Upload File

on the feasibility of rerouting-based ddos defenses · nethide (meier et al.) stride (hsiao et al.)...

  • Home
  • Documents
  • On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP
25
On the Feasibility of Rerouting-based DDoS Defenses Muoi Tran , Min Suk Kang, Hsu-Chun Hsiao, Wei-Hsuan Chiang, Shu-Po Tung, Yu-Su Wang May 2019 | San Francisco, CA

Upload: others

Post on 24-Sep-2020

0 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

On the Feasibility of Rerouting-based DDoS

Defenses Muoi Tran, Min Suk Kang, Hsu-Chun Hsiao,

Wei-Hsuan Chiang, Shu-Po Tung, Yu-Su Wang May 2019 | San Francisco, CA

Page 2: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Transit-linkDDoSattack:apowerfultypeofvolumetricDDoSattack

2

Coremeltattack(ESORICS‘09)

Crossfireattack(S&P‘13)

(distributeddenialofservice)

Traditional:volumetricattacktraffictargetingendservers

Non-traditional:volumetricattacktraffictargetingtransitlinks

AS

AS

AS AS

Realincidents:

Academicstudies:

2013 2015

Page 3: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Handlingtransit-linkDDoSattackischallenging

AS

AS

AS

AS

AS

Indistinguishablelow-ratetraffic

Victimsareindirectlyaffected

3

Destination Source

AS

AS

AS

Page 4: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Transit-linkDDoSattacksstillremainanopenproblem

Coremeltattack(Studeretal.)

Crossfireattack(Kangetal.)

2009

2013

2016

2014

4

2018

RoutingAroundCongestion(Smithetal.S&P’18)

“Readilydeployablesolution"

SPIFFY(Kangetal.)

CoDefdefense(Leeetal.)

LinkScope(Xueetal.)

Partialsolutions RADAR(Zhengetal.)

NetHide(Meieretal.)

STRIDE(Hsiaoetal.)

SIBRA(Basescuetal.)

NotavailableinthecurrentInternet

Page 5: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Background:HowBGProutingworks?

5

{D}

BorderGatewayProtocol(BGP)

ASD ASZ ASX ASC ASY

{Z,D} {Y,Z,D} {X,Y,Z,D}

Trafficpath

BGPpropagationTrafficforwarding

SourceDestination

Nocontrolovertrafficpathbydesign

Loop-freeAS-path

Page 6: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

RoutingAroundCongestion(RAC):ReroutingusingBGPpoisoning[Smithetal.,S&P’18]

6

ASD ASZ

ASW

ASX ASC

ASY

Goal:reroutetoavoidASW

{D,W,D}

xLoopdetected!

Criticalsource

Detourpath

BGPpoisoningmessage

Originalpath

Victimdestination

Switchtodetourpath

AScollaborationisnotneeded!

Page 7: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

7

WillRACdefensestillworkagainstadaptiveattackers?

Page 8: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Futuredirectionsfortransit-linkDDoSdefenses

Practicalchallengeofmitigatingadaptivedetour-learningattack

Ourcontributions

8

Adaptivedetour-learningattackagainstreroutingsolutions

Page 9: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Adaptivedetour-learningattack:Threatmodel

9

Goals:(1)Todetectreroutinginreal-time(2)Tolearnnewdetourpathaccurately(3)Tocongestnewdetourpath(seethepaper)

Capabilities:-Samebotnetsusedintransit-linkDDoSattack

Page 10: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Victimdestination

Adaptivedetour-learningattack:(1)howtodetectreroutinginreal-time

10

ASD ASZ

ASW

ASX ASC

ASY Criticalsource

Detourpath

Originalpath

ASI traceroute

Reroutingisdetected!

Adaptiveadversary

Page 11: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Adaptivedetour-learningattack:(2)howtolearndetourpathaccurately

11

ASD ASY

ASG

ASC ASX

ASE ASJ

ASI

ASH

(3)congestdetourpath(seethepaper)

Challenge:Whichismoreaccurateroutemeasurementofactualdetourpath?

