a taxonomy of attacks using bgp blackholing
play

A Taxonomy of Attacks Using BGP Blackholing Loc Miller and Cristel - PowerPoint PPT Presentation

Aug 11, 2023 •253 likes •1.19k views

A Taxonomy of Attacks Using BGP Blackholing Loc Miller and Cristel Pelsser September 23, 2019 University of Strasbourg AS 20 AS 10 AS 30 P: 192.0.2.0/24 BGP Blackholing Blackholing is a DDoS mitigation technique signaled via BGP 1 . 1

  1. A Taxonomy of Attacks Using BGP Blackholing Loïc Miller and Cristel Pelsser September 23, 2019 University of Strasbourg

  2. AS 20 AS 10 AS 30 P: 192.0.2.0/24 BGP Blackholing Blackholing is a DDoS mitigation technique signaled via BGP 1 . 1 Rekhter, Li, and Hares, A Border Gateway Protocol 4 (BGP-4) . 1/17

  3. BGP Blackholing Blackholing is a DDoS mitigation technique signaled via BGP 1 . Internet is composed of Autonomous Systems (AS): one or more networks under the control of a single entity. AS 20 AS 10 AS 30 P: 192.0.2.0/24 Figure 1: BGP Blackholing 1 Rekhter, Li, and Hares, A Border Gateway Protocol 4 (BGP-4) . 1/17

  4. BGP Blackholing Blackholing is a DDoS mitigation technique signaled via BGP 1 . Internet is composed of Autonomous Systems (AS): one or more networks under the control of a single entity. AS 20 AS 10 AS 30 P: 192.0.2.0/24 Figure 1: BGP Blackholing 1 Rekhter, Li, and Hares, A Border Gateway Protocol 4 (BGP-4) . 1/17

  5. BGP Blackholing Blackholing is a DDoS mitigation technique signaled via BGP 1 . Internet is composed of Autonomous Systems (AS): one or more networks under the control of a single entity. BLACKHOLE AS 20 AS 10 AS 30 P: 192.0.2.0/24 Figure 1: BGP Blackholing 1 Rekhter, Li, and Hares, A Border Gateway Protocol 4 (BGP-4) . 1/17

  6. BGP Blackholing Blackholing is a DDoS mitigation technique signaled via BGP 1 . Internet is composed of Autonomous Systems (AS): one or more networks under the control of a single entity. BLACKHOLE AS 20 AS 10 AS 30 P: 192.0.2.0/24 Figure 1: BGP Blackholing Blackholing has a double-edged sword effect: all traffic is dropped. 1 Rekhter, Li, and Hares, A Border Gateway Protocol 4 (BGP-4) . 1/17

  7. Objectives 1/17

  8. Objectives Can blackholing be used with malicious intent? 1/17

  9. Objectives Can blackholing be used with malicious intent? Are there different types of attacks? 1/17

  10. Objectives Can blackholing be used with malicious intent? Are there different types of attacks? Are there any existing and relevant security mechanisms? 1/17

  11. Objectives Can blackholing be used with malicious intent? Are there different types of attacks? Are there any existing and relevant security mechanisms? Are these mechanisms enough? 1/17

  12. Quick BGP Primer AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 Figure 2: BGP message propagation 2/17

  13. Quick BGP Primer AS 1 AS 2 AS 3 AS 4 10.1/16 AS5 AS 5 AS 6 10.1.0.0/16 Figure 2: BGP message propagation 2/17

  14. Quick BGP Primer AS 1 AS 2 10.1/16 10.1/16 AS3 AS5 AS3 AS5 AS 3 AS 4 10.1/16 AS3 AS5 AS 5 AS 6 10.1.0.0/16 Figure 2: BGP message propagation 2/17

  15. Quick BGP Primer 10.1/16 AS1 AS3 AS5 AS 1 AS 2 AS 3 AS 4 10.1/16 AS4 AS3 AS5 AS 5 AS 6 10.1.0.0/16 Figure 2: BGP message propagation 2/17

