Defend your phone against loose networks? There’s an app for that
A group of researchers from the University of Michigan has released an Android app designed to defend against a common firewall vulnerability which they say commonly exposes smartphones on cellular networks.
The vulnerability, “off-path TCP sequence number inference”, can allow hijacking of Web pages users are trying to visit. The researchers say that some types of stateful firewalls, designed to drop packets without valid TCP sequence numbers, can be attacked by an insider that’s able to guess TCP sequence numbers of other users, and use this as the basis of a redirection.
The firewalls are common on cellular networks, the researchers say, with as many as 31.5 percent of the networks they tested using the stateful firewalls.
The researchers, Z. Morley Mao (a professor at Michigan) and doctoral student Zhiyun Qian, say that smartphones’ sandbox models can make them vulnerable to having a malware-infected machine inside the firewall read the incoming packet counters from an Android device, and let the attacker know when the sequence numbers advance. A successful attack also depends on having suitable malware on the Android phone, o as to get sequence numbers out of its sandbox.
“An attacker can try to guess at sequence numbers. It’s usually hard to get feedback on whether a guessed number is correct, but the firewall middlebox makes this possible,” Qian said. “The attacker can try a range of sequence numbers. The firewall will only allow one through if it is in the valid range.”
A successful redirection allows the attacker to gain IDs and passwords of users on the same network. The researchers have also published a paper (PDF) describing other attack types. For example, the attacker could use TCP sequence number inference to create a spoofed IP address to perform denial-of-service on another server.
Their app, offered on Google Play, checks the firewall type on a network and alerts the user if it is vulnerable to the attack.
Mao and Qian are presenting their work at the IEEE Symposium on Security and Privacy in San Francisco. ®