Researchers from Boston University attack method
(CVE-2019-11728), to conduct scanning of IP addresses and open network ports in a user's internal network, shielded from the external network by a firewall, or on the current system (localhost). An attack can be carried out by opening a specially crafted page in the browser. The proposed technique is based on the use of the HTTP header (HTTP Alternate Services, ). The issue manifests in Firefox, Chrome, and browsers based on their engines, including Tor Browser and Brave.
The Alt-Svc header allows the server to define an alternative way to access the site and instructs the browser to redirect the request to a new host, for example, for load balancing. It is also possible to specify a network port for tunneling; for example, specifying 'Alt-Svc: http/1.1="other.example.com:443"; ma=200' instructs the client to connect to host other.example.org to retrieve the requested page using network port 443 and the HTTP/1.1 protocol. The 'ma' parameter sets the maximum time for the redirect to be valid. Besides HTTP/1.1, the supported protocols include HTTP/2-over-TLS (h2), HTTP/2-over plain text (h2c), SPDY (spdy), and QUIC (quic), which uses UDP.
To scan addresses, the attacker's site can sequentially test addresses and network ports of interest in the internal network, using the delay between successive requests as an indicator.
If the redirected resource is unavailable, the browser instantly receives a RST packet in response and marks the alternative service as unavailable while clearing the time-to-live set in the request.
If the network port is open, it takes longer to complete the connection (a connection attempt will be made with the corresponding packet exchange), and the browser will not respond instantly.
To obtain information about the check, the attacker can immediately redirect the user to a second page that refers, in the Alt-Svc header, to an active host of the attacker. If the client's browser sends a request to this page, it can be concluded that the first Alt-Svc request redirection has been canceled and the checked host and port are unavailable. If there is no request, then the data from the first redirection has not yet expired, and the connection was established.
The specified method also allows checking network ports that are blacklisted by the browser, such as mail server ports. The attack is set up using an iframe substitution in the victim's traffic and employing the HTTP/2 protocol in Alt-Svc for Firefox and QUIC for scanning UDP ports in Chrome. The attack cannot be applied in the context of the internal network and localhost in Tor Browser, but it is suitable for organizing covert scanning of external hosts through the Tor exit node. The issue of port scanning already exists in Firefox 68.
The Alt-Svc header can also be applied:
- In organizing DDoS attacks. For instance, for TLS, redirection can provide a level of amplification up to 60 times as the initial client request takes 500 bytes, while the response with the certificate is about 30 KB. By generating such requests in a loop across multiple client systems, one can exhaust the server's available network resources;
- To bypass phishing and malware protection mechanisms provided by services like Safe Browsing (redirecting to a malicious host does not trigger any warnings);
- To organize user movement tracking. The essence of the method lies in substituting an iframe that refers in Alt-Svc to an external movement tracking handler, which is called regardless of the activation of protection tools against trackers. It is also possible to track at the provider level by using a unique identifier (random IP:port as an identifier) in Alt-Svc for subsequent analysis in transit traffic;
- To extract information about movement history. By embedding an iframe on their page that requests images from a specified site using Alt-Svc and analyzing the Alt-Svc status in the traffic, an attacker with the ability to analyze transit traffic can conclude that the user has previously visited the specified site;
- Log noise for intrusion detection systems. Through Alt-Svc, it is possible to generate a wave of requests to malicious systems on behalf of the user, creating the appearance of false attacks to obscure the actual attack information in the overall data.
Source: opennet.ru
