论文标题
跨层攻击以及如何使用它们（用于DNS缓存中毒，设备跟踪等）
Cross Layer Attacks and How to Use Them (for DNS Cache Poisoning, Device Tracking and More)
论文作者
论文摘要
我们分析了在Linux内核（Linux操作系统的内核以及Android）中使用的Prandom伪随机数生成器（PRNG），并证明了此PRNG很弱。 Linux内核中的许多“消费者”正在使用prandom prng。我们专注于网络级别的三个消费者 - UDP源端口生成算法，IPv6流标签生成算法和IPv4 ID生成算法。所有这些消费者共享了有缺陷的prandom prng，这使我们能够对Linux内核进行“跨层攻击”。在这些攻击中，我们会从一个OSI层中推断出Prandom PRNG的内部状态，并使用它来预测另一个OSI层使用的PRNG值，或将其与从其他协议中推断的PRNG的内部状态相关联。 使用这种方法，我们可以对Linux进行非常有效的DNS缓存中毒攻击。我们收集TCP/IPv6流标签值或UDP源端口，或TCP/IPV4 IP ID值，重建内部PRNG状态，然后预测出站DNS查询UDP源端口，该端口将攻击加快X3000至X6000的速度。此攻击远程可行，但也可以在本地，跨Linux用户和跨容器安装，并且（取决于存根的解析器）可以用任意的DNS记录中毒缓存。此外，我们可以识别和跟踪Linux和Android设备 - 我们收集TCP/IPv6流标签值和/或UDP源端口值和/或TCP/IPv4 ID字段，重建PRNG内部状态，并将此新状态与先前提取的PRNG状态相关联，以识别同一设备。
We analyze the prandom pseudo random number generator (PRNG) in use in the Linux kernel (which is the kernel of the Linux operating system, as well as of Android) and demonstrate that this PRNG is weak. The prandom PRNG is in use by many "consumers" in the Linux kernel. We focused on three consumers at the network level -- the UDP source port generation algorithm, the IPv6 flow label generation algorithm and the IPv4 ID generation algorithm. The flawed prandom PRNG is shared by all these consumers, which enables us to mount "cross layer attacks" against the Linux kernel. In these attacks, we infer the internal state of the prandom PRNG from one OSI layer, and use it to either predict the values of the PRNG employed by the other OSI layer, or to correlate it to an internal state of the PRNG inferred from the other protocol. Using this approach we can mount a very efficient DNS cache poisoning attack against Linux. We collect TCP/IPv6 flow label values, or UDP source ports, or TCP/IPv4 IP ID values, reconstruct the internal PRNG state, then predict an outbound DNS query UDP source port, which speeds up the attack by a factor of x3000 to x6000. This attack works remotely, but can also be mounted locally, across Linux users and across containers, and (depending on the stub resolver) can poison the cache with an arbitrary DNS record. Additionally, we can identify and track Linux and Android devices -- we collect TCP/IPv6 flow label values and/or UDP source port values and/or TCP/IPv4 ID fields, reconstruct the PRNG internal state and correlate this new state to previously extracted PRNG states to identify the same device.
