DPIFuzz: A Differential Fuzzing Frameworkto Detect DPI Elusion Strategies for QUIC

Reen, Gaganjeet Singh and Rossow, Christian
(2020) DPIFuzz: A Differential Fuzzing Frameworkto Detect DPI Elusion Strategies for QUIC.
In: Annual Computer Security Applications Conference (ACSAC 2020).
Conference: ACSAC Annual Computer Security Applications Conference

[img] Text
DPIFuzz.pdf

Download (1MB)

Abstract

QUIC is an emerging transport protocol that has the potential to replace TCP in the near future. As such, QUIC will become an important target for Deep Packet Inspection (DPI). Reliable DPI is essential, e.g., for corporate environments, to monitor traffic entering and leaving their networks. However, elusion strategies threaten the validity of DPI systems, as they allow attackers to carefully design traffic to fool and thus evade on-path DPI systems. While such elusion strategies for TCP are well documented, it is unclear if attackers will be able to elude QUIC-based DPI systems. In this paper, we systematically explore elusion methodologies for QUIC. To this end, we present DPIFuzz: a differential fuzzing framework which can automatically detect strategies to elude stateful DPI systems for QUIC. We use DPIFuzz to generate and mutate QUIC streams in order to compare (and find differences in) the server-side interpretations of five popular open-source QUIC implementations. We show that DPIFuzz successfully reveals DPI elusion strategies, such as using packets with duplicate packet numbers or exploiting the diverging handling of overlapping stream offsets by QUIC implementations. DPIFuzz additionally finds four security-critical vulnerabilities in these QUIC implementations.

Actions

Actions (login required)

View Item View Item