Accurate Real-Time Identification of IP Prefix Hijacking Z. Morley Mao Xin Hu 2007 IEEE Symposium on and Privacy Oakland, California 2007 IEEE Symposium on Security and Privacy Oakland, California

IEEE Symposium on Security and Privacy May Outline Introduction Taxonomy of IP prefix hijacking Proposed approach of combining control and data plane information Implementation and results Conclusion

IEEE Symposium on Security and Privacy May Outline Introduction Taxonomy of IP prefix hijacking Proposed approach of combining control and data plane information Implementation and results Conclusion

IEEE Symposium on Security and Privacy May IP prefix hijacking Fraudulent origin attack Steal IP prefixes belonging to other networks Announce unauthorized prefixes through BGP Can also result from network misconfiguration

IEEE Symposium on Security and Privacy May Motivation Existing solutions  Route filters  Short-lived announcements [Boothe06]  Anomalous routing information [Lad06] Control plane + Data plane  Control plane anomalies trigger real-time detection  Data plane fingerprints provide confirmative evidence  Real-time and accurate identification of prefix hijacking  Insufficient due to multi-homing  Solely rely on Control plane  High false positive and false negative

IEEE Symposium on Security and Privacy May Outline Introduction Taxonomy of IP prefix hijacking Proposed approach of combining control and data plane information Implementation and results Conclusion

IEEE Symposium on Security and Privacy May Prefix announcements IEEE Symposium on Security and Privacy May 2007 AS 1AS 2 AS 3 AS 4 AS 5 PrefixPath /161 PrefixPath /162, 1 PrefixPath /162, 1 Advertise /16 PrefixPath /164, 2, /16 Path: /16 Path: 2, /16 Path: 4, 2, /16 Path: 3, 2, 1

IEEE Symposium on Security and Privacy May Type 1: Hijack a prefix AS 1AS 2 AS 3 AS 4 AS 5 PrefixPath /161 PrefixPath /162, 1 PrefixPath /162, /16 path: 5 PrefixPath /165 PrefixPath /164, 5 MOAS (Multiple Origin AS) Advertise / /16 path: 4, 5

IEEE Symposium on Security and Privacy May Type 2: Hijack a prefix and its AS number AS 1AS 2 AS 3 AS 4 AS 5 PrefixPath /161 PrefixPath /162, 1 PrefixPath /162, /16 Path: 5, 1 PrefixPath /165, /16 Path: 4, 5, 1 NO MOAS! Advertise /16 Advertise a path to /16

IEEE Symposium on Security and Privacy May Type 3: Hijack a subnet of a prefix AS 1AS 2 AS 3 AS 4 AS 5 PrefixPath /161 PrefixPath /162, 1 PrefixPath /162, /24 path: /24 Path: 4, 5 PrefixPath / /162, 1 PrefixPath /244, /162,1 PrefixPath /244, /161 No MOAS! Advertise / 24 SubMOAS! Advertise / 16

IEEE Symposium on Security and Privacy May Longest prefix matching IEEE Symposium on Security and Privacy May 2007 Attacker is able to attract all traffic AS 1AS 2 AS 3 AS 4 AS 5 PrefixPath /162, 1 PefixPath / /162, 1 PrefixPath /244, /162, 1 PrefixPath /244, /161 Send packet to in AS 1 Longest Prefix Matching Advertise / 24 Advertise / 16

IEEE Symposium on Security and Privacy May Type 4: Hijack a subnet of a prefix and AS number IEEE Symposium on Security and Privacy May 2007 AS 1AS 2 AS 3 AS 4 AS 5 PrefixPath /161 PrefixPath /162, 1 PrefixPath /162, /24 path 5, /24 Path: 4, 5,1 PrefixPath /245, /162, 1 PrefixPath /244,5, /162, 1 PrefixPath /244,5, /161 Neither MOAS Nor SubMOAS! Advertise a path to / 24 Advertise / 16 Longest Prefix Matching

IEEE Symposium on Security and Privacy May Outline Introduction Taxonomy of IP prefix hijacking Proposed approach of combining control and data plane information Implementation and results Conclusion

IEEE Symposium on Security and Privacy May Control plane information alone is insufficient False positive  Legitimate reasons for anomalous routing updates  Multi-homing with static link AS 3 AS /24 path: 1 AS /24 static link or IGP route /24 path: 2, /24 path: 3 aggregation MOAS! AS /16 AS /24 AS / /24 path: /16 path: /24 path: /24 path: 3, 1 subMOAS!

IEEE Symposium on Security and Privacy May Control plane information alone is insufficient False positive  Legitimate reasons for anomalous routing updates  Multi-homing with static link and aggregation False negative  AS-level path may not match the forwarding path  Type 2 and type 4 attack do not lead to control plane anomalies

IEEE Symposium on Security and Privacy May Proposed approach Combine control plane and data plane information  A successful hijacking will result in conflicting data plane fingerprints  A hijacking attempt cannot affect the entire network, especially the network topologically close to the victim Fingerprinting-based consistency check  For valid MOAS and subMOAS, there is only one owner for the prefix  For real hijacking, traffic from different locations may arrive at true owner or attackers  Same data plane fingerprints  conflicting fingerprints

IEEE Symposium on Security and Privacy May Fingerprinting techniques Determine characteristics of remote hosts or networks by sending probe packets Host-based fingerprinting  Host Operating System detection  IP Identifier (IPID) probing  Timestamp probing (ICMP and TCP timestamp)  Reflect-scan Network fingerprinting  Firewall policies  Resource properties (e.g., bandwidth)  Edge router characteristics

IEEE Symposium on Security and Privacy May Detection of prefix hijack AS 1 AS 2 AS 3 AS 4 AS 5 PrefixPath /162, 1 PrefixPath /162, 1 Advertise /16 PrefixPath /165 PrefixPath /164, 5 Advertise / PrefixPath /161 Fingerprint probing server

