Key SSL man-in-the-middle technology-data stream redirection

I. ARP spoofing-based data stream redirection1.1 ARP and Its workflow ARP is short for Address Resolution Protocol (Address Resolution Protocol). RFC826 describes its functions as follows: resolve the network layer protocol address of the computer to the hardware address of the data link layer. In the most popular TCP/IP network architecture, indirect cross-LAN communication relies on IP address addressing, and direct communication within the same LAN is performed through the MAC address. Therefore, ARP is generally used to resolve an IP address to a MAC address. Take host A (IP_A, MAC_A) as an example to send packets to host B (IP_ B, MAC_ B) in the same LAN. the workflow of ARP is described as follows: ① host A queries the ARP cache list of the local machine through IP_ B (which stores the IP addresses and corresponding MAC address records of the host that has recently communicated with the local machine) to check whether there are corresponding records. Yes, the resolution ends. No, go to the next step. ② Host A broadcasts arp request packets to all hosts in the LAN: "I am IP_A, my MAC address is MAC_A, and I want to know the MAC address of IP_ B ." ③ When all hosts in the LAN receive arp request packets from host A, they first check whether there is A record of host A's IP address and corresponding MAC address in their ARP cache list, if no record is recorded or the record is different from the received message, the ARP cache list of the local machine is updated. Then compare whether your IP address is IP_ B. No, the local machine is finished. Yes, the ARP response packet is sent to host A: "I am IP_ B, and my MAC address is MAC_ B. ④ After host A receives the ARP response packet from host B, it updates the local ARP cache list. Write MAC_ B as the destination MAC address into the Ethernet frame and deliver it to host B through the LAN. 1.2 ARP spoofing and data stream redirection Based on it. To reduce ARP traffic in the LAN, the ARP Protocol stipulates that even if a host receives an ARP response packet that is not requested by itself, it will also update it to the local ARP cache list. The update policy of the ARP cache list is based on the latest one. That is to say, when the ARP cache list already has related records, if the records in the newly received ARP response packet do not match those in the ARP cache list, ARP Protocol requires that the old records in the ARP cache list be updated with the latest records. These design principles of ARP make ARP spoofing possible. The principle of ARP spoofing is that an attacker sends a spoofed ARP packet to the deceived host, so that the data stream sent from the deceived host to a specific IP address is mistakenly sent to the network card specified by the attacker. If the attacker aims to block the communication between the deceived host, the network card specified by the ARP spoofing packet is generally a network card that does not exist in the LAN, and the attack target is only one deceived host; however, if the attacker is redirected to the traffic of the deceived host for sniffing, the ARP spoofing packet must specify its own Nic and both parties of the communication must be specified as the attack target. That is to say, we often say that a complete ARP spoofing is "Deceiving. If host M (IP_M, MAC_M) wants to change the flow of data between host A (IP_A, MAC_A) and host S (IP_S, MAC_S) in the same LAN, then host M only needs to send ARP response packets to host A at A fixed interval: "I am IP_S, and my MAC address is MAC_M. ", Send ARP response packets to host S:" I am IP_A, and my MAC address is MAC_M .". In this way, host A will send the data that should have been delivered to host S to host M, and host S will also. To ensure that the communication between host A and host S is not interrupted, A data forwarding mechanism is required on host M. In this way, host M becomes the "intermediary" between host A and host S, so that it can monitor the session content between host A and host B. Generally, both parties of SSL communication are not in the same LAN. For example, host A is located in LAN_A, host S is located outside LAN_A, And the gateway of LAN_A is R. In this case, all the traffic sent to the Internet in the LAN must be forwarded through the gateway, so as long as the "man-in-the-middle" between host A and gateway R performs ARP spoofing, data stream redirection can be completed.Ii. DNS spoofing-based data stream redirection2.1 The DNS service and domain name query process computers use IP addresses for Internet communication, but it is almost impossible for people who use computers to remember a large number of computer IP addresses. In order to facilitate memory, people develop a symbolic address scheme, domain name, on the basis of IP addresses. Domain Name is the Name of a computer or computer group on the Internet composed of a string of names separated by dots [12]. It is used to identify the electronic location of a computer during data transmission. In order to complete the conversion between the two sets of address solutions, people have designed a DNS (Domain Name System ). Take host A's request to obtain the IP address of the host whose domain name is Name_ B as an example. The domain name query process is as follows: ① host A queries the DNS Cache list of the local machine through Name_ B (which stores the domain names and corresponding IP address records of the hosts that have recently communicated with the local machine) to check whether the corresponding records exist. If yes, the query ends. If no, the next step is performed. ② Host A sends a dns query request message to the Local Domain Name Server: "This is A request identified as ID_A2B. I want to know the IP address of the domain name Name_ B. "③ After receiving the request, the Local Domain Name Server first checks whether the corresponding record exists in the local database. If yes, go to step 2. If no record exists, go to the next step. ④ The local domain name server sends a query request message to other root domain name servers through iterative query based on the customer's identity. When the root domain name server receives an iterative query request message from the Local Domain Name Server, either the IP address corresponding to Name_ B is provided or the Local Domain Name Server is notified: "Which Domain Name Server should you query next ". Then, the Local Domain Name Server performs subsequent queries until the corresponding IP address of Name_ B is obtained. The Local Domain Name Server first writes the results to the local database for the next query. ⑤ The Local Domain Name Server Returns a dns response message to host A: "This is A response to the request identified as ID_A2B. the IP address of the