The Attacker Waits For Several Milliseconds

Aus Vokipedia
Wechseln zu: Navigation, Suche


We analyze the prandom pseudo random quantity generator (PRNG) in use in the Linux kernel (which is the kernel of the Linux operating system, as well as of Android) and show that this PRNG is weak. The prandom PRNG is in use by many "consumers" in the Linux kernel. We focused on three customers on the community stage - the UDP source port generation algorithm, the IPv6 move label generation algorithm and the IPv4 ID generation algorithm. The flawed prandom PRNG is shared by all these customers, which allows us to mount "cross layer attacks" against the Linux kernel. In these attacks, we infer the inner state of the prandom PRNG from one OSI layer, and use it to either predict the values of the PRNG employed by the other OSI layer, or to correlate it to an inner state of the PRNG inferred from the other protocol. Using this approach we will mount a really efficient DNS cache poisoning assault in opposition to Linux.



We acquire TCP/IPv6 movement label values, or UDP source ports, or iTagPro shop TCP/IPv4 IP ID values, reconstruct the interior PRNG state, then predict an outbound DNS question UDP source port, which speeds up the attack by a factor of x3000 to x6000. This assault works remotely, but may also be mounted locally, across Linux users and across containers, and (relying on the stub resolver) can poison the cache with an arbitrary DNS document. Additionally, we will identify and track Linux and Android devices - we accumulate TCP/IPv6 movement label values and/or UDP supply port values and/or TCP/IPv4 ID fields, reconstruct the PRNG inner state and iTagPro smart device correlate this new state to beforehand extracted PRNG states to identify the identical gadget. IPv4/IPv6 community address. This course of known as DNS resolution. In order to resolve a reputation into an handle, the appliance uses a regular working system API e.g. getaddrinfo(), which delegates the query to a system-vast service referred to as stub resolver.



This local (on-machine) service in turn delegates the question to one of the identify servers in the working system’s network configuration, e.g. an ISP/campus/enterprise name server, or a public name server such as Google’s 8.8.8.8. This recursive resolver does the precise DNS decision in opposition to the authoritative DNS servers which might be responsible for sub-bushes of the hierarchical DNS global database. Both the stub resolver and iTagPro smart device the recursive resolver may cache the DNS reply for higher performance in subsequent decision requests for the same host name. DNS is basic to the operation of the Internet/web. For example, iTagPro product each non-numeric URL requires the browser to resolve the host title earlier than a TCP/IP connection to the vacation spot host will be initiated. Likewise, SMTP depends on DNS to search out the network deal with of mail servers to which emails ought to be sent. Therefore, attacks that modify the decision course of, and specifically attacks that change existing DNS data in the cache of a stub/recursive resolver or introduce fake DNS data to the cache, can result in a severe compromise of the user’s integrity and privateness.



Our focus is on poisoning the cache of the Linux stub resolver. The DNS protocol is implemented on top of UDP, ItagPro which is a stateless protocol. As a way to spoof a DNS reply, the attacker needs to know/guess all of the UDP parameters within the UDP header of the genuine DNS answer, particularly the supply and destination community addresses, and the supply and vacation spot ports. We assume the attacker knows the destination community tackle, which is the deal with of the stub resolver, and the supply network deal with, which is the deal with of the recursive identify server used by the stub resolver. The attacker additionally knows the UDP supply port for the DNS reply, which is fifty three (the usual DNS port), iTagPro smart tracker and thus the one unknown is the destination port (nominally 16 bits, practically about 15 bits of entropy), which is randomly generated by the stub resolver’s system. At the DNS stage, the attacker must know/guess the transaction ID DNS header field (16 bits, abbreviated "TXID"), which is randomly generated by the DNS stub resolver, ItagPro and the DNS query itself, which the attacker can infer or affect.



Thus, the attacker needs to predict/guess 31 bits (the UDP destination port, and the DNS TXID) with the intention to poison the cache of the stub resolver. DNS solutions is sort of impractical to carry out over today’s Internet within a reasonable time-frame, and subsequently improvements to DNS cache poisoning strategies that can make them extra sensible are a topic of ongoing research. Browser-primarily based tracking is a common manner through which advertisers and surveillance agents identify customers and observe them throughout multiple browsing periods and web sites. As such, it's widespread in today’s Internet/web. Web-based mostly tracking may be completed directly by web sites, or by commercials positioned in websites. We analyze the prandom PRNG, which is basically a mixture of 4 linear feedback shift registers, and present easy methods to extract its inner state given a couple of PRNG readouts. For DNS cache poisoning, we receive partial PRNG readouts by establishing multiple TCP/IPv6 connections to the target machine, and observing the move labels on the TCP packets sent by the gadget (on recent kernels, we are able to alternatively set up TCP/IPv4 connections and observe the IP ID values).

Meine Werkzeuge
Namensräume

Varianten
Aktionen
Navigation
Werkzeuge