Analytics //

Security Monitoring

8/1/2014
01:00 PM
100%
0%

Some Security Tools Fail With Multipath TCP

Researchers at Black Hat USA will reveal how multipath TCP breaks assumptions about how TCP works -- and the implications for network security.

The need for hardy networking connections has led to the development of Multipath TCP (MPTCP), which allows a Transmission Control Protocol (TCP) connection to use multiple paths to maximize resource usage and increase redundancy. But the explosion in mobile and Internet of Things devices also requires network security tools keep pace with change.

Neohapsis researchers Catherine Pearce and Patrick Thomas say very few security and network management tools are up to that challenge when it comes to MPTCP streams. At a presentation at the upcoming Black Hat USA conference in Las Vegas, the two plan to discuss how MPTCP eviscerates assumptions about TCP that are made by both tools and network engineers alike.

TCP is a foundational protocol for communication on the Internet that has largely stood the test of time, says Thomas. "It's used everywhere; it's used by everything," he says. "It's been around since the dawn of the Internet."

Yet TCP is not set up for the future of the Internet people are seeing now -- a highly-connected world featuring different types of connectivity, says Thomas.

This had led to the development of MPTCP, which allows TCP to talk over multiple paths simultaneously, decoupling it from a specific IP address. Doing this, however, creates a new reality for security. For starters, it affects the ability of intrusion detection systems to inspect, correlate, and reassemble traffic. This can add a new wrinkle to fragmentation attacks, Thomas says.

"An intrusion detection system that is not multipath TCP-aware, sees five different connections coming from different IP addresses, has no conception that they are related, and on each of them it sees complete garbage data," he says.

"If any of your security decisions, tools, thought-processes, manual processes, if they rely on any of... these four things, then something in those is going to break," he says. "Those four things that we've got are: If you expect to see all app layer data within a TCP stream; if you expect to differentiate clients from servers based on the connection direction; if you expect to tamper with or close bad connections midstream; or if attempt to associate logical connections to IP addresses. If you make any security decisions based on any of those, then those security mechanisms are going to break in the face of MPTCP."

During their presentation, which is scheduled for Wednesday at 3:30 p.m., the researchers will show tools and strategies for understanding and mitigating the risk of MPTCP-capable devices on a network.

Multipath TCP changes the way the Internet works at its core, explains Pearce.

"If we're not ready for this the impact of this could be probably at least as great as IPv6," she says, adding that the goal of the talk at Black Hat is to raise awareness.

"We want security to keep up with technology," she says.

 

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
anon5663234767
50%
50%
anon5663234767,
User Rank: Apprentice
4/14/2015 | 2:50:07 AM
MPTCP Security

ttp://www.it.uc3m.es/fvalera/t2/D2.4.pdf

Fairly recent paper from EU Trilogy2 project branch with tips and tools for dealing with security around MPTCP

 
 
EricD388
50%
50%
EricD388,
User Rank: Apprentice
8/1/2014 | 4:06:56 PM
Wireless Aggregation of Internet Bandwidth
This technology has been in the works for quite some time.  Delangis has three U.S. patents on this technology dating back to 2002.  Check out 7606156 and 8228801 for starters.
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Be a unicorn, not a donkey...
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.