TCP Injection Attacks in the Wild - a Large Scale Study
summary
Massive survey examines 1.5 Peta-bits from 1.5 million IPs and finds 14 injection groups: eight ad-injection clusters, four delivering malware (malicious APKs and compromised JS), and two blocking cases; many injections originate inside the target site’s AS and implicate China Unicom/China Telecom. Detection uses edge monitoring for racing packets with identical TCP sequence numbers but different payloads. Commercial injections prove transient and hard to reproduce; a client tool implements out-of-band TCP injection detection and a TTL/IPID-based mitigation that delays only suspicious packets (practical, lower latency than a 200 ms blanket delay).
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:04Research overview
- 3:02Understanding TCP injection
- 7:53Injection methodology
- 10:42Survey findings
- 14:10Advertisement injections
- 18:08Malicious injections
- 23:36Censorship injections
- 25:01Reproducing attacks
- 27:20Identifying the injectors
- 32:37Proposed mitigation
- 36:21Conclusion and Q&A
related talks
23mWebsite-Targeted False Content Injection by Network Operators
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
30mThe Hunt for Major League IoT-ICS Threats: A Deep Dive into IoT Threat Terrain
25mOver 20 Years of SQL Injection Attacks in the Wild - Time to Refine and ...
40mResearch on New Vectors of UDP-Based DDoS Amplification Attacks of IoT
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
30mOff-Path TCP Exploits: Global Rate Limit Considered Dangerous