Ao-Jan Su and Aleksandar Kuzmanovic Department of EECS Northwestern University Thinning Akamai USENIX/ACM SIGCOMM IMC ’08

Ao-Jan SuThinning Akamai 2 Motivation ● >50% of online users would leave and never come back to a streaming site when streaming quality is bad (Akamai’s user study ’07)

Ao-Jan SuThinning Akamai 3 Akamai’s Streaming Architecture Entry Points Reflectors Edge Servers Can we degrade service to large-scale streaming networks?

Ao-Jan SuThinning Akamai 4 DNS-based Load Balancing ● DNS-based load balancing is used in both edge and reflector levels Global Monitoring Infrastructure Edge Server 1 Edge Server 2 feedback update DNS Server New edge server IP

Ao-Jan SuThinning Akamai 5 Web vs. Streaming ● Web ■ Insensitive to bandwidth and latency ■ Short-lived connections − Server load quickly goes away ● Streaming ■ Sensitive to bandwidth, jitter, and packet loss ■ Long-lived connections − Clients connect to a streaming server for minutes/hours Is DNS-based load balancing resilient to DoS attacks for streaming service?

Ao-Jan SuThinning Akamai 6 Slow Load Balancing Experiment

Ao-Jan SuThinning Akamai 7 Redirection Time Scales Minimum redirection time is 20 seconds Is minimum redirection time scale small enough for streaming?

Ao-Jan SuThinning Akamai 8 Slow Load Balancing Result Start probing machines Edge server becomes overloaded DNS updated, stop probing machines DNS updated, stop probing machines Throughput recovers DNS-based system is too slow to react to overloaded conditions DNS-based system is too slow to react to overloaded conditions

Ao-Jan SuThinning Akamai 9 No-isolation Experiment Pay per View VoD Movie Live Video

Ao-Jan SuThinning Akamai 10 Service Overlapping Would different streaming services interfere with each other? 25% of nodes observe overlap ratio > 0.5

Ao-Jan SuThinning Akamai 11 No-isolation Experiment (Live vs. VoD) Start probing machines Edge server becomes overloaded Edge server attempts to refill client’s buffer No-isolation makes it possible to DoS Video-on-Demand service by live streaming No-isolation makes it possible to DoS Video-on-Demand service by live streaming DNS updated, stop probing machines DNS updated, stop probing machines

Ao-Jan SuThinning Akamai 12  Facts: -Akamai gathers streams from different customers into channels -Streams from the same region and the same channel map to the same reflector  Facts: -Akamai gathers streams from different customers into channels -Streams from the same region and the same channel map to the same reflector  Issue: How to attack reflectors?  Challenge: Information about reflectors not publicly available  Approach: Use edge servers as proxies Need mapping between edge servers and reflectors  Issue: How to attack reflectors?  Challenge: Information about reflectors not publicly available  Approach: Use edge servers as proxies Need mapping between edge servers and reflectors Reflector-level Experiments Customers

Ao-Jan SuThinning Akamai 13 Amplification Experiment Big edge server clusters are vulnerable to amplification attacks Big edge server clusters are vulnerable to amplification attacks Can we attack reflectors by using edge servers as proxies?

Ao-Jan SuThinning Akamai 14 Amplification Experiment Service degradation at similar pace Service degradation at similar pace Throughput recovery It is possible to attack reflectors by using edge servers as “proxies” It is possible to attack reflectors by using edge servers as “proxies” Start probing machines Bottleneck observed, stop probing machines

Ao-Jan SuThinning Akamai 15 Existing Countermeasures ● Stream replication ■ Waste bandwidth ● Resource-based admission control ■ Can’t solve network or reflector bottlenecks ● Solving Puzzles ■ Undermines Akamai’s service transparency

Ao-Jan SuThinning Akamai 16 Our approaches ● Location-aware admission control

Ao-Jan SuThinning Akamai 17 Our approaches (Cont.) ● Reducing system transparency ■ Shielding administrative information − Keep state at edge servers ■ Shielding vincible IP addresses − Virtual IP addresses ● Key issue: ■ Tradeoff between transparency and DoS resiliency

Ao-Jan SuThinning Akamai 18 Conclusions ● Large-scale, DNS-based load balancing systems are known to be resilient to attacks. However, it is not exactly true in the case of streaming ● Identify vulnerabilities of DNS-based streaming service ■ Slow load balancing ■ No isolation ■ Amplification attacks ● Provide countermeasures to raise the bar for attackers

Ao-Jan SuThinning Akamai 19 Thank you!

Ao-Jan SuThinning Akamai 20 Backup Slides

Ao-Jan SuThinning Akamai 21 Methodogy ● Protocol: Windows Media Server (mms) ■ Modify MiMMS software ● Setup: ■ Observers & experimental machines ● Collect 1400 unique live streams ■ assign 200 streams each to 7 experimental machines ● Bypass DNS redirections ■ Directly connect to edge server ● Abort experiment immediately when we observe bottleneck conditions

Ao-Jan SuThinning Akamai Migration