6 papers
Cross User/App Network Attacks - Hijacking TCP Connections and DNS Cache Poisoning via a Malicious User/App (Extended Version)
Tamir Shahar, Amit Klein
Off-path network attacks against TCP and DNS (over UDP) client-server connections are generally considered impractical nowadays, due to built-in security features in these protocol…
One (Thread) Can Keep a (PRNG) Secret, but not Two
Ehood Porat, Amit Klein, Benny Pinkas
We present a novel, practical attack on the IPv6 Fragment ID generation algorithm of XNU, which is the kernel used by Apple products such as macOS and iOS. This attack exploits a r…
Device Tracking via Linux's New TCP Source Port Selection Algorithm (Extended Version)
Moshe Kol, Amit Klein, Yossi Gilad
We describe a tracking technique for Linux devices, exploiting a new TCP source port generation mechanism recently introduced to the Linux kernel. This mechanism is based on an alg…
Subverting Stateful Firewalls with Protocol States (Extended Version)
Amit Klein
We analyzed the generation of protocol header fields in the implementations of multiple TCP/IP network stacks and found new ways to leak information about global protocol states. W…
Cross Layer Attacks and How to Use Them (for DNS Cache Poisoning, Device Tracking and More)
Amit Klein
We analyze the prandom pseudo random number generator (PRNG) in use in the Linux kernel (which is the kernel of the Linux operating system, as well as of Android) and demonstrate t…
From IP ID to Device ID and KASLR Bypass (Extended Version)
Amit Klein, Benny Pinkas
IP headers include a 16-bit ID field. Our work examines the generation of this field in Windows (versions 8 and higher), Linux and Android, and shows that the IP ID field enables r…