BlackHat资料us-14-Pearce-Multipath-TCP-Breaking-Todays-Networks-With-Tomorrows-Protocols-WP.pdfVIP

Securing the Mobile Ecoomy – M U L T I P A T H T C P , P W N I N G T O D A Y ’ S N E T W O R K S W I T H T O M O R R O W ’ S P R O T O C O L S . Catherine Pearce – Catherine.pearce@, twitter: @secvalve A B S T R A C T : MultiPath TCP (MPTCP) is an extension to TCP that enables sessions to use multiple network endpoints and multiple network paths at the same time, and to change addresses in the middle of a connection. MPTCP works transparently over most existing network infrastructure, yet very few security and network management tools can correctly interpret MPTCP streams. With MPTCP network security is changed: how do you secure traffic when you cant see it all and when the endpoint addresses change in the middle of a connection ? This paper briefly discusses how MPTCP breaks assumptions about how TCP works, and how this can be used to evade security controls. We will also discuss tools and strategies for understanding and mitigating the risk of MPTCP-capable devices on a network. INTRODUCTION Ubiquitous in modern networking, with much of the worlds infrastructure depending upon it, but its single path nature is a significant shortcoming in many modern uses. Where there is a need to combine the bandwidth of multiple network connections, or to roam across different network locations while maintaining a connection, TCP falls short. This has motivated both research and proposed solutions. While many proposed solutions have been revolutionary (comprising complete replacements, notably Stream Control Transmission Control Protocol (SCTP)), recent proposals have been more evolutionary extensions of TCP itself. Multipath TCP (MPTCP) is one such expansion. It adds the ability to split TCP flows over multiple network endpoints, and to change network endpoints seamlessly without dropping the connection. It is well on its way to becoming a wid