使用协议状态颠覆有状态防火墙（扩展版）
Subverting Stateful Firewalls with Protocol States (Extended Version)
摘要：
分析了多个TCP/IP网络协议栈实现中协议头字段的生成，发现了泄漏全局协议状态信息的新途径。然后，我们通过远程观察和修改系统的全局状态，通过这些协议字段演示了新的隐蔽通道。与早期的作品不同，我们的研究集中在主机驻留在防火墙网络（包括源地址验证-SAV），这是一个非常常见的情况下，现在。我们的攻击被设计为非破坏性的-在渗透场景中，这使得攻击更加隐蔽，从而延长了它们的寿命，并且在主机别名解析和类似技术的情况下-这确保了技术是道德的。我们关注的是防火墙通常使用的TCP，以及UDP，随着HTTP/3和QUIC的出现，UDP预计将在互联网流量中占据更突出的份额，尽管我们也报告了TCP的结果。我们发现的信息泄漏的情况下，使实际的隐蔽通道，直接穿透防火墙的建设，或间接建立通信通过主机的防火墙网络，也采用SAV。我们描述和测试三种新的攻击在这种情况下：通过防火墙本身的渗透，通过DMZ主机渗透，并通过共存容器渗透。这是隐蔽通道的三个通用新用例，它们围绕防火墙工作，并使不允许与互联网直接通信的设备仍然可以将数据从网络中泄露出去。换句话说，我们将数据从孤立的网络泄露到互联网。我们还解释了如何安装已知的攻击，如主机别名解析，去NAT和容器共存检测，使用新的信息泄漏技术。
英文摘要：
We analyzed the generation of protocol header fields in the implementations of multiple TCP/IP network stacks and found new ways to leak information about global protocol states. We then demonstrated new covert channels by remotely observing and modifying the system's global state via these protocol fields. Unlike earlier works, our research focuses on hosts that reside in firewalled networks (including source address validation -- SAV), which is a very common scenario nowadays. Our attacks are designed to be non-disruptive -- in the exfiltration scenario, this makes the attacks stealthier and thus extends their longevity, and in case of host alias resolution and similar techniques -- this ensures the techniques are ethical. We focused on ICMP, which is commonly served by firewalls, and on UDP, which is forecasted to take a more prominent share of the Internet traffic with the advent of HTTP/3 and QUIC, though we report results for TCP as well. The information leakage scenarios we discovered enable the construction of practical covert channels which directly pierce firewalls, or indirectly establish communication via hosts in firewalled networks that also employ SAV. We describe and test three novel attacks in this context: exfiltration via the firewall itself, exfiltration via a DMZ host, and exfiltration via co-resident containers. These are three generic, new use cases for covert channels that work around firewalling and enable devices that are not allowed direct communication with the Internet, to still exfiltrate data out of the network. In other words, we exfiltrate data from isolated networks to the Internet. We also explain how to mount known attacks such as host alias resolution, de-NATting and container co-residence detection, using the new information leakage techniques.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