  16. Quick BGP Primer AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 Figure 2: BGP message propagation 2/17

  17. BGP Hijacks As BGP is a distributed protocol, lacking authentication of route origins and verification of paths, ASes can advertise illegitimate routes for prefixes they do not own, attracting some or all of the traffic to these prefixes. 2/17

  18. BGP Hijacks AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 Figure 3: BGP hijack 3/17

  19. BGP Hijacks AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 3: BGP hijack 3/17

  20. BGP Hijacks AS 1 AS 2 AS 3 AS 4 10.1/16 AS6 10.1/16 AS6 AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 3: BGP hijack 3/17

  21. BGP Hijacks AS 1 AS 2 10.1/16 10.1/16 AS4 AS6 AS4 AS6 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 3: BGP hijack 3/17

  22. BGP Hijacks 10.1/16 AS2 AS4 AS6 AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 3: BGP hijack 3/17

  23. BGP Hijacks AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 3: BGP hijack (Type-0 2 ) 3/17 2 Sermpezis et al., “ARTEMIS: Neutralizing BGP hijacking within a minute”.

  24. BGP Hijacks - 5304 routing attacks in 2017 alone 2 . AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 3: BGP hijack (Type-0) 3/17 2 Robachevsky, 14,000 Incidents: A 2017 Routing Security Year in Review .

  25. BGP Blackjacks - Type-0 AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 Figure 4: Type-0 blackjack 4/17

  26. BGP Blackjacks - Type-0 AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 4: Type-0 blackjack 4/17

  27. BGP Blackjacks - Type-0 AS 1 AS 2 AS 3 AS 4 10.1/16 AS6 10.1/16 AS4:666 AS6 AS 5 AS 6 AS3:666 10.1.0.0/16 10.1.0.0/16 Figure 4: Type-0 blackjack 4/17

  28. BGP Blackjacks - Type-0 AS 1 AS 2 AS 3 AS 4 AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 4: Type-0 blackjack 4/17

  29. Best practices for legitimate blackholing empower blackjacks Best Practices for blackholing 3 Give a higher priority to blackholing. Do not propagate the advertisement across AS borders. 3 Cisco, Remotely Triggered Black Hole Filtering - Destination Based and Source Based . 5/17

  30. Best practices for legitimate blackholing empower blackjacks Best Practices for blackholing 3 Give a higher priority to blackholing. Do not propagate the advertisement across AS borders. Advantages of blackjacks Reach : Precedence over AS path length. Even ASes far away are vulnerable. No propagation: More disruption. Stealth : The attacker is not dropping traffic himself. 3 Cisco, Remotely Triggered Black Hole Filtering - Destination Based and Source Based . 5/17

  31. RPKI - Resource Public Key Infrastructure 4 The RPKI is a distributed, hierarchic public key infrastructure. It allows prefix holders to emit digitally signed objects attesting that a given AS is authorized to originate routes for a set of prefixes. 4 Lepinski and Kent, An Infrastructure to Support Secure Internet Routing . 6/17

  32. RPKI - Resource Public Key Infrastructure AS 1 AS 2 AS 3 AS 4 RPKI pub. point AS 5 AS 6 10.1.0.0/16 Figure 5: RPKI usage 7/17

  33. RPKI - Resource Public Key Infrastructure AS 1 AS 2 10.1/16 AS5 AS 3 AS 4 RPKI pub. point AS 5 AS 6 10.1.0.0/16 Figure 5: RPKI usage 7/17

  34. RPKI - Resource Public Key Infrastructure AS 1 AS 2 AS 3 AS 4 RPKI pub. point AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 5: RPKI usage 7/17

  35. RPKI - Resource Public Key Infrastructure AS 1 AS 2 AS 3 AS 4 RPKI pub. 10.1/16 point AS6 10.1/16 AS4:666 AS6 AS 5 AS 6 AS3:666 10.1.0.0/16 10.1.0.0/16 Figure 5: RPKI usage 7/17

