Subject: [tcpm] off-path TCP sequence number inference

From: "Eggert, Lars" <[email-masked]>
Date: Tue, 22 May 2012 13:59:43 +0000

FYI:

Abstract—In this paper, we report a newly discovered “off-path TCP sequence number inference” attack enabled by firewall middleboxes. It allows an off-path (i.e., not man-in- the-middle) attacker to hijack a TCP connection and inject malicious content, effectively granting the attacker write-only permission on the connection. For instance, with the help of unprivileged malware, we demonstrate that a successful attack can hijack an HTTP session and return a phishing Facebook login page issued by a browser. With the same mechanisms, it is also possible to inject malicious Javascript to post tweets or follow other people on behalf of the victim. The TCP sequence number inference attack is mainly enabled by the sequence-number-checking firewall middleboxes. Through carefully-designed and well-timed probing, the TCP sequence number state kept on the firewall middlebox can be leaked to an off-path attacker. We found such firewall middleboxes to be very popular in cellular networks — at least 31.5% of the 149 measured networks deploy such firewalls. Finally, since the sequence-number-checking feature is enabled by design, it is unclear how to mitigate the problem easily.

http://web.eecs.umich.edu/~zhiyunq/tcp_sequence_number_inference/
http://web.eecs.umich.edu/~zhiyunq/pub/oakland12_TCP_sequence_number_inference.pdf

Lars

---

From: Joe Touch <[email-masked]>
Date: Tue, 22 May 2012 10:00:43 -0700

On 5/22/2012 6:59 AM, Eggert, Lars wrote:
> FYI:
>
> Abstract—In this paper, we report a newly discovered “off-path TCP sequence number inference” attack enabled by firewall middleboxes. It allows an off-path (i.e., not man-in- the-middle) attacker to hijack a TCP connection and inject malicious content, effectively granting the attacker write-only permission on the connection. For instance, with the help of unprivileged malware, we demonstrate that a successful attack can hijack an HTTP session and return a phishing Facebook login page issued by a browser. With the same mechanisms, it is also possible to inject malicious Javascript to post tweets or follow other people on behalf of the victim. The TCP sequence number inference attack is mainly enabled by the sequence-number-checking firewall middleboxes. Through carefully-designed and well-timed probing, the TCP sequence number state kept on the firewall middlebox can be leaked to an off-path attacker. We found such firewall middleboxes to be very popular in cellular networ!
 ks — at 
least 31.5% of the 149 measured networks deploy such firewalls. Finally, since the sequence-number-checking feature is enabled by design, it is unclear how to mitigate the problem easily.
> http://web.eecs.umich.edu/~zhiyunq/pub/oakland12_TCP_sequence_number_inference.pdf

Hi, Lars (et al.),

I don't know anyone who considers "off-path" attacks to include malware 
*on the device being attacked*, as this does. That's not only on-path, 
that's on-device.

The details require:

     - guessing the 4-tuple by either spoofing the IP address
     of the destination, tracking packets from/on the device
     using malware, or "guessing" properly

     - guessing the sequence number, either using on-device malware
     or scanning the 32-bit window range

The on-path vulnerability is having any device on-path - including 
on-device - that can see the 4-tuple and sequence numbers of existing 
connections.

The key insight here appears to be that non-privileged malware can see 
the 4-tuples of connections on a device -- but that doesn't help much 
unless the ISNs are *predictable* or the attacker probes the sequence 
window - which can be easily be used as an indication of attack.

The true off-path vulnerability here - without on-path assistance - is 
guessing the 4-tuple *and* guessing the sequence number correctly. The 
traffic generated to create such an attack itself could easily be 
tracked to raise flags on a device (e.g., large number of packets to 
nonexistent connections).

To misquote recent news, seems like a "tempest in a TCP pot"

Joe