TY - GEN
T1 - From IP ID to device ID and KASLR bypass
AU - Klein, Amit
AU - Pinkas, Benny
N1 - Publisher Copyright: © 2019 by The USENIX Association. All rights reserved.
PY - 2019
Y1 - 2019
N2 - IP headers include a 16-bit ID field. Our work examines the generation of this field in Windows (versions 8 and higher), Linux and Android, and shows that the IP ID field enables remote servers to assign a unique ID to each device and thus be able to identify subsequent transmissions sent from that device. This identification works across all browsers and over network changes. In modern Linux and Android versions, this field leaks a kernel address, thus we also break KASLR. Our work includes reverse-engineering of the Windows IP ID generation code, and a cryptanalysis of this code and of the Linux kernel IP ID generation code. It provides practical techniques to partially extract the key used by each of these algorithms, overcoming different implementation issues, and observing that this key can identify individual devices. We deployed a demo (for Windows) showing that key extraction and machine fingerprinting works in the wild, and tested it from networks around the world.
AB - IP headers include a 16-bit ID field. Our work examines the generation of this field in Windows (versions 8 and higher), Linux and Android, and shows that the IP ID field enables remote servers to assign a unique ID to each device and thus be able to identify subsequent transmissions sent from that device. This identification works across all browsers and over network changes. In modern Linux and Android versions, this field leaks a kernel address, thus we also break KASLR. Our work includes reverse-engineering of the Windows IP ID generation code, and a cryptanalysis of this code and of the Linux kernel IP ID generation code. It provides practical techniques to partially extract the key used by each of these algorithms, overcoming different implementation issues, and observing that this key can identify individual devices. We deployed a demo (for Windows) showing that key extraction and machine fingerprinting works in the wild, and tested it from networks around the world.
UR - http://www.scopus.com/inward/record.url?scp=85076381075&partnerID=8YFLogxK
M3 - منشور من مؤتمر
T3 - Proceedings of the 28th USENIX Security Symposium
SP - 1063
EP - 1080
BT - Proceedings of the 28th USENIX Security Symposium
T2 - 28th USENIX Security Symposium
Y2 - 14 August 2019 through 16 August 2019
ER -