Understanding BGP Security Issues and Solutions in Computer Networks

Advanced Computer Networks cs538, Fall 2014 @ UIUC Klara Nahrstedt Lecture 11, October 2, 2014 Based on A Survey of BGP Security Issues and Solutions, Butler et al, Proceedings of the IEEE, 2010 Prior 2010-2013, lecture material by Brighten Godfrey and Matt Caesar Worldwide Infrastructure Security Report, Arbor Networks Inc Special Report, Volume IX, October 2012 to October 2013

Announcements Midterm Take-Home Exam Exam will be posted Monday, October 6, 8am on Piazza Deadline for Midterm submission will be Wednesday, October 8, 8am. Exam must be individual effort (no group work) !!! Exam must be written and submitted electronically (pdf) to klara@Illinois.edu Exam will include questions from mandatory papers from August 28 to October 2. Mandatory paper is the first paper in each lecture.

Outline BGP Attacks BGP Security Solutions

Network security Where was security in the design of the original Internet protocols? Virtually nowhere! All the core protocols (IP, TCP, DNS, BGP) have trivial, glaring vulnerabilities When security really matters, rely on end-to-end mechanisms Public key cryptography & certificate authorities With e2e security, what can an attack on BGP still do?

Attacks on Internet routing Denial of service announce more attractive path (what does that mean?) e.g., more-specific prefix; shorter path; cheaper path Eavesdropping like DoS, a kind of traffic attraction but somehow get data to destination or impersonate it Evasion of accountability steal someone s prefix or an unused one; send spam; disappear! What are some of the BGP attacks?

BGP Refresh IP Prefixes and AS numbers Announcement messages to advertise new route is available Withdrawal messages to advertise that route does not exist anymore Path-vector routing

IP Prefixes and AS Numbers - Attacks Announcement of prefix 12.34.0.0/16 originating from valid AS6 (a) regular announcement, (b) malicious advertisement from AS1

BGP Security Attacks Attacks on IP Prefixes and AS Numbers Prefix hijacking Black Hole Impersonate attack Interception attack Attacks on TCP as BGP Transport Attacks on confidentiality (eavesdrop) Attacks on integrity (man in the middle, modify and replay attacks) Deaggregation Attack : Because AS1 advertises longer prefix for address block 12.34.128.0/17, it will be preferred over longer advertised block 12.34.0.0./16 even if it is invalid (example: Pakistan Telecom attack on YouTube)

BGP Security Today Byzantine Problems need Byzantine Robustness Existing Security Solutions Cryptographic techniques for BGP Security Pairwise keys , cryptographic hash functions, message authentication codes, public key infrastructure, certificates and attestations, Protecting BGP Sessions Between Pairs of Routers MD5 Integrity, Session and Message Protection, IPSec, Generalized TTL Security Mechanism Others Generalized TTL Security Mechanism

Best Current Practices within Network Infrastructure

Three approaches to BGP security 1. Defensive filtering 2. Secure BGP (S-BGP) Many others not discussed here Active area of research over the last decade Many tradeoffs, especially in deployment issues

1. Defensive filtering Most commonly used class of techniques Typical implementation Filter routes received from customers/peers Requires assumptions about what they should be advertising Imperfect, requires human maintenance Arbor Networks survey 2012: 76% filter from customers 55% filter from peers 57% monitor for hijacks Arbors Networks survey 2013

1. Defensive filtering filtering difficult Tier 1 s Mid-tier Stub / Leaf filtering feasible

1. Defensive filtering Pretty Good BGP [Karlin, Forrest, Rexford, ICNP 06] Deprioritize novel routes for a period (e.g. 24 hours) Routers prefer older (known) routes May still pick new route if it s the only option Why does this help? Advantages Raises the bar for attacker: route must persist Gives time for response No protocol changes for deployment Disadvantages?

1. Defensive filtering Pretty Good BGP [Karlin, Forrest, Rexford, ICNP 06] Take-away points Prioritization is important: not just good vs. bad route Think about human-level solutions # suspicious advertisements is only about 50/day vs. O(400k/day) total Average number of Announcements (per day) Classified as suspicious using suspicious period Of 1 day and variety of history periods

2. S-BGP Scheme Origin Authentication + hop-by-hop cryptographic validation Deployment challenges Requires PKI Requires significant computational resources Route Attestation in S-BGP. As UPDATE messages are passed between Peers, the receiving peer signs the received message before passing it To another neighbor. Result is Onion-style attestation that contains Signatures from all routers along the path. [Diagram from Butler, Farley, McDaniel, Rexford, Proc. IEEE, 2010]

Not just malicious attackers Many or most high-profile outages likely just configuration errors Natural correspondence between attackers and bugs behavior unknown ahead of time defense is to limit and contain worst-case effects What about a bug in the protocol? worst-case scenario: zero-day exploit on large fraction of routers across the entire Internet many are running the same software!

Case Study of BGP Problems Thai telecom Communications Authority of Thailand (AS4651) CAT Telecom was completely offline for over three hours on Saturday during the Government s crackdown on the protestors. In series of three outages, CAT stopped providing Internet transit to 204 routes at 8:30 UTC, 207 routes At 8:48 UTC and finally lost service to 906 routes At 8:52 UTC. In total, the outages left Thailand with 32% of its Internet path down until restoration occurred at 12:11 UTC. http://research.dyn.com/2013/12/protests-lead-outage- thailand/

Discussion Many flaws in routing. Which are critical? Incentives to adopt secure routing? Partial deployment crucial. Issues? Given all this, why does the Internet work so well?