Abstract
We present practical off-path TCP injection attacks for connections between current, nonbuggy browsers and Web servers. The attacks allow
Web-cache poisoning
with malicious objects such as spoofed Web pages and scripts; these objects can be cached for a long period of time, exposing any user of that cache to
cross-site scripting
,
cross-site request forgery
, and
phishing
attacks.
In contrast to previous TCP injection attacks, we do not require MitM capabilities or malware running on the client machine. Instead, our attacks rely on a weaker assumption, that the user only enters a malicious Web site, but does not download or install any application. Our attacks exploit subtle details of the TCP and HTTP specifications, and features of legitimate (and very common) browser implementations. An empirical evaluation of our techniques with current versions of browsers shows that connections with most popular Web sites are vulnerable.
We conclude this work with practical client- and server-end defenses against our attacks.
Funder
Israel Science Foundation
Check Point Institute for Information Security
Ministry of Science and Technology, Israel
Publisher
Association for Computing Machinery (ACM)
Subject
Safety, Risk, Reliability and Quality,General Computer Science
Reference48 articles.
1. Advanced Network Architecture Group. 2013. Spoofer project. http://spoofer.csail.mit.edu/summary.php. Advanced Network Architecture Group. 2013. Spoofer project. http://spoofer.csail.mit.edu/summary.php.
2. Alexa Web Information Company. 2013. Top sites. http://www.alexa.com/topsites. Alexa Web Information Company. 2013. Top sites. http://www.alexa.com/topsites.
3. Baker F. and Savola P. 2004. Ingress Filtering for Multihomed Networks. RFC 3704 (Best Current Practice). Baker F. and Savola P. 2004. Ingress Filtering for Multihomed Networks . RFC 3704 (Best Current Practice).
4. Barth A. 2011. The Web Origin Concept. RFC 6454 (Proposed Standard). Barth A. 2011. The Web Origin Concept . RFC 6454 (Proposed Standard).
Cited by
20 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献