System and method to spoof a TCP reset for an out-of-band security device
Systems and methods are provided to reset a TCP connection such as in response to a security policy violation. To address reset conditions under RFC 5961, for example, TCP RST segments may be spoofed and injected into communications between endpoints (e.g. client and server). In one example, three segments may be spoofed with two having respective predicted sequence numbers to invoke a reset and the third having a sequence number to invoke a challenge ACK. If a challenge ACK is received, one or more additional TCP RST segments may be injected using segment information from the challenge ACK to predict new sequence numbers, one to invoke a reset and the other, if used, to invoke a further challenge ACK. Further responsive pairs of additional TCP RST segments may be sent in response to any further challenge ACK observed until the reset is successful.
1. A computing device comprising a processor and a storage device coupled thereto, the storage device storing instructions to inject spoofed Transmission Control Protocol (TCP) RST (reset) segments into communication traffic between sender and receiver endpoints of a TCP connection, which instructions when executed by the processor configure the computing device to:
define spoofed TCP RST segments (RST-SEG_1, RST-SEG_2) to inject into the traffic to communicate to the receiver endpoint, each having a predicted sequence number (SEQ) determined using observed segments of traffic between the endpoints, such that:
RST-SEG_1.SEQ=SEG.SEQ; and
RST-SEG_2.SEQ=SEG.SEQ+SEG.LEN;
where SEG represents that last segment observed from the sending endpoint and SEG.LEN is a segment length of SEG; and
inject segments RST-SEG_1, RST-SEG_2, for communication to the receiver endpoint.
2. The computing device of claim 1 configured to:
define a spoofed TCP RST segment RST-SEG_3 to inject into traffic with segments RST-SEG_1, RST-SEG_2, where RST-SEG_3.SEQ=SEG.SEQ+(RCV.WND/2) and RCV.WND is a receive window of the receiver endpoint; and
inject segment RST-SEG_3 for communication to the receiver endpoint.
3. The computing device of claim 1 configured to, upon receipt from the receiver endpoint of a challenge ACK segment (CH-SEG) while waiting for a RST segment from the receiver endpoint:
define an additional TCP RST segment RST-SEG_4 using a TCP state of the receiver endpoint from TCP segment values received in the CH_SEG response, such that RST-SEG_4.SEQ=CH-SEG.ACK; and
inject the segment RST-SEG_4 for communication to the receiver endpoint.
4. The computing device of claim 3 configured to:
define a spoofed TCP RST segment RST-SEG_5 to inject into traffic with segment RST-SEG_4 using a TCP state of the receiver endpoint from TCP segment values received in the CH_SEG response, such that RST-SEG_5.SEQ=CH-SEQ.ACK+(RCV.WND/2); and
inject segment RST-SEG_5 for communication to the receiver endpoint.
5. The computing device of claim 4 configured to, upon receipt of a new CH-SEG while waiting for a RST from the receiver endpoint after communication segment RST-SEG_5, define a new pair of TCP RST segments in the same form as RST-SEG_4 and RST-SEG_5 using the new CH-SEG.ACK value in the new CH-SEG response and inject the new pair of TCP RST segments.
6. The computing device of claim 1 configured to monitor traffic from the receiver endpoint for a RST under a timer and repeat operations to define and inject spoofed TCP RST segments (RST-SEG_1, RST-SEG_2) using a current state of communications if the timer expires before the RST is received.
7. The computing device of claim 1 configured to:
observe the communication traffic between the sender and receiver endpoints; and
determine and store current segment variables, and send sequence variables and receive sequence variables in accordance with TCP with which to define the spoofed TCP RST segments.
8. The computing device of claim 1 configured to determine a security violation from the traffic and wherein the spoofed TCP RST segments are defined and injected in response to the security violation.
9. The computing device of claim 1 wherein the receiver endpoint is configured to implement a requirement of RFC 5961 comprising sending a challenge ACK segment in reply to a TCP RST segment when the sequence number in the TCP RST segment is not an exact match to an expected sequence number of the receiver endpoint.
10. The computing device of claim 1 comprising at least one processor, a storage device storing instructions in a non-transient manner to configure the execution of the processor and at least one communication unit for communicating the spoofed TCP RST segments.
