ETRI meeting (Feb 16, 2005) -- Dongkee LEE 1 Sapphire/Slammer worm impact on Internet routing Dongkee LEE

ETRI meeting (Feb 16, 2005) -- Dongkee LEE  Introduction to Sapphire/Slammer worm.  Analysis methods  Results  Discussion

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Sapphire worm Also called Slammer, SQLSlammer, W32.Slammer  Began at 5:30 AM (UTC) on Saturday Jan 25 th.  System affected Microsoft SQL Server 2000 Microsoft Desktop Engine (MSDE) 2000 Once the worm compromises a machine, it will try to propagate itself. The worm will craft packets of 376 bytes and send them to randomly chosen IP address on port 1434/udp. - CERT Advisory CA reference [1], [2]

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Sapphire worm Sat Jan 05:29: (UTC) Infected with Sapphire: 0 Most vulnerable machines was infected with 10-minutes of the worm’s release. Sat Jan 06:30: (UTC) Infected with Sapphire: reference [1], [2]

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Sapphire worm Cause considerable harm simply by overloading networks and taking database servers out of operation. Many individual sites lost connectivity as their access bandwidth was saturated by local copies of the worm. Outbound traffic to external addresses on UDP port Large amount of ICMP Unreachable messages aimed at server systems. SQL resolution service failure. Performance degradation. Scanning.

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Previous works 정보통신망 침해사고 합동조사단 – ‘ 정보통신망 침해사고 조사결과 ’ But, How about Sapphire impact on ‘Internet Routing’ ?

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Routeviews - 1  University of Oregon – Route Views project. Routing information repository for … Analysis of BGP routing table dynamics. Work on routing table growth. Analysis of geographic cope of routing announcements.  Routeviews routers route-views.eqix.routeviews.orgroute-views.isc.routeviews.org route-views.linx.routeviews.orgroute-views.oregon-ix.net route-views.wide.routeviews.orgroute-views2.oregon-ix.net route-views3.routeviews.org reference

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Routeviews - 2 peer list – route-views2.oregon-ix has no Korean peers. reference

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Korean ASes  Korean ASes  8 Major Korean ASes AS4766 KORNETAS3786 DACOM AS9457 DREAMXAS9277 THRUNET AS9318 HANANETAS7563, 9768 PUBNET AS4670, 4664 SHINBIROAS9848 ENTERPRISENET  16 Other Korean ASes AS KANETAS4663 ELIMNET AS10038 FWINetAS17864 HANVITINB AS9695 KITINETAS5051 KOLNET AS9488 KRENAS1237, 7623, KREONET AS9701 KRLINEAS7557 KTNET AS9316 PUBNETPLUSAS9689 QRIXNET AS10171 SKTelinkAS10049 SKNETWORKS AS9644 SKSpeedNetAS6619 SAMSUNGNETWORKS reference NIDA and ISIS

ETRI meeting (Feb 16, 2005) -- Dongkee LEE BGP4MP| |A| |16150 | /22| |IGP| |0|0|3549: : : : : :65321|NAG|| BGP4MP| |A| |16150 | /24| |IGP| |0|0|3549: : : : : :65321|AG| | BGP4MP| |A| |1668 | /24| |IGP| |0|25||NAG|| BGP4MP| |W| |2914| /24 BGP4MP| |W| |2914| /24 BGP4MP| |W| |2914| /23 Announced prefix AS-PATHorigin-AS

ETRI meeting (Feb 16, 2005) -- Dongkee LEE BGP Updates (Announcements and Withdrawals) reference [6]

ETRI meeting (Feb 16, 2005) -- Dongkee LEE BGP (origin) matched Announcements BGP Announcements and Withdrawals are increased during Sapphire impact. reference [6]

ETRI meeting (Feb 16, 2005) -- Dongkee LEE BGP RIB Entries About prefixes are transited by Korean ASes. Number prefixes can be accessed through Korea from abroad.

ETRI meeting (Feb 16, 2005) -- Dongkee LEE BGP RIB Origin matched entries - 1 D1 D2 D3 SE 50 hours S  D104 hours D1  R112 hours R1  D204 hours D2  R202 hours R2  D312 hours R1 R2 16 hours 14 hours

ETRI meeting (Feb 16, 2005) -- Dongkee LEE BGP RIB Origin matched entries - 2

ETRI meeting (Feb 16, 2005) -- Dongkee LEE BGP RIB Origin matched entries - 3

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Korean Top 8 ASes

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Other Korean ASes

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Totally Blackout-ed Korean ASes About 15/213 ASes are totally blackouted during Sapphire/Slammer impact. Stub AS AS P1 Peering session X

ETRI meeting (Feb 16, 2005) -- Dongkee LEE Other Non-Korean ASes Similar phenomenon is also observed from Other Non-Korean ASes D1 D2D3

ETRI meeting (Feb 16, 2005) -- Dongkee LEE During Sapphire/Slammer worm impact, massive increase in the number of BGP updates and decrease in BGP RIB entries is observed. There are 3 unrecognized dipping points in RIB snapshots. ‘D1’ isn’t surprising. But, Why ‘D2’ and ‘D3’ ?

ETRI meeting (Feb 16, 2005) -- Dongkee LEE BGP doesn’t show sufficient statistics, BGP Withdrawals do not contain ‘AS-PATH’, mapping between BGP withdrawals and RIB counts is ambiguous. Routing data of Korea isn’t accessible. Well organized monitoring infra. is needed.

ETRI meeting (Feb 16, 2005) -- Dongkee LEE [1] Analysis of the Sapphire Worm – A joint effort of CAIDA, ICSI, Silicon Defense, UC Berkeley EECS and UCSD CSE [2] CERT Advisory CA MS-SQL Server Worm. [3] Sapphire worm code disassembled – [4] University of Oregon – Route Views Project page – [5] 정보통신망 침해사고 합동조사단, 정보통신망 침해사고 조사결과. [6] RIPE NCC RIS, Sapphire/Slammer Worm Impact on Internet Performance –

ETRI meeting (Feb 16, 2005) -- Dongkee LEE  The END