Low-Rate TCP-Targeted DoS Attack Disrupts Internet Routing Ying Zhang Z. Morley Mao Jia Wang Presented in NDSS07 Prepared by : Hale Ismet

The attacks Attacks targeting end hosts Attacks targeting end hosts Denial of Service attacks, worms, spam Denial of Service attacks, worms, spam Attacks targeting the routing infrastructure Attacks targeting the routing infrastructure

Border Gateway Protocol standard inter-domain routing protocol There are two types of BGP sessions: eBGP iBGP sessions. It is former are between routers withindifferent autonomous systems (ASes) or networks AS 2

To ensure liveness of the neighbor in a BGP session, routers periodically exchange keepalive messages C BR AS 1 AS 2 BGP session Transport: TCP connection C BR Keepalive confirm peer liveliness; determine peer reachability BGP HoldTimer expired BGP session reset

Low-rate TCP-targeted DoS attacks minRTO2 x minRTO 4 x minRTO Time TCP congestion window size (segments) Initial window size Attack flow period approximates minRTO of TCP flows

the attacker can indeed bring down the BGP session 1-Burst Length L needs to be long enough to cause congestion 2-Peak magnitude R also needs to be large to cause congestion. 3- Inter-burst period T needs to be minRTO to cause session reset

To effect of this attack on BGP 1. that attack traffic lowers the sending rate of the TCP connection carrying BGP traffic ; this increased convergence 2. the more severe effect on the BGP session is the possibility of BGP session reset caused by all packets dropped within a time interval exceeding the hold timer value.

Testbed experiments the high-end Cisco router GSR (It is widely used in Internet and is very powerful ) the high-end Cisco router GSR (It is widely used in Internet and is very powerful ) Demonstrating the attack feasibility by two computers Demonstrating the attack feasibility by two computers

UDP-based attack flow Attacker A Receiver B Router R1 C BR Router R2 C BR minRTO 2*minRTO 7 th retransmitted BGP Keepalive message BGP Session Reset Take 3 min

Kind of routers

the probability of session reset. the burst length of 225 msec, the attacker has around 30% probability to reset the session with 42% available bandwidth the burst length of 225 msec, the attacker has around 30% probability to reset the session with 42% available bandwidth

Attack peak magnitude’s impact on session reset and table transfer duration

Necessary conditions for single attack Inter-burst period approximates minRTO Inter-burst period approximates minRTO The attack flow’s path traverses at least one link of the BGP session The attack flow’s path traverses at least one link of the BGP session Attack flow’s bottleneck link is the target link Attack flow’s bottleneck link is the target link

bring down the BGP session To avoid sending too much traffic from each node, we perform time synchronization designed

Conditions for Coordinated attacks 1’. Sufficiently strong combined attack flows to cause congestion 1’. Sufficiently strong combined attack flows to cause congestion 2. The attack flow’s path traverses the BGP session 2. The attack flow’s path traverses the BGP session 3’. Identify the target link location 3’. Identify the target link location

Attack prevention hiding information hiding information -Kuzmanovic03 :Randomize minRTO -Hide network topology from end-hosts.  prioritize routing traffic Weighted Random Early Detection (WRED) [It is a mechanism ] Weighted Random Early Detection (WRED) [It is a mechanism ] Prevent TCP synchronization Prevent TCP synchronization Selectively drop packets : Drop low-priority packets first when the queue size exceeds defined thresholds Selectively drop packets : Drop low-priority packets first when the queue size exceeds defined thresholds ** WRED relies on the IP precedence field in the packet header

BGP table transfer with WRED enabled under attack

Conclusion Feasibility of attacks against Internet routing infrastructure Feasibility of attacks against Internet routing infrastructure Prevention solution using existing router configurations Prevention solution using existing router configurations Difficulties in detecting and defending against coordinated attacks Difficulties in detecting and defending against coordinated attacks

Thanks Any Questions? Any Questions? Attacker A Receiver B BGP Session Reset