11. The computing device of claim 10 comprising an out of band network security device configured to observe traffic, detect a security violation and take action in response to the security violation, the action comprising resetting a TCP connection.
12. A computer implemented method to inject spoofed Transmission Control Protocol (TCP) RST (reset) segments into communication traffic between sender and receiver endpoints of a TCP connection, the method comprising:
defining spoofed TCP RST segments (RST-SEG_1, RST-SEG_2) to inject into the traffic to communicate to the receiver endpoint, each having a predicted sequence number (SEQ) determined using observed segments of traffic between the endpoints, such that:
RST-SEG_1.SEQ=SEG.SEQ; and
RST-SEG_2.SEQ=SEG.SEQ+SEG. LEN;
where SEG represents that last segment observed from the sending endpoint and SEG.LEN is a segment length of SEG; and
injecting segments RST-SEG_1, RST-SEG_2 for communication to the receiver endpoint.
13. The method of claim 12 comprising:
defining a spoofed TCP RST segment RST-SEG_3 to inject into traffic with segments RST-SEG_1, RST-SEG_2, where RST-SEG_3.SEQ=SEG.SEQ+(RCV.WND/2) and RCV.WND is a receive window of the receiver endpoint; and
injecting segment RST-SEG_3 for communication to the receiver endpoint.
14. The method of claim 12 comprising, upon receipt from the receiver endpoint of a challenge ACK segment (CH-SEG) while waiting for a RST segment from the receiver endpoint:
defining an additional TCP RST segment RST-SEG_4using a TCP state of the receiver endpoint from TCP segment values received in the CH_SEG response, such that RST-SEG_4.SEQ=CH-SEG.ACK; and
injecting the segment RST-SEG_4 for communication to the receiver endpoint.
15. The method of claim 14 comprising:
defining a spoofed TCP RST segment RST-SEG_5 to inject into traffic with segment RST-SEG_4 using a TCP state of the receiver endpoint from TCP segment values received in the CH_SEG response, such that RST-SEG_5.SEQ=CH-SEQ.ACK+(RCV.WND/2); and
injecting segment RST-SEG_5 for communication to the receiver endpoint.
16. The method of claim 15 comprising, upon receipt of a new CH-SEG while waiting for a RST from the receiver endpoint after communication segment RST-SEG_5, defining a new pair of TCP RST segments in the same form as RST-SEG_4 and RST-SEG_5 using the new CH-SEG.ACK value in the new CH-SEG response and injecting the new pair of TCP RST segments.
17. The method of claim 12 comprising monitoring traffic from the receiver endpoint for a RST under a timer and repeating steps to define and inject spoofed TCP RST segments (RST-SEG_1, RST-SEG_2) using a current state of communications if the timer expires before the RST is received.
18. The method of claim 12 comprising:
observing the communication traffic between the sender and receiver endpoints; and
determining and storing current segment variables, send sequence variables and receive sequence variables in accordance with TCP with which to define the spoofed TCP RST segments.
19. The method of claim 12 comprising determining a security violation from the traffic and wherein the spoofed TCP RST segments are defined and injected in response to the security violation.
20. The method of claim 12 wherein the receiver endpoint is configured to implement a requirement of RFC 5961 comprising sending a challenge ACK segment in reply to a TCP RST segment when the sequence number in the TCP RST segment is not an exact match to an expected sequence number of the receiver endpoint.
21. The method of claim 12 implemented by an out of band network security device configured to observe traffic, detect a security violation and take action in response to the security violation, the action comprising resetting a TCP connection.
22. A non-transitory computer-readable medium storing instructions to configure the execution of a processor of a computing device to inject spoofed Transmission Control Protocol (TCP) RST (reset) segments into communication traffic between sender and receiver endpoints of a TCP connection by:
defining spoofed TCP RST segments (RST-SEG_1, RST-SEG_2) to inject into the traffic to communicate to the receiver endpoint, each having a predicted sequence number (SEQ) determined using observed segments of traffic between the endpoints, such that:
RST-SEG_1.SEQ=SEG.SEQ; and
RST-SEG_2.SEQ=SEG.SEQ+SEG. LEN;
where SEG represents that last segment observed from the sending endpoint and SEG.LEN is a segment length of SEG; and
injecting segments RST-SEG_1, RST-SEG_2 for communication to the receiver endpoint.