  36. RPKI - Resource Public Key Infrastructure AS 1 AS 2 AS 3 AS 4 RPKI pub. point AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 5: RPKI usage 7/17

  37. BGP Blackjacks - Type-N AS 1 AS 2 AS 3 AS 4 RPKI pub. point AS 5 AS 6 10.1.0.0/16 Figure 6: Type-N blackjack 8/17

  38. BGP Blackjacks - Type-N AS 1 AS 2 AS 3 AS 4 RPKI pub. point AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 6: Type-N blackjack 8/17

  39. BGP Blackjacks - Type-N AS 1 AS 2 AS 3 AS 4 RPKI pub. 10.1/16 point AS6 AS5 10.1/16 AS4:666 AS6 AS5 AS 5 AS 6 AS3:666 10.1.0.0/16 10.1.0.0/16 Figure 6: Type-N blackjack 8/17

  40. BGP Blackjacks - Type-N AS 1 AS 2 AS 3 AS 4 RPKI pub. 10.1/16 point AS6 AS5 10.1/16 AS4:666 AS6 AS5 AS 5 AS 6 AS3:666 10.1.0.0/16 10.1.0.0/16 Figure 6: Type-N blackjack 8/17

  41. BGP Blackjacks - Type-N AS 1 AS 2 AS 3 AS 4 RPKI pub. point AS 5 AS 6 10.1.0.0/16 10.1.0.0/16 Figure 6: Type-N blackjack 8/17

  42. BGPsec 5 BGPsec modifies BGP to allow ASes to sign advertisements. This guarantees the AS path reflects the actual path the advertisement went through. 5 Lepinski and Sriram, BGPsec Protocol Specification . 9/17

  43. BGPsec AS 1 AS 2 1 2 AS 3 AS 4 3 4 AS 5 AS 6 5 6 10.1.0.0/16 Figure 7: BGPsec message propagation 10/17

  44. BGPsec AS 1 AS 2 1 2 AS 3 AS 4 3 4 5 10.1/16 - AS3 AS5 AS 5 AS 6 5 6 10.1.0.0/16 Figure 7: BGPsec message propagation 10/17

  45. BGPsec AS 1 AS 2 1 2 5 10.1/16 - AS3 AS5 5 10.1/16 - AS3 AS5 3 10.1/16 - AS4 AS3 AS5 3 10.1/16 - AS1 AS3 AS5 AS 3 AS 4 3 4 5 10.1/16 - AS3 AS5 3 10.1/16 - AS6 AS3 AS5 AS 5 AS 6 5 6 10.1.0.0/16 Figure 7: BGPsec message propagation 10/17

  46. BGPsec 5 10.1/16 - AS3 AS5 3 10.1/16 - AS1 AS3 AS5 1 10.1/16 - AS2 AS1 AS3 AS5 AS 1 AS 2 1 2 AS 3 AS 4 3 4 5 10.1/16 - AS3 AS5 3 10.1/16 - AS4 AS3 AS5 4 10.1/16 - AS6 AS4 AS3 AS5 AS 5 AS 6 5 6 10.1.0.0/16 Figure 7: BGPsec message propagation 10/17

  47. BGPsec AS 1 AS 2 1 2 AS 3 AS 4 3 4 AS 5 AS 6 5 6 10.1.0.0/16 Figure 7: BGPsec message propagation 10/17

  48. BGP Blackjacks - Type-N AS 1 AS 2 1 2 AS 3 AS 4 3 4 RPKI pub. point AS 5 AS 6 5 6 10.1.0.0/16 Figure 8: Type-N blackjack 11/17

  49. BGP Blackjacks - Type-N AS 1 AS 2 1 2 AS 3 AS 4 3 4 RPKI pub. point AS 5 AS 6 5 6 10.1.0.0/16 Figure 8: Type-N blackjack 11/17

