Project

General

Profile

Bug #3324

TCP evasion technique by overlapping a TCP segment with a fake packet

Added by Nicolas Adba 8 months ago. Updated 7 months ago.

Status:
Closed
Priority:
High
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

It's possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet.

The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets).
The client will ignore the fake FIN packet because the ACK flag is not set.
Both linux and windows client are ignoring the injected packet.

Client    ===============  Legit TCP handshake  =================     Evil Server 
Client    <-  [FIN] [Seq=80 Ack=100] XXXXXXX                      <-  Evil Server     # injected packet with fake data (ignored by the client)
Client    <-  [PUSH, ACK] [Seq=80 Ack=100] MALWARE                <-  Evil Server     # Legit data (ignored by suricata)

This evasion technique is referenced as CVE-2019-18792.

You can find attached :
- test.rule : A tcp rule that detects the string THIS_IS_A_TEST
- without_evasion.pcap : A web server which sends the string THIS_IS_A_TEST to a client without any evasion technique
- with_evasion_windows.pcap : A web server which sends the string THIS_IS_A_TEST to a windows 10 client with this evasion technique
- with_evasion_linux.pcap : A web server which sends the string THIS_IS_A_TEST to a linux client (tested with kernel 5.2.0) with this evasion technique


Files

without_evasion.pcap (1.01 KB) without_evasion.pcap Nicolas Adba, 11/06/2019 10:10 PM
with_evasion_linux.pcap (1.16 KB) with_evasion_linux.pcap Nicolas Adba, 11/06/2019 10:10 PM
with_evasion_windows.pcap (1.13 KB) with_evasion_windows.pcap Nicolas Adba, 11/06/2019 10:10 PM
test.rule (147 Bytes) test.rule Nicolas Adba, 11/06/2019 10:11 PM

Related issues

Copied to Bug #3394: TCP evasion technique by overlapping a TCP segment with a fake packet (4.1.x)ClosedVictor JulienActions
#1

Updated by Andreas Herz 8 months ago

  • Assignee set to OISF Dev
  • Target version set to Soon
#2

Updated by Victor Julien 8 months ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Victor Julien
#3

Updated by Victor Julien 8 months ago

  • Target version changed from Soon to 5.0.1
#4

Updated by Victor Julien 8 months ago

  • Priority changed from Normal to High
  • Label Needs backport added
#5

Updated by Victor Julien 7 months ago

  • Copied to Bug #3394: TCP evasion technique by overlapping a TCP segment with a fake packet (4.1.x) added
#6

Updated by Victor Julien 7 months ago

  • Status changed from Assigned to Closed
  • Private changed from Yes to No
  • Label deleted (Needs backport)

Also available in: Atom PDF