Network (In)security: Leniency in Protocols' Design, Code and Configuration

Protocols are one of the founding pillars of network communication. Given their importance, protocols have received great attention not only from the research community but also from adversaries. Protocols, particularly their implementations, have been lucrative targets for adversarial attacks to induce network insecurity by compromising the guarantees that these implementations should provide. Most of these attacks can be traced back to the leniency in their design, code, or configuration. Finding leniency in implementations is challenging as these lenient instances are primarily tied to the semantics of the protocol and thus demand for techniques unlike existing approaches that we use for finding low-level memory corruption bugs.

In this talk, I will discuss our experience and lesson learned in detecting leniency in different layers of the TCP/IP network protocol stack. First, I will show how leniency in the design of loss-based TCP congestion control schemes can be exploited by an attacker to manipulate the victim into taking actions favorable for the attacker. I will introduce our model-guided fuzzing approach to find such manipulation attacks in different TCP implementations part of mainstream operating systems (e.g., Linux, Windows). Next, I will focus on leniency in code, where an implementation exhibits noncompliance with its design. Specifically, I will talk about how lenient implementations of X.509 certificate validation in SSL/TLS libraries can be exploited by an attacker to mount impersonation attacks. Finally, I will highlight that it is not always the protocol's design or code, sometimes it is humans: the users and/or the IT (Information Technology) administrators. Specifically, I will present our multifaceted measurement study where we examined the WPA2-Enterprise Wi-Fi configurations prescribed in tertiary education institutes (TEIs) around the world. I will share our findings about the widespread insecure practices that can leave users of these institutes open to credential theft[2].