The Dark Side of the Web: An Open Proxy’s View Vivek S. Pai, Limin Wang, KyoungSoo Park, Ruoming Pang, Larry Peterson Princeton University

Nov 20, 2003CoDeeN Security - HotNets II2 Origins: Surviving Heavy Loads Surviving flash crowds, DDoS attacks Absorb via massive resources Raise the bar for attacks Tolerate smaller crowds Survive larger attacks Existing approach: Content Distribution Networks

Nov 20, 2003CoDeeN Security - HotNets II3 Building an Academic CDN Flash crowds are real We have the technology OSDI’02 paper on CDN performance USITS’03 proxy API PlanetLab provides the resources Continuous service, decentralized control Seeing real traffic, reliability, etc We use it ourselves Open access = more traffic

Nov 20, 2003CoDeeN Security - HotNets II4 How Does CoDeeN Work? Server surrogates (proxies) on most North American sites Originally everywhere, but we cut back Clients specify proxy to use Cache hits served locally Cache misses forwarded to CoDeeN nodes Maybe forwarded to origin servers

Nov 20, 2003CoDeeN Security - HotNets II5 How Does CoDeeN Work? CoDeeN Proxy origin Request Response Cache hit Each CoDeeN proxy is a forward proxy, reverse proxy, & redirector Cache miss Response Cache hit Cache miss Response Request Cache Miss

Nov 20, 2003CoDeeN Security - HotNets II6 Steps For Inviting Trouble Use a popular protocol HTTP Emulate a popular tool/interface Web proxy servers Allow open access With HTTP’s lack of accountability Be more attractive than competition Uptime, bandwidth, anonymity

Nov 20, 2003CoDeeN Security - HotNets II7 Hello, Trouble! Spammers Bandwidth hogs High request rates Content Thieves Worrisome anonymity Commonality: using CoDeeN to do things they would not do directly

Nov 20, 2003CoDeeN Security - HotNets II8 The Root of All Trouble origin CoDeeN Proxy (Malicious) Client http/tcp No End-To-End Authentication

Nov 20, 2003CoDeeN Security - HotNets II9 Spammers SMTP (port 25) tunnels via CONNECT Relay via open mail server POST forms (formmail scripts) Exploit website scripts IRC channels (port 6667) via CONNECT Captive audience, high port #

Nov 20, 2003CoDeeN Security - HotNets II10 Attempted SMTP Tunnels/Day

Nov 20, 2003CoDeeN Security - HotNets II11 Bandwidth Hogs Webcam trackers Mass downloads of paid cam sites Cross-Pacific traffic Simultaneous large file downloads Steganographers Large files small images All uniform sizes

Nov 20, 2003CoDeeN Security - HotNets II12 High Request Rates Password crackers Attacking random Yahoo! accounts Google crawlers Dictionary crawls – baffles Googlians Click counters Defeat ad-supported “game”

Nov 20, 2003CoDeeN Security - HotNets II13 Content Theft Licensed content theft Journals and databases are expensive Intra-domain access Protected pages within the hosting site

Nov 20, 2003CoDeeN Security - HotNets II14 Worrisome Anonymity Request spreaders Use CoDeeN as a DDoS platform! TCP over HTTP Non-HTTP Port 80 Access logging insufficient Vulnerability testing Low rate, triggers IDS

Nov 20, 2003CoDeeN Security - HotNets II15 Goals, Real & Otherwise Desired: allow only “safe” accesses Ideally An oracle tells you what’s safe “Your” users are not impacted Open proxies considered inherently bad NLANR requires accounts, proxy-auth JANET closed to outsiders No research in “partially open” proxies

Nov 20, 2003CoDeeN Security - HotNets II16 Privilege Separation Local Proxy Local Server Remote Proxy Remote Client Unprivileged Request Local Client Privileged Request

Nov 20, 2003CoDeeN Security - HotNets II17 Rate Limiting 3 scales capture burstiness Exceptions Login attempts Vulnerability tests Day Hour Minute

Nov 20, 2003CoDeeN Security - HotNets II18 Other Techniques Limiting methods – GET, (HEAD) Local users not restricted Sanity checking on requests Browsers, machines very different Modifying request stream Most promising future direction

Nov 20, 2003CoDeeN Security - HotNets II19 By The Numbers… Running 24/7 since May, ~40 nodes Over 400,000 unique IPs as clients Over 150 million requests serviced Valid rates up to 50K reqs/hour Roughly 4 million reqs/day aggregate About 4 real abuse incidents Availability: high uptimes, fast upgrades

Nov 20, 2003CoDeeN Security - HotNets II20 Daily Client Population Count

Nov 20, 2003CoDeeN Security - HotNets II21 Daily Request Volume

Nov 20, 2003CoDeeN Security - HotNets II22 Monitors & Other Venues Routinely trigger open proxy alerts Educating sysadmins, others Really good honeypots 6000 SMTP flows/minute at CMU Spammers do ~1M HTTP ops/day Early problem detection Failing PlanetLab nodes Compromised university machines

Nov 20, 2003CoDeeN Security - HotNets II23 Lessons & Directions Few substitutes for reality Non-dedicated hardware really interesting Failure modes not present in NS-2 Stopgap measures pretty effective Very slow arms race Breathing time for better solutions Next: more complex techniques Machine learning, high-dim clustering

Nov 20, 2003CoDeeN Security - HotNets II24 More Info Thanks: Intel, HP, iMimic, PlanetLab Central