMINSERT: Requirements 0 Ability to monitor the traffic between the victim and the responding server 5

QUANTUMINSERT: Requirements 0 Timing Attack Faster connection Slower connection 6

QUANTUMINSERT: Victim Requests Website 1 GET 7

QUANTUMINSERT: Shooter Gets Notified 2 ! GET GET 8

QUANTUMINSERT: Shooter Injects Malicious Response 3 INJ 9

QUANTUMINSERT: Server Sends Legitimate Response 4 RES INJ 10

QUANTUMINSERT: Result 5 Injection packet Attackvector (INJ) Gets interpreted as the HTTP response Partial HTTP response (RES) 11

QUANTUMINSERT: Result 5 Injection packet Attackvector (INJ) Gets interpreted as First fragments get the HTTP response dropped (Sequence number Partial HTTP response Duplicates) (RES) 12

QUANTUMINSERT: Result 5 Injection packet Attackvector (INJ) Gets interpreted as the HTTP response Partial HTTP response (RES) 13

The Responsibles: NSA and GCHQ [1] [2] agent victim “The early bird catches the worm.” 14

The Responsibles: Tailored Access Operations Division NSA‘s hacker division Implemented several QUANTUM attacks Motto: "Your data is our data, your equipment is our equipment - anytime, any place, by any legal means.“ [3] 15

The Advocates: Foreign Intelligence Surveillance Court(FISC) • secret court which makes secret rulings with gag orders • Was empowered after the Foreign Intelligence Surveillance Act (FISA) and has been called "almost a parallel Supreme Court.“ [4] FISC denied 11 requests out of ~33.900 in 33 years, i.e. approved ~99,97% 16

[5] 17

Whistleblower: Edward Snowden • Former secret service system administrator and agent • Worked as contractor for NSA and CIA • Is against mass surveillance in the internet  2013: Leaked sensitive information(e.g. NSA‘s surveillance techniques) in cooperation with Glenn Greenwald and Laura Poitras [6] 18

7 Layer ISO/OSI model Application Layer Application Layer Presentation Layer Presentation Layer Session Layer Session Layer Transport Layer Transport Layer Network Layer Network Layer Data Link Layer Data Link Layer Physical Layer Physical Layer 19

QUANTUMINSERT: Relevant Protocols HTTP HTTP TCP TCP Network Layer Network Layer Data Link Layer Data Link Layer Physical Layer Physical Layer 20

Reminder: Transmission Control Protocol(TCP) Handshake 21

TCP Handshake with QUANTUMINSERT 1 2 3 4 22

TCP Handshake with QUANTUMINSERT 1 2 3 4 Identical sequence and acknowledge numbers 23

Hypertext Transfer Protocol (HTTP) Server Client 24

Hypertext Transfer Protocol (HTTP) Server Client Request Response 25

Hypertext Transfer Protocol (HTTP) Server Client Statuscode: Defines the functionality of the response 26

27 [7]

Teaser Practical Part: Setup 28

Teaser Practical Part: Intended Connection 29

Teaser Practical Part: Redirection Injection 30

Teaser Practical Part: Manipulated Connection 31

Teaser Practical Part: Real Life Analogy 32 [8]

Teaser Practical Part: Closer Look Transatlantic GCHQ‘s shooter wire endpoint (North America) You (probably Transatlantic unaware) wire endpoint (Europe) NSA‘s server Facebook (Foxacid) headquarter 33 [8]

THANKS! Sources: • [1]: Seal of the United States National Security Agency, https://commons.wikimedia.org/wiki/File:Seal_of_the_United_States_National_Security_Agency.svg • [2]: EFF NSA-Logo Parody https://www.flickr.com/photos/electronicfrontierfoundation/12225935484 • [3]: Question mark head https://commons.wikimedia.org/wiki/File:No_image.JPG • [4]: How the NSA collects data http://www.theverge.com/2013/7/17/4517480/nsa-spying-prism-surveillance-cheat-sheet • [5]: Court house https://upload.wikimedia.org/wikipedia/commons/b/b0/Garrett_Prettyman_district_court.jpg • [6]: Edward Snowden https://upload.wikimedia.org/wikipedia/commons/6/60/Edward_Snowden-2.jpg • [7]: There is more than one way to QUANTUM https://theintercept.com/document/2014/03/12/one-way-quantum/ • [8]: World map https://pixabay.com/de/weltkarte-global-geographie-1958134/ • All other figures were made by ourselves 34