Off-Path TCP Exploits: Global Rate Limit Considered Dangerous
summary
Claims a practical off‑path side channel (CVE-2016-5696) in Linux kernels 3.6+ that leverages a global challenge-ACK rate limit to tell if two hosts share a TCP connection, then recover 32-bit sequence and ACK numbers and perform RST or data‑injection attacks. Implementation uses guess-and-check probes plus binary/multi-beam search; measured median attack time is 40–60 seconds with success rates roughly 88–97% (EC2 termination ~96%, Tor ~89%, hijack ~90%). Kernel patched July 2016 by adding noise and plans to remove the global limit.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:53Our TCP Attack
- 1:26Outline
- 1:48Threat Model
- 2:35Background
- 5:36Data Receiving Scheme
- 6:56Why Does This Vulnerability Exist?
- 8:22Side Channel Vulnerability
- 10:57Guess-Then-Check Method
- 13:04Optimizations
- 13:29Binary-style Search
- 14:07Attack Overview
- 14:54Time Synchronization
- 15:47Inference Of Possible TCP Connection
- 16:36TCP Connection Termination Attack
- 19:16Evaluation: Time Cost
- 20:35Case Study: Termination Attack
- 21:10Evaluation: Hijacking Attack
- 24:30Defense & Conclusion
related talks
21mOff-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets
16mR-TCP: A Framework to Optimize TCP Performance Over Rate-Limiting Networks
31mA Practical, Research‑Backed Introduction To Cloud‑Native Kernel‑Bypass Networking
50mOverTime: Remote Timing Attacks Against IoT Devices
44mSmashing The State Machine: The True Potential Of Web Race Conditions
17mOpening Up Kernel-Bypass TCP Stacks
30mLessons From Defending The Indefensible
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS