混合IPID分配的非路径TCP利用
Off-Path TCP Exploits of the Mixed IPID Assignment
摘要：
在本文中，我们发现了一种新的off-path TCP劫持攻击，可用于终止受害者TCP连接或通过操纵新的混合IPID分配方法向受害者TCP连接注入伪造数据，该方法广泛用于Linux内核版本4.18及更高版本，以帮助抵御TCP劫持攻击。攻击有三个步骤。首先，偏离路径攻击者可以将TCP数据包的IPID分配从更安全的基于每个套接字的策略降级为不太安全的基于散列的策略，从而构建一个共享IPID计数器，在受害者上形成侧通道。其次，攻击者通过观察受害者上的共享IPID计数器来检测TCP连接的存在。第三，攻击者通过观察共享IPID计数器的边信道来推断检测到的连接的序列号和确认号。因此，攻击者可以完全劫持连接，即，重置连接或破坏数据流。我们评估这种偏离路径的TCP攻击在现实世界中的影响。我们的案例研究SSH拒绝服务，操纵Web流量，并中毒BGP路由表显示其对广泛的应用程序的威胁。实验结果表明，我们的离线TCP攻击可以在215秒内构建，成功率超过88%。最后，我们分析了利用的根本原因，并开发了一种新的IPID分配方法来击败这种攻击。我们原型我们的防御在Linux 4.18，并确认其有效性，通过广泛的评估在互联网上的实际应用。
英文摘要：
In this paper, we uncover a new off-path TCP hijacking attack that can be used to terminate victim TCP connections or inject forged data into victim TCP connections by manipulating the new mixed IPID assignment method, which is widely used in Linux kernel version 4.18 and beyond to help defend against TCP hijacking attacks. The attack has three steps. First, an off-path attacker can downgrade the IPID assignment for TCP packets from the more secure per-socket-based policy to the less secure hash-based policy, building a shared IPID counter that forms a side channel on the victim. Second, the attacker detects the presence of TCP connections by observing the shared IPID counter on the victim. Third, the attacker infers the sequence number and the acknowledgment number of the detected connection by observing the side channel of the shared IPID counter. Consequently, the attacker can completely hijack the connection, i.e., resetting the connection or poisoning the data stream. We evaluate the impacts of this off-path TCP attack in the real world. Our case studies of SSH DoS, manipulating web traffic, and poisoning BGP routing tables show its threat on a wide range of applications. Our experimental results show that our off-path TCP attack can be constructed within 215 seconds and the success rate is over 88%. Finally, we analyze the root cause of the exploit and develop a new IPID assignment method to defeat this attack. We prototype our defense in Linux 4.18 and confirm its effectiveness through extensive evaluation over real applications on the Internet.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
