TCP SPLIT HANDSHAKE ATTACK Mehmet Burak AKGÜN 04/27/2011

Outline Introduction Attack Mechanism NSS LABS Test Results 2

Introduction TCP Transport Layer Protocol Connection Oriented State-full sequence # 3

Introduction TCP Reliability ACK/NACK Flow Control Congestion Control Slow start /Automatic Repeat Request 4

3-way Handshake SYN – client initiates – Sets sequence number to random number SYN/ACK – Server generates own random number ACK – Connection Established 5

Outline Introduction Method Test of commercial products 6

RFC TCP State Diagram 7 Section 3.3 of RFC 793 defines TCP handshake as a 4 step process. Thus designed state diagram allows receiving only SYN while in SYN_SENT state. RFC 793 definition of TCP Handshake

Simultaneous Open Mode 4 step handshaking allows Simultaneous Open Mode 8

SPLIT SYN/ACK 9 Malicious Server splits the SYN/ ACK and sends ACK only. 5 step TCP SPLIT

SPLIT SYN/ACK 10 Step two (the server's initial ACK), appears to have no effect on establishing a new TCP session, and may optionally dropped.

So What Can an Attacker Accomplish with this Attack? 11 The attacker has reversed the logical direction of the client’s initial connection

Scenario Say an unpatched client in your network connects to a malicious drive-by download web server that is not leveraging the split-handshake attack. The malicious web site tries to get your client to execute some javascript that forces your client to download malware. If you have gateway IPS and AV, your IPS may detect the malicious javascript, or your AV may catch the malware. In either case, your security scanning would block the attack. However, if the malicious web server adds the TCP split-handshake connection to the same attack, your IPS and AV systems may be confused by the direction of the traffic, and not scan the web server’s content. Now the malicious drive-by download would succeed, despite your gateway security protection. CNL

Outline Introduction Method Test of commercial products 13

Network Firewall Group Test Q by NSS LABS Full Report $3500 Products Tested: Check Point Power Cisco ASA 5585 Fortinet Fortigate 3950 Juniper SRX 5800 Palo Alto Networks PA-4020 SonicWALL NSA E8500 Companies are releasing firmware updates ! 14

References  The TCP Split Handshake: Practical Effects on Modern Network Equipment, Macrothink Institute, Network Protocols and Algorithms, ISSN , 2010, Vol. 2, No. 1 John, Wolfgang & Tafvelin, Sven, “Analysis of Internet Backbone Traffic and Header Anomalies Observed”. IMC '07: Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, Pp October  affect-me/ affect-me/     newsletters/security-newsletter-17/a-new-way-for-tcp-connection newsletters/security-newsletter-17/a-new-way-for-tcp-connection CNL

QUESTIONS ? CNL