Re: [Spud] Detecting and Defeating TCP/IP Hypercookie Attacks

[Tom Herbert <[e-mail]>]

On Fri, Jul 29, 2016 at 5:33 AM, Brian Trammell <[e-mail]> wrote:
> Greetings, all,
>
> During the PLUS BoF last week, concern was expressed that a generic signaling mechanism such as proposed opened two new attack surfaces:
>
> (1) A method for endpoints to allow path elements to add non-integrity protected signals presents a surface for metadata injection attacks, where an entity who can place devices on a user's access network and has information about the user's identity could exfiltrate that information to third parties. For purposes of giving it a name, let's call this a hypercookie injection attack ("hyper" since it exists in a space completely inaccessible to the application).
>
> (2) Even if path elements are not allowed to say anything, a mechanism to allow endpoints to add integrity-protected signals to their traffic presents a surface for coercion attacks. An access provider can force a user to tag traffic with their user ID or some other token (a signed assertion that an advertisement has been viewed to the end, or maybe even just straight-up bitcoins) in order to get "better" connectivity, or even any connectivity at all. A more classically Orwellian dystopian variant of this attack has a government requiring citizens to tag all their outgoing traffic with some government-issued identifier. Let's call this a hypercookie coercion attack.
>
> I am less concerned about the surface PLUS presents to these attacks than those who have raised the concerns in the BoF and on the mailing list, because the current Internet architecture is already quite vulnerable to them. As I said during my presentation last Thursday, Ted Hardie and I sat down to think about this at lunch a couple of months ago, and found six ways one could execute hypercookie injection or coercion today before our pizza showed up.
>
Brian,

I think there is a significant practical difference between the
vulnerability of hypercookie injection in TCP/IP and what would be
present in PLUS. In order to enforce a hypercookie injection in TCP
one would need to change the TCP stack which typically necessitates a
kernel change. In the PLUS world one would only need changes in the
particular applications of interest, this is is a much easier task for
the attacker.  Now instead of having to deal with large OS vendors
that vigorously defend privacy (e.g. Apple vs. FBI), authorities can
go after much smaller players forcing them to either comply or cease
operations. Putting control of information solely in the users hands
is not necessarily a good thing.

Tom