Malicious apps enable tcp hijacking and dns poisoning attacks
Cross User/App Network Attacks - Hijacking TCP Connections and DNS Cache Poisoning via a Malicious User/App (Extended Version)
Cryptography and Security
Summary
Many people believe that modern internet security features stop hackers from messing with connections between your computer and websites. This paper shows that even without direct access, a bad app on your device can team up with a remote attacker to guess secret details about these connections. Knowing these secrets lets the attacker take over web sessions or put fake addresses into your device’s address book. The authors tested this on many operating systems and reported the issues so companies could fix them.
What this means in practice
- •For operating system developers: Improve TCP and DNS implementations to prevent attacks that learn connection secrets from local apps.
- •For network security engineers: Design defenses that detect or block network attacks combining malicious local apps and remote attackers.
Authors
Tamir Shahar, Amit Klein
Abstract
Off-path network attacks against TCP and DNS (over UDP) client-server connections are generally considered impractical nowadays, due to built-in security features in these protocols, e.g. randomized TCP (initial) sequence numbers and randomized UDP source ports, respectively. In this work, we refute this presumption by demonstrating that an unprivileged malicious application running on the client (but practically off-path), when combined with a remote off-path adversary, can enable powerful network attacks against such connections. We show how such a local--remote collaboration between the malicious application and a remote adversary allows inference of sensitive connection state, including TCP sequence numbers and DNS stub-resolver UDP source ports. Our attacks exploit standard socket API calls such as bind(), protocol mechanisms such as IP options, and operating system features such as cBPF and procfs to infer the TCP initial sequence number (ISN) and the UDP source port in use by the connection of interest. Specifically, we take advantage of certain properties of the ISN generation algorithm as implemented in major operating systems. We demonstrate TCP connection hijacking in Linux, Android, Windows, macOS and iOS, and DNS cache poisoning against Windows, Android and the popular systemd-resolved DNS stub resolver in Linux. We evaluate our techniques across multiple operating systems and realistic deployment settings, including environments behind port-preserving NAT-integrated routers. We disclosed our techniques to Microsoft, Apple, Linux and Google, which led to the release of several patches.