Network Layer Security Distributed Denial of Service (DDoS) attacks and the proposed solutions November 12, 2007

Network Layer security Definition: Network layer security is the security of IP routing mechanism and accessibility of networks, services and specific IP machines under general network conditions. Sample Network Level Threats: IP hijacking: the IP address of a machine is stolen by another machine. The data streams of the forst machin are diverted by the second machine. MAC address hijacking: Same as IP hijacking in the MC level. This is done by abusing the ARP protocol and something known as ARP poisoning. Distributed Denial of service.

What is a DDoS? A DDoS is a collaborative effort of many machines distributed across the internet. The machines are infected by a piece of malware, which makes them to be abused for a DDoS attack. The owners of the machines are usually un-aware of the infection. The infected machines are called zombies. All the zombie machines are controlled by a mastermind of the DDoS.

Illustrating a DDoS Edge router Core router DDoS source The Victim

Some of the Recent Incidents In May 2006, Internet spammers launched a massive DDoS attack against the anti-spam company Blue Security. As a result of a change in DNS entries of Blue Security at the time of the attack, the DDoS also targeted millions of blogs. In the aftermath of this DDoS attack, Blue Security was forced to stop providing anti-spam services and revised its business strategy A report of Online Wired Magazine on this event reads: “... at 4 pm on May 2, 2006, the sites went dark, and so did the mood at Six Apart, the company that owns them. In the blink of an eye, 10 million blogs and online communities disappeared. Flash floods of data thundered into one network port, stopped inexplicably, then reappeared to overwhelm another. The engineers pored over logs, desperately looking for a cause. After an agonizing hunt, they found it: a distributed denial-of-service attack, or DDoS”

Some of The Recent Incedents The alleged attack of Russia against Estonia in April-May 2007: The crisis unleashed a wave of so-called DDoS, or Distributed Denial of Service, attacks, where websites are suddenly swamped by tens of thousands of visits, jamming and disabling them by overcrowding the bandwidths for the servers running the sites. The attacks have been pouring in from all over the world, but Estonian officials and computer security experts say that, particularly in the early phase, some attackers were identified by their internet addresses - many of which were Russian, and some of which were from Russian state institutions.... The attacks have come in three waves: from April 27, when the Bronze Soldier riots erupted, peaking around May 3; then on May 8 and 9 - a couple of the most celebrated dates in the Russian calendar, when the country marks Victory Day over Nazi Germany, and when President Vladimir Putin delivered another hostile speech attacking Estonia and indirectly likening the Bush administration to the Hitler regime; and again this week. Source:

The Root of Vulnerability The main root of DDoS is the fact that the IP has an open structure and it is had to block distributed users to send traffic to a specific address. As of now, there is no solution to DDoS problem. Some of the solutions partially solve the problem.

Some of the Difficulties The source IP addresses are often spoofed. Therefore, it is hard to identify the real sources. In the network layer and the interim routers, the DDoS traffic looks like normal traffic. Often the sources are very distributed across the internet, and the number of active sources range from a few hundred to tens of thousands.

Example: reflected attacks The source sends traffic to a so-called reflector. The source IP address is spoofed as the IP address of the victim. Therefore, the response of the reflector is sent to the victim. Advantage: hiding the identity of the source, and reflection gain.

Illustrating Reflected Attack S SYN S: (spoofed) D: V R SYN SYN-ACK S: D: SYN-ACK S: source R: reflector V: Victim For every SYN at the source, the victim receives 3-5 SYN-ACKs. So the attack is amplified at the victim.

Some of the Proposed Solutions Egress (Ingress) filtering Route based filtering Probabilistic packet marking Pushback D-ward I-trace through ICMP messages

Ingress and Egress Filtering When leaving a network, the source IP address is checked for its validity. Therefore, the IP packets with a spoofed source do not leave the network

Issues of Egress Filtering No incentive for the source domains to implement: DDoS does not harm them! The attackers can still hide themselves within the IP address range of the domain.

Route-based filtering A router checks to see if a packet with a given source IP address is supposed to pass through that router Routers use BGP route information for such tests Route-based filtering is a generalization of egress filtering.

Illustrating Route-based Filtering Node 7 uses IP address belonging to node 2 when attacking node 4. Node 6 detects that a packet from node 2 is not supposed to be received On the interface connecting it to node 7. The packet is filtered.

Issues of Route-based Filtering A huge network support is needed Same problems as egress filtering Needs exchanging BGP route tables among routers

Probabilistic Packet Marking Each router randomly writes a piece of its IP address on some unused field in IP header. By using enough packets, the victim can recover the complete path to the sources.

Problems of Probabilistic Packet Marking Usually, the victim needs to receive too many packets from a source to be able to completely recover the path. The sources may be programmed to stop before they will be detectable by PPM It can only find the source networks not the real source machines.

I-trace through ICMP Messages For each IP packet being received, with a small probability, an ICMP packet with the complete information of the packet and the IP address of the router through which the packet was forwarded is generated. The probability of generating an ICMP message is 1/20,000 per receive packet If a DDoS source generates enough packets, then enough ICMP messages will be generated to help recover the complete path to the source.

Problems of I-trace through ICMP Messages The approach requires sources generate too many messages. It can only find the source networks not the real source machines.

Pushback Pushback is based on the fact that DDoS causes congestion A congestion signature is identified by the routers in proximity of the victim. The congestion signature is advertised to the upstream routers. Whenever there is a high rate of packets matching the congestion signature, the mechanism continues iteratively. Pushback is designed to continue toward the sources

Illustrating Pushback Pushback limits the traffic rate closer to the sources

Pushback in More Details ACC: Aggregate-based Congestion Control RED: Random Early Detection (Drop)

Problems of Pushback Many false positives and false negatives Often hard to extract a congestion signature Traffic becomes very sparse close to the sources. Therefore, pushback often fails to continue all the way to a DDoS source.

D-WARD D-WARD monitors the traffic at the egress router of a stub domain in order to determine whether the ratio of outgoing to incoming traffic for a set of remote addresses is abnormally high. A high ratio is taken as a signal that an attack is being mounted from within the stub domain.

Issues of D-WARD Performance of D-WARD degrades in detecting DDoS in transit domains because possibility of asymmetry in routes. D-WARD does not work when routes are not symmetric. D-WARD is not well suited for UD traffic.