Victimdestination Criticalsource Solution:Prioritizemeasurementfrombotclosertotrafficsource

Detourpath closerAS(e.g.,shorterAS-path)

Results:94%oflearneddetourpathsarecorrect

Page 12: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Futuredirectionsfortransit-linkDDoSdefenses

Adaptivedetour-learningattackagainstreroutingsolutions

Ourcontributions

12

Practicalchallengeofmitigatingadaptivedetour-learningattack

Page 13: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

ASI

ASJ

Howtodefendagainstdetour-learningattack?

13

Exclusivelyusedforcriticalflows

PoisonallpeersofASesondetourpath!

ASD ASZ

ASW

ASX ASC

ASY CriticalsourceVictimdestination

Detourpathmustbeisolated!

Detourlearned!

Howtoisolate?

Page 14: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

0.8

102 103 1040

0.2

0.4

0.6

0.8

1

Detourpathisolation=>poisoningtoomanyASes

14

CDF

100100010000

NumberofASesthatshouldbepoisoned

ThousandsASesshouldbepoisoned Butwhy?

Tier-1orlargeTier-2onthedetourpaths(moreinthepaper)

0

0.2

0.4

0.6

1

Page 15: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

0.8

102 103 1040

0.2

0.4

0.6

0.8

1

CanwepoisonthatmanyASes?

15

CDF

100100010000

NumberofASesthatshouldbepoisoned255 2034

Specificationupto2034

Implementationupto255

Configurationupto30-50

0

0.2

0.4

0.6

1

Specification

Implementation

Page 16: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Confirmed:ISPsdonotsupportpoisoning>255ASes

16

Numberofobserved

BGPmessages

99.99%

1 10100100030

slowlydecreaseinfrequency

50xdropinfrequency

255

NumberofASesseeninaBGPmessage16

Poisoning>1,000ASesisnearlyimpossible

=>Detourpathisolationisinfeasible=>Detour-learningattackisalmostalwayspossible

Page 17: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Practicalchallengeofmitigatingadaptivedetour-learningattack

Adaptivedetour-learningattackagainstreroutingsolutions

Ourcontributions

17

Futuredirectionsfortransit-linkDDoSdefenses

Page 18: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Desireddefenseproperty:destination-controlledrouting

18

Clean-slateInternetarchitecture

HackingBGP

e.g.,STRIDE,SIBRAe.g.,RoutingAroundCongestion

?

e.g.,explicitBGPreroutingforcriticalflowsunderemergency ✕Toocostlytodeploy✕Doesnotwork

Page 19: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

TwoLessonsLearned

19

Page 20: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Lesson1

HackingthecurrentInternetroutingisaflawedidea!

20

Page 21: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

ü Adaptiveattacksarepossible

ü Mitigationishard

ü Adaptivedefenseisslowerthanadaptiveattacker(moreinthepaper)

21

Page 22: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Lesson2

Analysisofprotocolspecificationsaloneisinsufficient!

22

Page 23: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

23

Specification Implementation Configuration

Page 24: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Conclusion• Detour-learningattacksareeffectiveandhardtomitigate

ü Transit-linkDDoSattacksstillremainanopenproblem

• Suggestiononresearchdirectionü Balancedestination-controlledroutinganddeployability

• 2lessonslearned:ü HackingBGPforreroutingisaflawedideaü Analysiswithspecificationonlycanbedangerous

24

Page 25: On the Feasibility of Rerouting-based DDoS Defenses · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescu et al.) Not available in the current Internet Background: How BGP

Question?

