Amit Klein

Background

Amit Klein is an Israeli computer security researcher whose work spans web application security, network protocol implementation flaws and privacy-relevant device fingerprinting. According to his conference biography, he holds a B.Sc. from the Hebrew University of Jerusalem, awarded magna cum laude, and is a graduate of the Israel Defense Forces' Talpiot programme. He later completed a doctorate under Professor Benny Pinkas at Bar-Ilan University, and his publication record is indexed under both the Hebrew University of Jerusalem and Bar-Ilan University affiliations.

HTTP response splitting

In March 2004, while serving as Director of Security and Research at the application-security vendor Sanctum, Inc., Klein published the whitepaper "Divide and Conquer" - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics. The paper described how an application that copies unvalidated user input into an HTTP response header allows an attacker to inject carriage-return and line-feed characters, terminating the intended header block early and appending a second, attacker-controlled response. The consequences the paper enumerated included web cache poisoning, cross-user defacement, browser cache poisoning and cross-site scripting.

The term introduced in that paper became the standard name for the attack class. It is catalogued by OWASP as HTTP Response Splitting and by MITRE as CWE-113, and the whitepaper remains the reference cited in general treatments of the subject. Successive platform releases added automatic header sanitisation to prevent the injection, including PHP, Node.js and Django.

HTTP request smuggling

In 2005 Klein co-authored the whitepaper HTTP Request Smuggling with Chaim Linhart, Ronen Heled and Steve Orrin, published by Watchfire, the company that had acquired Sanctum. Where response splitting concerns the response direction, request smuggling concerns the request direction: when a front-end intermediary and a back-end server disagree about how to interpret the Content-Length and Transfer-Encoding headers, an attacker can craft a request that the two systems parse as different numbers of requests. The paper demonstrated web cache poisoning, firewall and intrusion-detection evasion, request hijacking and credential hijacking.

The technique attracted renewed attention more than a decade later as reverse proxies, load balancers and content delivery networks became ubiquitous, and the 2005 paper is generally cited as the origin of the attack class.

Industry career

Klein's industry roles were consistently in security research leadership. He spent roughly seven years at Sanctum as Director of Security and Research, followed by about two years as Chief Scientist at Cyota, an online-banking fraud prevention company later acquired by RSA Security. In 2006 he was among the founders of Trusteer, an Israeli endpoint fraud-prevention company, alongside Mickey Boodaei, Shmulik Regev, Rakesh Loonkar and Eldan Ben-Haim. He served as Trusteer's chief technology officer for about eight and a half years, spanning the company's acquisition by IBM in 2013. He subsequently became VP of Security Research at SafeBreach, where his work covered infiltration, exfiltration and lateral-movement techniques, and where he spoke at conferences including Black Hat and Hack In The Box. His Hack In The Box speaker biography notes that InfoWorld recognised him as a CTO of the year in 2010.

Academic research

Klein moved into academia and is an associate professor of computer science at the Hebrew University of Jerusalem, where his research addresses the security of network protocols at layers 3 and 4 and of their implementations, DNS security, device tracking, and vulnerabilities in network intermediaries such as proxies, caches and load balancers. With Benny Pinkas he published From IP ID to Device ID and KASLR Bypass, presented at USENIX Security 2019, which showed that the way Windows, Linux and Android generate the 16-bit IP identification field can be reverse-engineered and cryptanalysed to yield a device identifier that persists across browsers and networks, and on Linux and Android also leaks a kernel address, defeating kernel address space layout randomisation.

Later work included Cross Layer Attacks and How to Use Them (for DNS Cache Poisoning, Device Tracking and More), which analysed the Linux kernel's prandom pseudorandom number generator; Subverting Stateful Firewalls with Protocol States; and Device Tracking via Linux's New TCP Source Port Selection Algorithm, written with Moshe Kol and Yossi Gilad. His academic page records the Strage-BGU Award for Excellence in Cyber Security Research in 2023.

Legacy

Klein is chiefly remembered for naming and formalising two families of HTTP desynchronisation attacks that remain part of the standard vocabulary of web security, and for demonstrating that vulnerabilities can be found not only in application logic but in the small implementation choices, such as header parsing or identifier generation, that protocol specifications leave open. That method carried across his career from vendor whitepapers in the early 2000s to peer-reviewed papers at USENIX Security and NDSS two decades later.

Timeline

• 2004-03Publishes the whitepaper "Divide and Conquer" - HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics as Director of Security and Research at Sanctum, Inc.
• 2005Co-authors the Watchfire whitepaper HTTP Request Smuggling with Chaim Linhart, Ronen Heled and Steve Orrin, introducing the request smuggling attack class.
• 2006Co-founds Trusteer in Israel with Mickey Boodaei, Shmulik Regev, Rakesh Loonkar and Eldan Ben-Haim, serving as chief technology officer.
• 2013IBM acquires Trusteer.
• 2016Presents "In Plain Sight: The Perfect Exfiltration Location" at Hack In The Box Amsterdam as VP Security Research at SafeBreach.
• 2019Presents From IP ID to Device ID and KASLR Bypass, co-authored with Benny Pinkas, at USENIX Security.
• 2020-12Publishes Cross Layer Attacks and How to Use Them (for DNS Cache Poisoning, Device Tracking and More), analysing the Linux kernel prandom PRNG.
• 2022Publishes Device Tracking via Linux's New TCP Source Port Selection Algorithm with Moshe Kol and Yossi Gilad.
• 2023Receives the Strage-BGU Award for Excellence in Cyber Security Research.