DHCP Starvation Attack and its Detection Dr. Neminath Hubballi IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi Contents Dynamic Host Configuration Protocol (DHCP) attacks Exploiting client side and server side IP conflict detection Proposed Technique to detect these attacks IIT Indore © Neminath Hubballi

Exchange of Messages IIT Indore © Neminath Hubballi DHCP Server LAN DHCP Client Initialization Begins 1. Client broadcasts a DHCPDISCOVER message Determines Configuration 2. Server unicasts a DHCPOFFER message to offer an IP address to client Selects configuration 3. Client broadcasts a DHCPREQUEST message to accept the offered IP. Commits Configuration 4. Server unicasts a DHCPACK message to supply additional network configuration information to client. IIT Indore © Neminath Hubballi Initialization Complete

IIT Indore © Neminath Hubballi Few Other Messages DHCPNAK DHCPDECLINE DHCPRELEASE DHCPINFORM IIT Indore © Neminath Hubballi

Message Structure Common Message Format for all DHCP Messages IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi Normal DHCP Operation IIT Indore © Neminath Hubballi

DHCPDISCOVER (Broadcast) DstMAC=ff:ff:ff:ff:ff:ff, Normal DHCP Operation I am new to this network so I should broadcast a DHCPDISCOVER message to get an IP address. DHCPDISCOVER (Broadcast) SrcMAC=18:03:73:a1:b2:c3, DstMAC=ff:ff:ff:ff:ff:ff, SrcIP=0.0.0.0, DstIP=255.255.255.255, chaddr=18:03:73:a1:b2:c3 DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Other Client 10.200.1.2 18:03:73:a1:b2:c4 Other Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi Normal DHCP Operation DHCPOFFER (Unicast) SrcMAC=18:03:73:b2:46:c6, DstMAC=18:03:73:a1:b2:c3, SrcIP=10.200.1.1, DstIP=10.200.1.4, yiaddr=10.200.1.4, siaddr=10.200.1.1, chaddr=18:03:73:a1:b2:c3 DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 I received a DHCPDISCOVER message. Let me check the pool for available IP addresses. I am going to offer 10.200.1.4 by unicasting a DHCPOFFER message back to the client. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 -- Other Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

Normal DHCP Operation DHCP Client 18:03:73:a1:b2:c3 DHCP Server I have been offered an IP address. Now I should broadcast a DHCPREQUEST message for the offered IP. DHCPREQUEST (Broadcast) SrcMAC=18:03:73:a1:b2:c3, SrcIP=0.0.0.0, DstIP=255.255.255.255, DstMAC=ff:ff:ff:ff:ff:ff, siaddr=10.200.1.1, chaddr=18:03:73:a1:b2:c3 DHCP option 50: 10.200.1.4 requested DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Other Client 10.200.1.2 18:03:73:a1:b2:c4 Other Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi Normal DHCP Operation DHCPACK (Unicast) SrcMAC=18:03:73:b2:46:c6, DstMAC=18:03:73:a1:b2:c3, SrcIP=10.200.1.1, DstIP=10.200.1.4, yiaddr=10.200.1.4, siaddr=10.200.1.1, chaddr=18:03:73:a1:b2:c3 DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 I received a DHCPREQUEST message for 10.200.1.4. Let me unicast a DHCPACK message back to the client. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 10.200.1.4 18:03:73:a1:b2:c3 -- Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 -- Other Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

I received DHCPACK message. Now I can use 10.200.1.4 as my IP address. Normal DHCP Operation I received DHCPACK message. Now I can use 10.200.1.4 as my IP address. DHCP Client 10.200.1.4 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Other Client 10.200.1.2 18:03:73:a1:b2:c4 Other Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

Classical DHCP Starvation Attack To launch the attack, I should broadcast multiple DHCPDISCOVER messages using spoofed random MAC addresses DHCPDISCOVER (Broadcast) SrcMAC=aa:aa:aa:aa:aa:aa, DstMAC=ff:ff:ff:ff:ff:ff, SrcIP=0.0.0.0, DstIP=255.255.255.255, Malicious Client 10.200.1.4 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Other Client 10.200.1.3 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 IIT Indore © Neminath Hubballi

DstMAC=aa:aa:aa:aa:aa:aa, DHCPOFFER (Unicast) SrcMAC=18:03:73:b2:46:c6, DstMAC=aa:aa:aa:aa:aa:aa, SrcIP=10.200.1.1, DstIP=10.200.1.5, Malicious Client 10.200.1.4 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 I received a DHCPDISCOVER message. Let me check the pool for available IP addresses. I am going to offer 10.200.1.5 by unicasting a DHCPOFFER message back to the client. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 10.200.1.4 18:03:73:a1:b2:c3 -- Other Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

