Advanced Computer Networks cs538, Fall 2014 @ UIUC

Network security Where was security in the design of the original Internet protocols?
Virtually nowhere!
All the core protocols (IP, TCP, DNS, BGP) have trivial, glaring vulnerabilities
When security really matters, rely on end-to-end mechanisms
Public key cryptography & certificate authorities
With e2e security, what can an attack on BGP still do?<br>

Attacks on Internet routing Denial of service
announce “more attractive” path (what does that mean?)
e.g., more-specific prefix; shorter path; “cheaper” path
Eavesdropping
like DoS, a kind of traffic attraction
but somehow get data to destination or impersonate it
Evasion of accountability
steal someone’s prefix or an unused one; send spam; disappear!
What are some of the BGP attacks?<br>

BGP Refresh IP Prefixes and AS numbers
Announcement messages to advertise new route is available
Withdrawal messages to advertise that route does not exist anymore
Path-vector routing<br>

IP Prefixes and AS Numbers - Attacks Announcement of prefix 12.34.0.0/16 originating from valid AS6 (a) regular announcement,
(b) malicious advertisement from AS1<br>

BGP Security Attacks Attacks on IP Prefixes and AS Numbers
Prefix hijacking
Black Hole
Impersonate attack
Interception attack
Attacks on TCP as BGP Transport
Attacks on confidentiality (eavesdrop)
Attacks on integrity (man in the middle, modify and replay attacks) Deaggregation Attack : Because AS1 advertises longer prefix for
address block 12.34.128.0/17, it will be preferred over longer advertised block
12.34.0.0./16 even if it is invalid (example: Pakistan Telecom attack on YouTube)<br>

BGP Security Today Byzantine Problems – need Byzantine Robustness
Existing Security Solutions
Cryptographic techniques for BGP Security
Pairwise keys , cryptographic hash functions, message authentication codes, public key infrastructure, certificates and attestations,
Protecting BGP Sessions Between Pairs of Routers
MD5 Integrity, Session and Message Protection, IPSec, Generalized TTL Security Mechanism
Others Generalized TTL Security Mechanism<br>

Best Current Practices within Network Infrastructure<br>

Three approaches to BGP security 1. Defensive filtering
2. Secure BGP (S-BGP)
Many others not discussed here
Active area of research over the last decade
Many tradeoffs, especially in deployment issues<br>

1. Defensive filtering Most commonly used class of techniques
Typical implementation
Filter routes received from customers/peers
Requires assumptions about what they should be advertising
Imperfect, requires human maintenance Arbor Networks survey 2012:
76% filter from customers
55% filter from peers
57% monitor for hijacks Arbors Networks survey 2013<br>

1. Defensive filtering Tier 1’s Mid-tier Stub / Leaf<br>

1. Defensive filtering Pretty Good BGP [Karlin, Forrest, Rexford, ICNP’06]
Deprioritize “novel” routes for a period (e.g. 24 hours)
Routers prefer older (known) routes
May still pick new route if it’s the only option
Why does this help?
Advantages
Raises the bar for attacker: route must persist
Gives time for response
No protocol changes for deployment
Disadvantages?<br>

1. Defensive filtering Pretty Good BGP [Karlin, Forrest, Rexford, ICNP’06]
Take-away points
Prioritization is important: not just good vs. bad route
Think about human-level solutions
# suspicious advertisements is only about 50/day
vs. O(400k/day) total Average number of Announcements (per day)
Classified as suspicious using suspicious period
Of 1 day and variety of history periods<br>

2. S-BGP Scheme
Origin Authentication + hop-by-hop cryptographic validation
Deployment challenges
Requires PKI
Requires significant computational resources [Diagram from Butler, Farley, McDaniel, Rexford,
Proc. IEEE, 2010] Route Attestation in S-BGP. As UPDATE messages are passed between
Peers, the receiving peer signs the received message before passing it
To another neighbor. Result is “Onion-style attestation that contains
Signatures from all routers along the path.<br>

Not just malicious attackers Many or most high-profile outages likely just configuration errors
Natural correspondence between attackers and bugs
behavior unknown ahead of time
defense is to limit and contain worst-case effects
What about a bug in the protocol?
worst-case scenario: zero-day exploit on large fraction of routers across the entire Internet
many are running the same software!<br>

Case Study of BGP Problems Thai telecom Communications Authority of Thailand
(AS4651) – CAT Telecom – was completely offline for
over three hours on Saturday during the
Government’s crackdown on the protestors.
In series of three outages, CAT stopped providing
Internet transit to 204 routes at 8:30 UTC, 207 routes
At 8:48 UTC and finally lost service to 906 routes
At 8:52 UTC.

In total, the outages left Thailand with 32% of its
Internet path down until restoration occurred at
12:11 UTC. http://research.dyn.com/2013/12/protests-lead-outage-thailand/<br>

Discussion Many flaws in routing. Which are critical?
Incentives to adopt secure routing?
Partial deployment crucial. Issues?
Given all this, why does the Internet work so well?<br>