Security Considerations in a Multihomed Operating Systems

AUTHOR(S):

TITLE

Security Considerations in a Multihomed Operating Systems

ABSTRACT

This short article presents an interesting behaviour of popular operating systems when multiple network interfaces are being used at the same time. Even if the IP layer forwarding (routing) is disabled some operating systems still deliver spoofed packets to the application not checking if they came from the proper physical interface. This paper verifies and compares the behaviour of three most popular operating systems, i.e. Microsoft Windows, Linux and Apple OS X. The behaviour was verified experimentally. The results show that all tested systems behave differently and there is no agreed way of processing IP traffic. This is an important problem which is not sufficiently documented nor described and may lead to security flaws when improperly interpreted by system administrators.

KEYWORDS

multihomed systems, firewall, packet spoofing, protocol stack, network security

REFERENCES

[1] Deering Stephen E. Internet Protocol, Version 6 (IPv6) Specification. https://tools. ietf.org/html/rfc2460, 1998.

[2] Marcelo Bagnulo and Erik Nordmark. Shim6: Level 3 Multihoming Shim Protocol for IPv6. https://tools.ietf.org/html/ rfc5533, 2009.

[3] Mike McCune. Integrating Linux and Windows. Prentice Hall Professional, January 2001. Google-Books-ID: 0SM3PEH9gagC.

[4] Sebastien Barre, Olivier Bonaventure, and others. Implementing SHIM6 using the Linux XFRM framework. In Routing In Next Generation Workshop, Madrid, Spain, 2007.

[5] Aditya Akella, Bruce Maggs, Srinivasan Seshan, and Anees Shaikh. On the performance benefits of multihoming route control. IEEE/ACM Transactions on Networking, 16(1):91–104, 2008.

[6] Rami Rosen. Linux Kernel Networking: Implementation and Theory. Apress, February 2014. Google-Books-ID: RpsQAwAAQBAJ.

[7] Zhiyun Qian and Z. Morley Mao. Off-path TCP sequence number inference attack-how firewall middleboxes reduce security. In 2012 IEEE Symposium on Security and Privacy, pages 347–361. IEEE, 2012.

[8] Zhiyun Qian, Z. Morley Mao, and Yinglian Xie. Collaborative TCP sequence number inference attack: How to crack sequence number under a second. In Proceedings of the 2012 ACM Conference on Computer and Communications Security, pages 593–604. ACM, 2012.

Cite this paper

Blazej Adamczyk. (2016) Security Considerations in a Multihomed Operating Systems. International Journal of Computers, 1, 267-270