Malicious Client 10.200.1.4 18:03:73:a1:b2:c3 DHCP Server One IP address is offered for “aa:aa:aa:aa:aa:aa”. Now I should broadcast a DHCPREQUEST message for the offered IP. DHCPREQUEST (Broadcast) SrcMAC= aa:aa:aa:aa:aa:aa, DstMAC=ff:ff:ff:ff:ff:ff, SrcIP=0.0.0.0, DstIP=255.255.255.255, Malicious Client 10.200.1.4 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Other Client 10.200.1.3 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 IIT Indore © Neminath Hubballi

DstMAC= aa:aa:aa:aa:aa:aa, DHCPACK (Unicast) SrcMAC=18:03:73:b2:46:c6, DstMAC= aa:aa:aa:aa:aa:aa, SrcIP=10.200.1.1, DstIP=10.200.1.5, Malicious Client 10.200.1.4 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 I received a DHCPREQUEST message for 10.200.1.5. Let me unicast a DHCPACK message back to the client. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 10.200.1.4 18:03:73:a1:b2:c3 10.200.1.5 aa:aa:aa:aa:aa:aa -- Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 10.200.1.4 18:03:73:a1:b2:c3 -- Other Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

DHCPDISCOVER (Broadcast) DstMAC=ff:ff:ff:ff:ff:ff, Exploiting DHCP Client-side IP Address Conflict Detection: An Induced DHCP Starvation Attack I am new to this network so I should broadcast a DHCPDISCOVER message to get an IP address. DHCPDISCOVER (Broadcast) SrcMAC=18:03:73:a1:b2:c3, DstMAC=ff:ff:ff:ff:ff:ff, SrcIP=0.0.0.0, DstIP=255.255.255.255, DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi DHCPOFFER (Unicast) SrcMAC=18:03:73:b2:46:c6, DstMAC=18:03:73:a1:b2:c3, SrcIP=10.200.1.1, DstIP=10.200.1.4, DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 I received a DHCPDISCOVER message. Let me check the pool for available IP addresses. I am going to offer 10.200.1.4 by unicasting a DHCPOFFER message back to the client. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 -- Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

DHCPREQUEST (Broadcast) DstMAC=ff:ff:ff:ff:ff:ff, I have been offered an IP address. Now I should broadcast a DHCPREQUEST message for the offered IP. DHCPREQUEST (Broadcast) SrcMAC=18:03:73:a1:b2:c3, DstMAC=ff:ff:ff:ff:ff:ff, SrcIP=0.0.0.0, DstIP=255.255.255.255, DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi DHCPACK (Unicast) SrcMAC=18:03:73:b2:46:c6, DstMAC=18:03:73:a1:b2:c3, SrcIP=10.200.1.1, DstIP=10.200.1.4, DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 I received a DHCPREQUEST message for 10.200.1.4. Let me unicast a DHCPACK message back to the client. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 10.200.1.4 18:03:73:a1:b2:c3 -- Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 -- Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

ARP Request (Broadcast) I received DHCPACK message. Now I should check if the allotted IP address is already in use. ARP Request (Broadcast) Who has IP 10.200.1.4? Tell your MAC address DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 ARP Reply (Unicast) I have IP 10.200.1.4 My MAC is 18:03:73:a1:b2:c5 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 IIT Indore © Neminath Hubballi

DHCPDECLINE (Broadcast) DstMAC=ff:ff:ff:ff:ff:ff, Someone is already using 10.200.1.4. I must broadcast a DHCPDECLINE message to refuse allotted IP address DHCPDECLINE (Broadcast) SrcMAC=18:03:73:a1:b2:c3, DstMAC=ff:ff:ff:ff:ff:ff, SrcIP=0.0.0.0, DstIP=255.255.255.255, DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 DHCPDECLINE message received for 10.200.1.4. I must mark this IP address as unavailable for the lease time. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 10.200.1.4 Not available -- Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

Exploiting DHCP Server-side IP Address Conflict Detection: A DHCP Starvation Attack I should broadcast DHCPDISCOVER message to get an IP address. DHCPDISCOVER (Broadcast) SrcMAC=18:03:73:a1:b2:c3, DstMAC=ff:ff:ff:ff:ff:ff, SrcIP=0.0.0.0, DstIP=255.255.255.255, DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 IIT Indore © Neminath Hubballi

ARP Request (Broadcast) Who has IP 10.200.1.4? Tell your MAC address DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 I am going to offer 10.200.1.4 but before offering it, let me check if any other client is already using this IP address. I received a DHCPDISCOVER message. Let me check the pool for available IP addresses. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 -- Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 ARP Reply (Unicast) I have IP 10.200.1.4 My MAC is 18:03:73:a1:b2:c5 Other Client 10.200.1.2 18:03:73:a1:b2:c4 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

ICMP Ping Request (Unicast) DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 ICMP Ping Request (Unicast) SrcMAC=18:03:73:b2:46:c6, DstMAC=18:03:73:a1:b2:c5, SrcIP=10.200.1.1, DstIP=10.200.1.4, Other Client 10.200.1.2 18:03:73:a1:b2:c4 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

