Off-path TCP injection attacks

Yossi Gilad*, Amir Herzberg

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

22 Scopus citations

Abstract

We present practical off-path TCP injection attacks for connections between current, nonbuggy browsers and Web servers. The attacks allow Web-cache poisoning with malicious objects such as spoofed Web pages and scripts; these objects can be cached for a long period of time, exposing any user of that cache to cross-site scripting, cross-site request forgery, and phishing attacks. In contrast to previous TCP injection attacks, we do not require MitM capabilities or malware running on the client machine. Instead, our attacks rely on a weaker assumption, that the user only enters a malicious Web site, but does not download or install any application. Our attacks exploit subtle details of the TCP and HTTP specifications, and features of legitimate (and very common) browser implementations. An empirical evaluation of our techniques with current versions of browsers shows that connections with most popular Web sites are vulnerable. We conclude this work with practical client- and server-end defenses against our attacks.

Original languageAmerican English
Article number13
JournalACM Transactions on Information and System Security
Volume16
Issue number4
DOIs
StatePublished - Apr 2014
Externally publishedYes

Keywords

  • Browser security
  • Web and network security

Fingerprint

Dive into the research topics of 'Off-path TCP injection attacks'. Together they form a unique fingerprint.

Cite this