[email protected]


Quaternary evolution of the Caravelas strandplain – …Dominguez et al. 1998). (Suguio et al. 1985, Martin et al. 1987, 1988, Suguio et al. 1988, Martin et al. 2002). Martin et al

ArcticDx et. al. v. Sequenom et. al

Multi-scale assessment of human-induced changes to ... · (Neill et al. 2001; Davidson et al. 2004; Neill et al. 2006; Figueiredo et al. 2010; Neill et al. 2011; Macedo et al. 2013;

Wisconsin et al v. Fitzgerald et al

The KMOS Redshift One Spectroscopic Survey (KROSS) · Kassin et al. 2007, 2012; Buitrago et al. 2008; Dunne et al. 2009; Peng et al. 2010; Geach et al. 2011; van Dokkum et al. 2011;

Perry et al v. Judd et al

Integrative analysis of multi-platform RPPA data · 2011, Hayashi et al. 2014, Bernhardt et al. 2017, Hutter et al. 2017, Lièvre et al. 2017, Aslan et al. 2018, Faham et al. 2018,

Oceana et al vs.BOEM et al

NCAA Et Al v. Christie Et Al

Aoki et. al. v. Gilbert et. al

Troya et al Dooley et al Fancourt et al Zhong et al · Troya et al Involving patients with dementia in decisions to initiate treatment Dooley et al ... Elena Garralda Simon Gilbody

6 Journal research area: Whole Plant and Ecophysiology et al., 1998; Hemamalini et al., 2000; Li et al., 2001; Xing et al., 2002; Courtois et al., 2003; Xu 123 et al., 2004; Lian et

The human genome Lander et al. 2001 Venter et al. 2001 Patil et al. 2001 Gabriel et al. 2002 Reich et al. 2001 Sabeti et al. 2002 Yu et al. 2002

et al. et al

On the Feasibility of Rerouting-based DDoS Defenseskangms/papers/tran... · NetHide (Meier et al.) STRIDE (Hsiao et al.) SIBRA (Basescuet al.) Not availablein the currentInternet

Garber et al v. MLB et al

Fluorescent biological aerosol particle concentrations … Mortazavi et al., 2008; Rosenfeld et al., 2008; Ariya et al., 2009; Bowers et al., 2009; Pratt et al., 2009; Prenni et al.,

(12) United States Patent (10) Patent No.: US 6,792,177 B2 ...Gale et al. Asakura Neukermans et al. Laor Pan et al. Laughlin Hornbeck Gove et al. Neukermans et al. Neukermans et al

Guyot et al 2013 - engit.monash.eduGuyot et al

Smartflash Et. Al. v. Google Et. Al

EXHIBIT E - cases.justia.com · 811996 Konrad 1211996 Koppolu et al. 211997 Duscher et al. 311997 Koppolu et al. 511997 Koppolu et al. 711997 Ashe et al. 511998 Koppolu et al. 911998

Turkmen, et al. v. Hasty, et al

Glynn et. al. v. Christy et. al

Actin-based propulsive forces and myosin-II-based ... · Tsujioka et al. (Tsujioka et al., 2004), Ladam et al. (Ladam et al., 2005) and del Alamo et al. (del Alamo et al., 2007)

Shire Et. Al. v. Apotex Et. Al

Unsteady Hydrodynamic Modeling of a Cycloidal PropellerBenedict et al 2014a, Benedict et al 2014b, Zachary et al 2013, Shrestha et al 2012, Shrestha et al 2014, Hrishikeshavan et al

Yamada Et Al. v. Kuramoto Et Al

Radiocarbon-based ages and growth rates of Hawaiian deep-sea … · Smith et al. 1997, Adkins et al. 1998, Smith et al. 2000, Weinbauer et al. 2000, Smith et al. 2002, Frank et al

Silver et al. v. Pueblo et al

USA, Et Al v. Kaplan, Et Al

(12) United States Patent (10) Patent No.: US … · Liamos et al. Mann et al. Heller et al. Gotoh et al. Rush et al. Mao et al. Liamos et al. Desai ..... A61B 5,14532 204,403.01

Wacom et. al. v. Applebox et. al

NetHide: Secure and Practical Network Topology Obfuscation · NetHide hides the vulnerable physical topology and shows a secure virtual topology Deriving a secure and practical topology

W. et al. Tikka Kato et al. Unterberger Park et al. Carley Matsubara et al. Lee Bradley et al. Park et al. Schmidhammer et al. Ginsburg et al. Korden et al. Mikulin et al. Bouche et

Literature Review Messent et al (1998,1999) Robertson et al (2000) Beart et al (2001) Heller et al (2002)