roya ensafi, jong chun park, deepak kapur, and jedidiah r. crandall university of new mexico, dept....
TRANSCRIPT
IDLE PORT SCANNING AND
NON-INTERFERENCE ANALYSIS OF NETWORK PROTOCOL
STACKS USING MODEL CHECKING
Roya Ensafi, Jong Chun Park, Deepak Kapur, and Jedidiah R. Crandall
University of New Mexico, Dept. of Computer Science
USENIX 2010
Advanced Defense Lab 2
Outline
Introduction Related Work Formalizing Non-interference Analysis Finding Idle Scan Experimental confirmation of
counterexamples
Advanced Defense Lab 3
Introduction
Network reconnaissance is the important first step of virtually all network attacks. [Link]
Idle scans were introduced by Antirez in a 1998. [Link]Based on non-random, sequential IPIDs of
older network stacks
Advanced Defense Lab 4
Introduction - Idle Scan
Advanced Defense Lab 5
Introduction - Idle Scan IPID-based idle scans have been implemented
in nmap [Link]
But modern network stacks randomize the IPID [Link]
FTP bounce scans are currently the only known way to port scan a victim host or network without routing forged packets to that host or network from the attacker [Link]This paper proposes another one
Advanced Defense Lab 6
Related Work Staniford et al. use simulated annealing to
detect stealthy scans. [Link]
Leckie and Kotagiri present a probabilistic approach
Gates and Kang et al. consider the problem of stealth port scans based on using many distributed hosts (e.g., a botnet) to perform the scan.
Advanced Defense Lab 7
Related Work(cont.)
Non-interference [Link] is a widely used concept of information flow security
Non-interference proved to be a very useful property because it can be specified with Linear Temporal Logic (LTL [Link]).
Advanced Defense Lab 8
Formalizing Non-interference Analysis
A host is viewed to be at the end of the network, i.e., an end host.
Advanced Defense Lab 9
SYN Cache [Link]
The SYN cache is a cache for pending SYN packets for which a SYN/ACK has been sent and the host is waiting for an ACK.
In our model packets are only removed from the SYN cache when a TCP RST is received from the source IP address and port of the original SYN packet
Advanced Defense Lab 10
Idel Scan model
Advanced Defense Lab 11
Non-interference Analysis Model
Advanced Defense Lab 12
Formalizing Non-interference Analysis
Using SAL [Link] for modelingSAT-based [Link] bounded model checker
Advanced Defense Lab 13
Advanced Defense Lab 14
Advanced Defense Lab 15
Formalizing Non-interference Analysis -- Assumptions
A major abstraction is that we consider the proper reply to SYN/ACK packets to be “drop” for open ports and RST for closed ports.
Another major abstraction is that each of the two buffers in our split SYN cache has only a single entry.
Advanced Defense Lab 16
Port Status
Advanced Defense Lab 17
Finding Idle Scan
RST rate limit
Advanced Defense Lab 18
Finding Idle Scan
SYN cache
Advanced Defense Lab 19
Experimental confirmation of counterexamples
SetupVirtualBoxTUN/TAP [Link]Zombie
○ kernel 2.4 host (Fedora Core 1)○ Windows XP host with no service packs○ Linux kernel 2.6 host (CentOS 5.2)○ FreeBSD 7.1.1 host
Advanced Defense Lab 20
Experimental confirmation of counterexamples - RST rate
For a real FreeBSD system, RSTs are limited to a default of 200 per second
Our implementation sends 2000 each of two different types of packets, each at a rate of 180 per second, to the victim and FreeBSD zombie, respectively
Advanced Defense Lab 21
Experimental confirmation of counterexamples - RST rate
Advanced Defense Lab 22
Experimental confirmation of counterexamples – SYN cache Linux kernel 2.4 uses a simple buffer for the SYN
cache, with between 128 and 1024 entries depending on the memory available on the system.
our implementation50 forged SYNs, then 50 each of forged SYNs and
SYNs where the attacker uses their own return IP (1000 per second)
200 more forged SYNs (1000 per second)sends 200 each of forged SYNs and SYNs where the
attacker uses their own return IP address (400 per second)
Advanced Defense Lab 23
Experimental confirmation of counterexamples – SYN cache
Result between different OSes
Advanced Defense Lab 24
Experimental confirmation of counterexamples – SYN cache
Idle port scan20,000 forged SYN packets (with random
return ports that are closed on the zombie)
At half the rate, alternating forged SYNs with the target port on the victim as the source port and valid SYNs with the return address of the attacker
Advanced Defense Lab 25
Experimental confirmation of counterexamples – SYN cache
Result for idle port scan