ICMP Ping Reply (Unicast) DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 ICMP Ping Reply (Unicast) SrcMAC=18:03:73:b2:46:c5, DstMAC=18:03:73:a1:b2:c6, SrcIP=10.200.1.4, DstIP=10.200.1.1, Other Client 10.200.1.2 18:03:73:a1:b2:c4 Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi DHCP Client 18:03:73:a1:b2:c3 DHCP Server 18:03:73:b2:46:c6 10.200.1.1 ICMP Ping Reply received. The IP address 10.200.1.4 is already in use. I must mark this IP address as unavailable for the lease time. Other Client 10.200.1.2 18:03:73:a1:b2:c4 Pool Status IP Address MAC address 10.200.1.2 18:03:73:a1:b2:c4 10.200.1.3 18:03:73:a1:b2:c5 10.200.1.4 Not Available -- Malicious Client 10.200.1.3 18:03:73:a1:b2:c5 IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi Related Work Existing methods can be categorized in 2 categories: Cryptographic Techniques such as [1] Rarely deployed due to high implementation cost. Requires intervention of network administrators. Not feasible for highly dynamic networks. Non cryptographic techniques Security Features in switches [2] Port Security, DHCP Snooping and Dynamic ARP Inspection (DAI) Using DHCP Relay Agent Information Option [3]. Monitoring DHCP Request Traffic Rate [4]. Fair Allocation based mitigation technique [5]. D. Dinu, M. Togan: DHCP Server Authentication using Digital Certicates. In: International Conference on Communications (ICC), pp. 1-6, (2014). Configuring DHCP. http://www.cisco.com/switches/catalyst6500/ios/122SX/configuration/guide/book/snoodhcp.html M. Patrick. DHCP Relay Agent Information Option. RFC 3046, 2001. OConnor, T.: Detecting and Responding to Data Link Layer Attacks. http://www.sans.org/readingroom/whitepapers/intrusion/detecting-responding-data-link-layer-attacks-33513 H. Mukhtar, K. Salah, and Y. Iraqi. Mitigation of DHCP Starvation Attack. Computers and Electrical Engineering, 38(5):1115–1128, 2012. IIT Indore © Neminath Hubballi

Detection of proposed attacks using Hellinger Distance Hellinger Distance (HD): Statistical abnormality measurement technique. Computes distances between two probability distributions, 𝑃and 𝑄. 𝑃and 𝑄are 𝑁 dimensional vectors and each vector component represents probability of an attribute. HD is given by equation: 𝑑 𝐻 always ranges from 0 to 1. IIT Indore © Neminath Hubballi

Detection using Hellinger Distance (contd.) Reasons behind choosing HD over other similar methods: Lightweight Computation. Natural Lower and Upper Bounds. Yielding finite distance values. IIT Indore © Neminath Hubballi

Detection using Hellinger Distance (contd.) Normal behavior of DHCP operation is treated as a distribution comprised of various events. Various DHCP messages have strong correlation between them. DISCOVER, OFFER, REQUEST and ACK DECLINE does not follow this fact. Reasons which may disturb this balance. Presence of DECLINE messages during induced DHCP starvation attack. Absence of all messages but DISCOVER while launching attack by exploiting server side conflict detection scheme. This change in observation can be exploited to detect the attacks. IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi

Detection using Hellinger Distance (contd.) Two phases of operation Training Phase Create normal behavior profile of DHCP operation over a period of 𝑛 observations. Each observation is of ∆𝑇=30 minutes. Generated profile contains 5 attributes DISCOVER, OFFER, REQUEST, ACK and DECLINE Probability of a particular message type, 𝑃 𝑖 , is estimated as: where 𝑁 𝑖 =Number of events of Type 𝑖, during 𝑛∗∆𝑇 𝑁 𝑡𝑜𝑡𝑎𝑙 =Total number of events of all type during 𝑛∗∆𝑇 IIT Indore © Neminath Hubballi

Detection using Hellinger Distance (contd.) Testing Phase After training, detect starvation attacks from 𝑛+1 𝑡ℎ interval of duration ∆𝑇 bb Each observation is of ∆𝑇=30 minutes. Generate Probability Distribution, 𝑄,every ∆𝑇 duration using previous eq. 𝑄 is now compared with 𝑃. If HD >δ (predefined threshold), raise the alarm. IIT Indore © Neminath Hubballi

Experimental Evaluation Training Data Collection: 2 days of normal DHCP traffic from departmental network having 43 clients. Probability Distribution of Training Data IIT Indore © Neminath Hubballi

Experimental Evaluation (contd.) Testing Data: One day DHCP traffic for testing purpose. Probability Distribution generated from testing Normal Interval IIT Indore © Neminath Hubballi

IIT Indore © Neminath Hubballi Probability Distribution generated from testing Induced Attack Interval Probability Distribution generated from testing server-side exploitation based attack interval IIT Indore © Neminath Hubballi

Detection of Normal and Starvation Scenarios IIT Indore © Neminath Hubballi