Network Attacks

Network Trust Issues – TCP Congestion control – IP Src Spoofing – Wireless transmission Denial of Service Attacks – TCP-SYN – Name Servers DDoS (DNS) – DNS Amplification attack

Network Trust Issues

The Gullible Network A lot of network protocols assume people are well intentioned – TCP: Congestion Control – Wireless: Transmit power – BGP Route-advertisements

Cheating TCP 5 22, 2210, 35 35, 1015, 15 (x, y) A Increases by 1 Increases by 5 D  Increases by 1 Increases by 5 Individual incentives: cheating pays Social incentives: better off without cheating Classic Prisoner Dilemma: resolution depends on accountability Too aggressive  Losses  Throughput falls AB x DE y

Cheating Wireless 6 5Mbps, 5Mbps0MBps, 20MBps 20Mbps, 0Mbps 10Mbps, 10Mbps 10X Power Normal power Individual incentives: cheating pays Social incentives: better off without cheating Classic Prisoner Dilemma: resolution depends on accountability 10X Power Normal power A A C C B B

7 Origin: IP Address Ownership and Hijacking Who can advertise a prefix with BGP? – By the AS who owns the prefix – … or, by its upstream provider(s) in its behalf Implicit trust between upstream & downstream providers However, what’s to stop someone else? – Prefix hijacking: another AS originates the prefix – BGP does not verify that the AS is authorized

8 Prefix Hijacking: full or partial control /16 Consequences for the affected ASes – Blackhole: data traffic is discarded – Snooping: data traffic is inspected, and then redirected – Impersonation: data traffic is sent to bogus destinations

DoS

Denial of Service Attack Prevent other people from using a service: – A server – A link in a network High level idea – Sent a lot of packets and ensure 100% utilization No one else can use it.

DNS: Denial Of Service 11 Flood DNS servers with requests until they fail What was the effect? – … users may not even notice – Caching is almost everywhere More targeted attacks can be effective – Local DNS server  cannot access DNS – Authoritative server  cannot access domain

TCP: Denial Of Service (SYN Flood) 12 Send a bunch of SYN Packets to a server – Server allocates buffer and TCP sockets – You allocate nothing – Eventually the server runs out of space. How to solve this problem?

Recall: TCP Handshake SYN SYN/ACK A Server Server allocates: Allocates data structures E.g buffer space No allocations No resource committed

TCP: Denial Of Service (SYN Flood) 14 Send a bunch of SYN Packets to a server – Server allocates buffer and TCP sockets – Server responds with ‘SYN/ACK’ – You allocate nothing – Eventually Server runs out of space. How to solve this problem? – SYN Cookies: server stores nothing and instead responds with a special cookie – If cookie is returned in subsequent packet, then server allocates space – Assumption: If you come back then you aren’t a bad person

Problems with DoS One person attacks one server/link – Easy to figure out who …. – Easy to block …. – Takes a while for the attack to work…..

DDoS

Distributed Denial of Service Attack Take over a number of machines – Use a BotNet Use all machines to conduct a DoS on a server – Much more effective than regular DoS – Harder to stop and shutdown

DNS Amplification Attack 580,000 open resolvers on Internet (Kaminsky-Shiffman’06) DNS Server DoS Source DoS Target DNS Query SrcIP: DoS Target (60 bytes) EDNS Reponse (3000 bytes) DNS Amplification attack: (  40 amplification )

attacker Solutions ip spoofed packets replies victim open amplifier prevent ip spoofing disable open amplifiers

DDOS BotNet Name Server Name Server DNS Requests DNS Responses victim

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube YOU!!!!! Google!!!

What Happens When you Connect to a Website? Browser Network Loading SoundCloud HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: sound.mp3 HTTP Requests Get: sound.mp3

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube

Similar to streaming a Video … Browser Network HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi Loading Youtube

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

How are they deployed? “circle of trust” The Internet AKA “Everything evil” The firewall is the gatekeeper Only one way in or out into the circle

Types of Packet-Filters Stateless Very simple Applies rules to packets – Stateful A bit more complicated In addition to applying rules – It ensure that: all connections must be initiated from within the network

Stateful Firewalls “circle of trust” The Internet AKA “Everything evil” SYN Why would someone from the outside want to start a connection?

Stateful Firewalls “circle of trust” The Internet AKA “Everything evil” SYN Why would someone from the outside want to start a connection? – They would if you were running a web-server, an -server, a gaming server …. Pretty much any ‘server’ service.

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

At What level should you apply security? You see just one packet What the network and lower layer see HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: video.avi HTTP Requests Get: video.avi You see the whole object what application sees Are you protecting against an attack on the application? E.g. worms, virus… Are you protecting against an attack on your network? E.g. DDoS

Application Level Firewall Why are they needed? Attackers are tricky – When exploiting security vulnerabilities – They can use multiple packets. Need a system to scan across multiple packets for Virus/Worm/Vulnerability exploits

What Happens When you Connect to a Website? Browser Network Loading SoundCloud HTTP Requests Get: image.png HTTP Requests Get: image.png HTTP Requests Get: sound.mp3 HTTP Requests Get: sound.mp3 What happens if the virus/worm is hidden in an ? Picture? Or if the security exploit is in an HTML page?

Application Level Firewall Why are they needed? Attackers are tricky – When exploiting security vulnerabilities – They can use multiple packets. Need a system to scan across multiple packets for Virus/Worm/Vulnerability exploits

Application Level Firewalls Similar to Packet-filters except: – Supports regular expression – Searches across different packets for a match – Reconstructs objects (images,pictures) from packets and scans objects.

Application Level Firewalls Similar to Packet-filters except: – Supports regular expression – Searches across different packets for a match – Reconstructs objects (images,pictures) from packets and scans objects. HTTP Requests Get: image.png HTTP Requests Get: image.png Appy reg-ex to the object:

Application Level Firewalls Similar to Packet-filters except: – Supports regular expression – Searches across different packets for a match – Reconstructs objects (images,pictures) from packets and scans objects. HTTP Requests Get: image.png HTTP Requests Get: image.png

Why doesn’t everyone use App level firewalls? Object re-assembly requires a lot of memory Reg-expressions require a lot of CPU App level firewalls are a lot more expensive – And also much slower  – So you need more -- a lot more.

How do you Attack the Firewall? Most Common: Denial-of-Service attacks – Figure out a bug in the Firewall code – Code causes it to handle a packet incorrectly – Send a lot of ‘bug’ packets and no one can use the firewall