domain name Name_ B is IP_ B .". ⑥ After host A receives the DNS response message, it first matches the Response Message and request message, only when both the ID ID_A2B and the domain name Name_ B In the DNS response message can match the DNS query request message, host A updates the record (Name_ B, IP_ B) to the local DNS Cache list. 2.2 DNS Spoofing and data stream redirection the update policy of the DNS Cache list is different from that of the ARP cache list. If the DNS Cache list already contains relevant records, if a new DNS response message is received, the DNS protocol takes the old record as the standard and does not update the cache list. The basic principle of DNS Spoofing is that an attacker impersonates a Domain Name Server and sends a spoofed DNS response packet to the deceived host, causing the data stream originally sent to a specific domain name to be redirected to the attacker. If host M (IP_M) wants to hijack the session between host A and server S (Name_S, IP_S. Then host M needs to listen to the DNS query request sent by host A. Once host A requests the IP address corresponding to Name_S from the Domain Name Server, it immediately retrieves the query ID ID_A2S, and before the real DNS response message arrives, it sends A forged DNS response message to host A: "This is A response to the request identified as ID_A2S, And the IP address corresponding to the domain name Name_S is IP_M." Therefore, when host A wants to access server S, it will establish A connection with host M, and the data that host A originally sent to server S will be redirected to host M. Similarly, in order for host A to still Access Server S normally, host M needs to establish A connection with server S and forward the data returned by server S to host. DNS spoofing can be achieved smoothly. On the one hand, it is required to obtain accurate query identifiers so that forged DNS response messages can match the query request. On the other hand, it is required that the attacker send the forged packets exactly at the right time, the request must be sent by the deceived host before the real Domain Name Server Returns a real response. If one of these two requirements is not met, the spoofed DNS response packets will not be accepted by the host. Therefore, attackers must be able to listen to the data sent by the deceived host to obtain the query identifier and grasp the time to send forged packets. To achieve this goal, there are three methods for attackers in three different environments (the victim host A is still located in LAN LAN_A, the domain name server is located outside LAN_A, And the attacker host M exists as an example ): a) The host M is also in LAN_A, and LAN_A uses the shared media [currently relatively small] for connection. Host M directly sets the NIC to the hybrid mode and listens to all data in LAN_A. B) Host M is also in LAN_A, and LAN_A uses the exchange media connection. Host M performs ARP spoofing between the gateway of host A and LAN_A to listen on all data sent from host A to the gateway. c) Host M is outside LAN_A. Host M deploys A sniffer on the mirror port of host A's egress Gateway (or network device on the trunk line) for external communication, and monitors data of host A's external communication.Iii. Comparison between the two redirection TechnologiesFor ease of expression, we refer ARP redirection Based on ARP spoofing to ARP redirection and DNS redirection Based on DNS spoofing. As mentioned above, DNS Spoofing provides three different methods to monitor the victims in three different cases. This section mainly discusses the differences between ARP redirection and DNS redirection. Therefore, the DNS redirection mentioned in this section refers to the one that uses the network device Image Port to listen to the Communication Data of the victim. The following describes the differences between the two redirection technologies for man-in-the-middle monitoring.(1) requirements for monitoring host deployment locationsARP redirection requires that the monitored host and the monitored host are in the same LAN. DNS redirection requires that the monitoring host be connected to the mirror port of the network device that must pass through the monitoring host for external communication.(2) requirements on host monitoring PermissionsARP redirection does not require the monitoring host to have any permissions. Any host in the LAN can be monitored. When using DNS redirection, the monitoring host must have certain management permissions on the network to connect to the monitoring host on the mirror port of the network device.(3) difficulty in successful redirectionARP redirection is used. Because the update policy of the ARP cache list is based on the new record, it is easy to succeed no matter whether there is a corresponding record on the monitored host. DNS redirection is used. Because the update policy of the DNS Cache list is based on a valid old record, once the HOST file of the monitored HOST or the record in the DNS Cache list is not invalid, the operation fails.(4) Impact on network performanceWhen ARP redirection is used, the monitoring host actually becomes the proxy of the gateway and is responsible for forwarding all the communication traffic between the monitored host and the Internet host, which easily leads to performance bottlenecks; in addition, the monitoring process generates a large amount of ARP communication traffic, and the communication between other hosts in the LAN will also have a certain impact. The more hosts to be monitored, the higher the forwarding performance requirement on the monitoring host, the worse the network performance. Therefore, it is extremely unsuitable for monitoring too many hosts. When DNS redirection is used, the monitoring host only needs to forward the traffic of the monitored network application (this article specifically refers to the SSL communication traffic), which has little impact on the network performance; in addition, only one counterfeit packet is sent when a redirection is established, and no additional traffic is generated after the establishment, which has almost no impact on other hosts. Due to normal conditions, the SSL communication traffic of a host is relatively small, so increasing the number of monitored hosts within a certain range will not significantly affect network performance.(5) Concealment of monitoring BehaviorsWhen ARP redirection is used, a large number of ARP packets are sent during the monitoring process, which is easy to be detected. The network performance of the monitored host is greatly affected, users of this host are more likely to experience exceptions. Using DNS redirection, counterfeit packets are sent only once, and the probability of being detected is low. Users generally cannot feel exceptions in network performance.