Feeds

Defend your phone against loose networks? There’s an app for that

Researchers unveil ‘middlebox detection’ software

Beginner's guide to SSL certificates

A group of researchers from the University of Michigan has released an Android app designed to defend against a common firewall vulnerability which they say commonly exposes smartphones on cellular networks.

The vulnerability, “off-path TCP sequence number inference”, can allow hijacking of Web pages users are trying to visit. The researchers say that some types of stateful firewalls, designed to drop packets without valid TCP sequence numbers, can be attacked by an insider that’s able to guess TCP sequence numbers of other users, and use this as the basis of a redirection.

The firewalls are common on cellular networks, the researchers say, with as many as 31.5 percent of the networks they tested using the stateful firewalls.

The researchers, Z. Morley Mao (a professor at Michigan) and doctoral student Zhiyun Qian, say that smartphones’ sandbox models can make them vulnerable to having a malware-infected machine inside the firewall read the incoming packet counters from an Android device, and let the attacker know when the sequence numbers advance. A successful attack also depends on having suitable malware on the Android phone, o as to get sequence numbers out of its sandbox.

"An attacker can try to guess at sequence numbers. It's usually hard to get feedback on whether a guessed number is correct, but the firewall middlebox makes this possible," Qian said. "The attacker can try a range of sequence numbers. The firewall will only allow one through if it is in the valid range."

A successful redirection allows the attacker to gain IDs and passwords of users on the same network. The researchers have also published a paper (PDF) describing other attack types. For example, the attacker could use TCP sequence number inference to create a spoofed IP address to perform denial-of-service on another server.

Their app, offered on Google Play, checks the firewall type on a network and alerts the user if it is vulnerable to the attack.

Mao and Qian are presenting their work at the IEEE Symposium on Security and Privacy in San Francisco. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.