  50. BGP Blackjacks - Type-N AS 1 AS 2 1 2 AS 3 AS 4 3 4 RPKI pub. 10.1/16 point AS6 AS5 10.1/16 AS4:666 AS6 AS5 AS 5 AS 6 AS3:666 5 6 10.1.0.0/16 Figure 8: Type-N blackjack 11/17

  51. BGP Blackjacks - Type-N AS 1 AS 2 1 2 AS 3 AS 4 3 4 RPKI pub. point AS 5 AS 6 5 6 10.1.0.0/16 Figure 8: Type-N blackjack 11/17

  52. BGP Blackjacks - On Path AS 1 AS 2 1 2 AS 3 AS 4 3 4 AS 5 AS 6 5 6 10.1.0.0/16 Figure 9: On Path blackjack 12/17

Recommend

A First Joint Look at DoS Attacks and BGP Blackholing in the Wild Mattijs Jonker Aiko Pras

A First Joint Look at DoS Attacks and BGP Blackholing in the Wild Mattijs Jonker Aiko Pras

A First Joint Look at DoS Attacks and BGP Blackholing in the Wild Mattijs Jonker Aiko Pras (UTwente) Alberto Dainotti (CAIDA / UC San Diego) Anna Sperotto (UTwente) Denial-of-Service attacks A conceptually simple, yet effective class of

750 views • 33 slides
Next Gen Blackholing to Counter DDoS NANOG75, San Francisco Christoph Dietzel *, Matthias

Next Gen Blackholing to Counter DDoS NANOG75, San Francisco Christoph Dietzel *, Matthias

Next Gen Blackholing to Counter DDoS NANOG75, San Francisco Christoph Dietzel *, Matthias Wichtlhuber*, Georgios Smaragdakis , Anja Feldmann TU Berlin, *DE-CIX, MPI Volumetric DDoS Attacks ? Tbps 1.7 Tbps 1 Tbps 200 Gbps 15

571 views • 22 slides
A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms Jelena Mirkovic, Janice Martin & Peter

A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms Jelena Mirkovic, Janice Martin & Peter

A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms Jelena Mirkovic, Janice Martin & Peter Reiher Manu Shantharam & David Hadka What is DoS? DoS A type of attack wherein access to computer resource / service is denied or

380 views • 18 slides
Outline A taxonomy of CR security threats Primary user emulation attacks Cognitive Radio

Outline A taxonomy of CR security threats Primary user emulation attacks Cognitive Radio

10/25/19 Outline A taxonomy of CR security threats Primary user emulation attacks Cognitive Radio Network Security Byzantine failures in distributed spectrum sensing Security vulnerabilities in IEEE 802.22 Yao Zheng 1 2

383 views • 7 slides
BLOOMS TAXONOMY At the end of this workshop you will be able to: Explain what a Taxonomy

BLOOMS TAXONOMY At the end of this workshop you will be able to: Explain what a Taxonomy

Presented by: Gerry Maloney Ciarn Muirgheasa Lorna Wilson BLOOMS TAXONOMY At the end of this workshop you will be able to: Explain what a Taxonomy is. Define Blooms Taxonomy. Recognise and Understand the 6 different

1.83k views • 42 slides
AmI Taxonomy AmI Taxonomy Network Characteristics of the technologies allowing devices to

AmI Taxonomy AmI Taxonomy Network Characteristics of the technologies allowing devices to

AmI Taxonomy file:///D:/Mirror/elite/Didattica/Laurea/01PRD Ambient Intelligence/sl... AmI Taxonomy AmI Taxonomy Network Characteristics of the technologies allowing devices to communicate an collaborate in the exchange of information.

