Abstract:We analyzed the generation of protocol header fields in the implementations of multiple TCP/IP network stacks and found new ways to leak information about global protocol states. We then demonstrated new covert channels by remotely observing and modifying the system's global state via these protocol fields. Unlike earlier works, our research focuses on hosts that reside in firewalled networks (including source address validation -- SAV), which is a very common scenario nowadays. Our attacks are designed to be non-disruptive -- in the exfiltration scenario, this makes the attacks stealthier and thus extends their longevity, and in case of host alias resolution and similar techniques -- this ensures the techniques are ethical. We focused on ICMP, which is commonly served by firewalls, and on UDP, which is forecasted to take a more prominent share of the Internet traffic with the advent of HTTP/3 and QUIC, though we report results for TCP as well. The information leakage scenarios we discovered enable the construction of practical covert channels which directly pierce firewalls, or indirectly establish communication via hosts in firewalled networks that also employ SAV. We describe and test three novel attacks in this context: exfiltration via the firewall itself, exfiltration via a DMZ host, and exfiltration via co-resident containers. These are three generic, new use cases for covert channels that work around firewalling and enable devices that are not allowed direct communication with the Internet, to still exfiltrate data out of the network. In other words, we exfiltrate data from isolated networks to the Internet. We also explain how to mount known attacks such as host alias resolution, de-NATting and container co-residence detection, using the new information leakage techniques.

Firewall Fingerprinting and Denial of Firewalling Attacks.

Firewall fingerprinting

Denial of Firewalling

A Reference Model And System Architecture For Database Firewall

Detecting Rogue Access Points Using Client-agnostic Wireless Fingerprints.

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Accurate and Robust Rogue Access Point Detection with Client-Agnostic Wireless Fingerprinting

Subverting Stateful Firewalls with Protocol States (Extended Version)

CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure

Fingerprinting Sdn Applications Via Encrypted Control Traffic

A Design of Firewall Based on Feedback of Intrusion Detection System in Cloud Environment

Fingerprinting OpenFlow controllers: The first step to attack an SDN control plane

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

Detection and Defense of SYN Flood Attacks Based on Dual Stack Network Firewall

DoS Attacks and Countermeasures on Network Devices

HiFIND: A High-Speed Flow-Level Intrusion Detection Approach with DoS Resiliency.

A Reflection-Based Channel Fingerprint to Locate Physically Intrusive Devices in ICS

Distributing and Obfuscating Firewalls via Oblivious Bloom Filter Evaluation

Efficient and Low Overhead Website Fingerprinting Attacks and Defenses based on TCP/IP Traffic

Autonomous Attack Mitigation Through Firewall Reconfiguration

Design and Implementation of Enterprise Network Security System Based on Firewall