IEEE Symposium on Security and Privacy May Detection of prefix and AS hijacking Problem  Attackers avoid MOAS conflicts by retaining correct origin AS  Checking all updates is prohibitively expensive Heuristics for detecting the fake AS edge  Edge popularity constraint  Geographic constraint  Relationship constraint [ Kruegel2003 ] Violation of these constraints triggers fingerprinting check

IEEE Symposium on Security and Privacy May Detection of prefix subnet hijacking Problem  Attackers avoid MOAS conflicts by hijacking a subnet  longest prefix matching AS 1 AS 2 AS 3 AS 4 AS 5 Advertise /24 Advertise / fingerprint PrefixPath / /162, 1 PrefixPath /244, /162, 1 PrefixPath /244, /161

IEEE Symposium on Security and Privacy May Detection of prefix subnet hijacking (Cont.) Identify subMOAS conflicts  Newly announced prefixes which is part of existing prefix Customer-provider relationship check  Assume provider and customer will not hijack one another Reflect-scan to detect subnet hijacking  IGP routing within victim AS is unaffected  Use IP spoofing to solicit traffic inside victim AS  Predictable IP ID increment in IP packet

IEEE Symposium on Security and Privacy May Summary of detection techniques IEEE Symposium on Security and Privacy May 2007 Limitations  Detection is triggered by anomalous updates  Limited number of vantage points  Firewall blocks probing packets  Ingress filtering Attack Type Monitored Routing Updates Detection Technique Hijack prefixMOAS updates Fingerprinting-based consistency check (FP check) Hijack prefix & ASAll updates Edge, geographic, and relationship (EGR) constraints, FP check Hijack subnet prefixsubMOAS updates Customer-provider (C-P) check, reflect-scan Hijack subnet prefix & ASNew, non-subMOAS updatesEGR constraints, reflect-scan

IEEE Symposium on Security and Privacy May Outline Introduction Taxonomy of IP prefix hijacking Proposed approach of combining control and data plane information Implementation and results Conclusion

IEEE Symposium on Security and Privacy May Prototype Implementation Data Set  BGP data set: RouteView + Our own BGP monitor  Probe location: Planetlab testbed  Live IP addresses: DNS and Web Server log + lightweight ping  Prefix Geographic information: NetGeo from CAIDA Fingerprinting  OS detection and TCP timestamp: Nmap v 3.95  IPID and ICMP timestamp: Ruby in planetlab  Reflect-scan: hping v2

IEEE Symposium on Security and Privacy May Results 2 weeks’ monitoring period Real time BGP data from our BGP monitor Attack Type Anomalous updatesTotal number Avg rate /15 min Suspicious updates (After F-P check) 1MOAS conflicts Violate EGR constraints subMOAS conflicts (after C-P check) New non-subMOAS prefix that viiolate EGR constraints

IEEE Symposium on Security and Privacy May Potential attack (type 1)

IEEE Symposium on Security and Privacy May Potential attack (type 2)

IEEE Symposium on Security and Privacy May DNS anycast validation IP anycast of root DNS server  Multiple server support same service under same IP address  5 out of 13 DNS servers use anycast (C, F, I, J and K) Legitimate type 2 hijack attack  Hijack both prefix and AS number  Our system successfully detect 4 of them  C-root server doesn’t violate EGR check

IEEE Symposium on Security and Privacy May Fingerprints for F root server

IEEE Symposium on Security and Privacy May Correlation with spam data Hijacked IP prefixes are often used for spamming  Correlate identified suspicious updates with Spam source IPs  Non-negligible correlation between hijacking and spamming Time interval between identification of suspicious updates and the arrival of spam Type# of suspicious prefix # of matched prefix # of matched prefixes within the time window 1 h6 h1 d Correlation between detected suspicious prefixes and spam sources.

IEEE Symposium on Security and Privacy May Conclusion IEEE Symposium on Security and Privacy May 2007 Propose a framework for accurate real-time detection of IP prefix hijacking attacks Exploit a novel insight that a real hijacking will result in conflicting data-plane fingerprints Propose detailed classification of hijacking attacks and the detection algorithm for each type Achieve significant reduction in both false positives and false negatives

IEEE Symposium on Security and Privacy May Paper-2 A Light-Weight Distributed Scheme for Detecting IP Prefix Hijacks in Real-Time In SIGCOMM’07

IEEE Symposium on Security and Privacy May Key observations If a prefix is hijacked, the paths observed from certain vantage points to the prefix would likely exhibit significant changes. The path from a source to a prefix is almost always a super-path of the path from the same source to a reference point along the previous path, as long as the reference point is topologically close to the prefix.

IEEE Symposium on Security and Privacy May High-level Methodology and Results Detect the suspicious hijacking using the first observation Confirm the real hijacking using the second observation Result is surprising good, 0.5% false positive and false negative. (which is really beyond my expectation, why?)

IEEE Symposium on Security and Privacy May Comparison between the two paper Paper 1Paper 2 Simplicity control + data√ data Real-time effect analysis -> probing √ online probing Accuracy √ Probing overhead √ targeted brute-force

IEEE Symposium on Security and Privacy May My thinking (a 100% detection) Observation ? (my guess) - hijacked prefixes and victim prefixes are not identically used. Hijacked addresses may be little used ? Proposed Method - Why not use a very simple and 100% accurate method, PING!!! Just ping the sampled addresses, to detect reachable or unreachable. Merits - Very simple, easy to deploy, no false positive and false negative, comparable overhead with previous work, no other assistance is need! Opportunity - I search online, nobody do so! Want to discuss with all of you - Why cannot we just do so?