205 views • 9 slides
NCTracks Taxonomy Presentation Agenda Taxonomy Code Information Using Taxonomy Codes in

NCTracks Taxonomy Presentation Agenda Taxonomy Code Information Using Taxonomy Codes in

NCTracks Taxonomy Presentation Agenda Taxonomy Code Information Using Taxonomy Codes in Filing Claims Checklist for Providers NCTracks Resources Questions 2 Taxonomy Code Information The taxonomy codes for NCTracks

545 views • 15 slides
Introduction to Network Security Chapter 4 Taxonomy of Network-Based Vulnerabilities Dr. Doug

Introduction to Network Security Chapter 4 Taxonomy of Network-Based Vulnerabilities Dr. Doug

Introduction to Network Security Chapter 4 Taxonomy of Network-Based Vulnerabilities Dr. Doug Jacobson - Introduction to 1 Network Security - 2009 Topics Network Security Model Header attacks Protocol Attacks

597 views • 25 slides
Taxonomy Jrg Cassens Data and Process Visualization SoSe 2017 SoSe 2017 Jrg Cassens

Taxonomy Jrg Cassens Data and Process Visualization SoSe 2017 SoSe 2017 Jrg Cassens

Taxonomy References Taxonomy Jrg Cassens Data and Process Visualization SoSe 2017 SoSe 2017 Jrg Cassens Taxonomy 1 / 92 Outline Taxonomy Comparing Categories Assessing Hierarchies Temporal Change Connections and Taxonomy 1

958 views • 93 slides
Inferring BGP Blackholing in the Internet Vasileios Giotsas, Georgios Smaragdakis, Christoph

Inferring BGP Blackholing in the Internet Vasileios Giotsas, Georgios Smaragdakis, Christoph

Inferring BGP Blackholing in the Internet Vasileios Giotsas, Georgios Smaragdakis, Christoph Dietzel, Philipp Richter, Anja Feldmann, and Arthur Berger TU Berlin CAIDA MIT DE-CIX Akamai DDoS A&acks are a Serious Threat 2 AS1

956 views • 54 slides
Down the Black Hole: Dismantling Operational Practices of BGP Blackholing at IXPs Marcin

Down the Black Hole: Dismantling Operational Practices of BGP Blackholing at IXPs Marcin

Down the Black Hole: Dismantling Operational Practices of BGP Blackholing at IXPs Marcin Nawrocki, Jeremias Blendin, Christoph Dietzel, Thomas C. Schmidt, Matthias Whlisch Christmas is near!

1.15k views • 80 slides
Blackholing the Internet: A Live Demo Adam Rapley me@adamrapley.com @admrply

Blackholing the Internet: A Live Demo Adam Rapley me@adamrapley.com @admrply

Blackholing the Internet: A Live Demo Adam Rapley me@adamrapley.com @admrply keybase.io/admrply Who am I? 3nd year Ethical Hacking student at Abertay. Does web things. Artist/Musician. Building and Breaking IoT. What is BGP

334 views • 29 slides
TAXONOMY AND CHALLENGES IN MACHINE LEARNING-BASED APPROACHES TO DETECT ATTACKS IN THE INTERNET

TAXONOMY AND CHALLENGES IN MACHINE LEARNING-BASED APPROACHES TO DETECT ATTACKS IN THE INTERNET

The 15th International Conference on Availability, Reliability and Security (ARES 2020) August 25 to August 28, 2020 in Dublin, Ireland ID-86 workshop paper (IoT-SECFOR) TAXONOMY AND CHALLENGES IN MACHINE LEARNING-BASED APPROACHES TO DETECT

583 views • 13 slides
How are living Taxonomy things classified? the classification of living things Taxonomy

How are living Taxonomy things classified? the classification of living things Taxonomy

How are living Taxonomy things classified? the classification of living things Taxonomy Biodiversity taxonomy = branch of biology which names biodiversity = the variety of organisms and classifies living things could be: of Earth (all

491 views • 10 slides
SOLO Taxonomy Moving towards understanding What is SOLO Taxonomy? The Structured Overview of

SOLO Taxonomy Moving towards understanding What is SOLO Taxonomy? The Structured Overview of

