Static Detection of Packet Injection Vulnerabilities: A Case for Identifying Attacker-controlled Implicit Information Leaks

Off-path packet injection attacks are still serious threats to the Internet and network security. In recent years, a number of studies have discovered new variations of packet injection attacks, targeting critical protocols such as TCP. We argue that such recurring problems need a systematic solution. In this paper, we design and implement PacketGuardian, a precise static taint analysis tool that comprehensively checks the packet handling logic of various network protocol implementations. The analysis operates in two steps. First, it identifies the critical paths and constraints that lead to accepting an incoming packet. If paths with weak constraints exist, a vulnerability may be revealed immediately. Otherwise, based on “secret” protocol states in the constraints, a subsequent analysis is performed to check whether such states can be leaked to an attacker. In the second step, observing that all previously reported leaks are through implicit flows, our tool supports implicit �...

• Type: Journal
• Year: 2015
• Where: CCS
• Authors: Qi Alfred Chen, Zhiyun Qian, Yunhan Jack Jia, Yuru Shao, Zhuoqing Morley Mao
• Keywords: CCS 2015, Security Privacy