Entry Gilad:2014:PTI from tissec.bib

Last update: Sun Oct 15 02:58:48 MDT 2017                Valid HTML 3.2!

Index sections

Top | Symbols | Numbers | Math | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

BibTeX entry

@Article{Gilad:2014:PTI,
  author =       "Yossi Gilad and Amir Herzberg",
  title =        "Off-Path {TCP} Injection Attacks",
  journal =      j-TISSEC,
  volume =       "16",
  number =       "4",
  pages =        "13:1--13:??",
  month =        apr,
  year =         "2014",
  CODEN =        "ATISBQ",
  DOI =          "https://doi.org/10.1145/2597173",
  ISSN =         "1094-9224 (print), 1557-7406 (electronic)",
  ISSN-L =       "1094-9224",
  bibdate =      "Mon May 5 18:00:10 MDT 2014",
  bibsource =    "http://portal.acm.org/;
                 http://www.math.utah.edu/pub/tex/bib/tissec.bib",
  abstract =     "We present practical off-path TCP injection attacks
                 for connections between current, nonbuggy browsers and
                 Web servers. The attacks allow Web-cache poisoning with
                 malicious objects such as spoofed Web pages and
                 scripts; these objects can be cached for a long period
                 of time, exposing any user of that cache to cross-site
                 scripting, cross-site request forgery, and phishing
                 attacks. In contrast to previous TCP injection attacks,
                 we do not require MitM capabilities or malware running
                 on the client machine. Instead, our attacks rely on a
                 weaker assumption, that the user only enters a
                 malicious Web site, but does not download or install
                 any application. Our attacks exploit subtle details of
                 the TCP and HTTP specifications, and features of
                 legitimate (and very common) browser implementations.
                 An empirical evaluation of our techniques with current
                 versions of browsers shows that connections with most
                 popular Web sites are vulnerable. We conclude this work
                 with practical client- and server-end defenses against
                 our attacks.",
  acknowledgement = ack-nhfb,
  articleno =    "13",
  fjournal =     "ACM Transactions on Information and System Security",
  journal-URL =  "http://portal.acm.org/browse_dl.cfm?idx=J789",
}

Related entries