SOLO Taxonomy Moving towards understanding What is SOLO Taxonomy? The Structured Overview of Learning Outcomes Describes levels of increasing complexity in a childs understanding of a subject, through five stages What is SOLO

739 views • 14 slides
The Greatness of God Examining Gods CV Do you know the word taxonomy? Do you know the

The Greatness of God Examining Gods CV Do you know the word taxonomy? Do you know the

The Greatness of God Examining Gods CV Do you know the word taxonomy? Do you know the word taxonomy? It is NOT the study of taxis! Do you know the word taxonomy? It is the science of classifying things! Do you know the

1.44k views • 108 slides
Flynns Taxonomy Prof. Mike Flynns famous taxonomy of parallel computers 1 Flynns

Flynns Taxonomy Prof. Mike Flynns famous taxonomy of parallel computers 1 Flynns

Flynns Taxonomy Prof. Mike Flynns famous taxonomy of parallel computers 1 Flynns Taxonomy Proposed by Prof. Mike Flynn in 1966 how many instructions vs how much data can be processed simultaneously Single Instruction Single Data

468 views • 17 slides
Towards a Taxonomy of Approaches Towards a Taxonomy of Approaches for for Mining of Source Code

Towards a Taxonomy of Approaches Towards a Taxonomy of Approaches for for Mining of Source Code

Towards a Taxonomy of Approaches Towards a Taxonomy of Approaches for for Mining of Source Code Repositories Mining of Source Code Repositories Huzefa H. Kagdi, Michael L. Collard, Jonathan I. Maletic Software Development Laboratory

430 views • 5 slides
EU Taxonomy Technical Expert Group on Sustainable Finance The taxonomy is a tool, an extremely

EU Taxonomy Technical Expert Group on Sustainable Finance The taxonomy is a tool, an extremely

EU Taxonomy Technical Expert Group on Sustainable Finance The taxonomy is a tool, an extremely useful TOOL A dictionary - style tool A measuring tool A transition tool Provides clarity on what is an environmentally Measures the degree

775 views • 11 slides
Taxonomy for App Makers: Movie Monsters & Medical Insurance UX London 30 May 2014 Presented

Taxonomy for App Makers: Movie Monsters & Medical Insurance UX London 30 May 2014 Presented

Taxonomy for App Makers: Movie Monsters & Medical Insurance UX London 30 May 2014 Presented by Andy Fitzgerald, PhD Taxonomy for App Makers Andy Fitzgerald http://bradfrostweb.com/blog/post/device-fatigue/ Overview Part I: Taxonomy

1.6k views • 148 slides
Introduction to Plant Taxonomy Introduction to Plant Taxonomy (See P. 1169) (See P. 1169)

Introduction to Plant Taxonomy Introduction to Plant Taxonomy (See P. 1169) (See P. 1169)

Introduction to Plant Taxonomy Introduction to Plant Taxonomy (See P. 1169) (See P. 1169) Plant Taxonomy. (= Systematic Botany Plant Taxonomy. (= Systematic Botany or plant systematics): or plant systematics): Science of identifying,

608 views • 23 slides
Blooms Taxonomy: A Framework for Learning An introduc<on

Blooms Taxonomy: A Framework for Learning An introduc<on

Blooms Taxonomy: A Framework for Learning An introduc<on to Blooms Taxonomy of Learning Ramkhamhaeng University New Media Repor7ng (MCS 3271

227 views • 19 slides
How can users get the gist of a taxonomy using tag

How can users get the gist of a taxonomy using tag

How can users get the gist of a taxonomy using tag clouds? Nathalie PINDE Department of Informa-on and Communica-on University of Bordeaux

660 views • 34 slides
NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3

NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3

CMPS122: COMPUTER SECURITY NETWORKING ATTACKS NETWORKING ATTACKS NOTICES Lab #2 extended to Feb. 17 @ 23:59 HW #3 due tonight NETWORKING ATTACKS LAST TIME TCP/IP networking stack Physical layer Data link layer Network

1.1k views • 61 slides

More recommend