1. Tracking and Tracing Cyber-Attacks
Howard F. Lipson, Ph.D.
CERT® Coordination Center

2. Outline Problem with Internet Security
Shortfalls in the Current Internet Environment
Near-Term Solutions
Long-Term Solutions
Next-Generation Internet Protocol

3. Problem with Internet Security (1)

4. Problem with Internet Security (2)

5. Shortfalls in the Current Internet Environment (1)
The Internet was never designed for tracking and tracing user behavior.
Functionality and performance are focused.
The Internet was not designed to resist highly untrustworthy users.
Only external attack is considered.
A packet’s source address is untrustworthy, which severely hinders tracking
IP-spoofed and intermediate nodes techniques are used.

6. Shortfalls in the Current Internet Environment (2)
The current threat environment far exceeds the Internet’s design parameters.
There are more high-stake Internet applications.
The expertise of the average system administrator continues to decline.
Attacks often cross multiple administrative, jurisdictional, and national boundaries.

7. Shortfalls in the Current Internet Environment (3)
High-speed traffic hinders tracking.
Tunnels impede tracking.
Hackers destroy logs and other audit data.
Anonymizers protect privacy by impeding tracking
The ability to link specific users to specific IP addresses is being lost.
Purely defensive approaches will fail, so deterrence through tracking and tracing is crucial.

8. Near-Term Solutions (1) Hop-by-Hop IP Traceback
victim
attacker Or
edge router
ISP security broker
Labor-intensive
For tracing large packet flows with spoofed source addresses
DDoS attacks are extremely difficult to trace via this process

9. Near-Term Solutions (2) CenterTrack
Optimizing the Hop-by-Hop IP traceback
Steps
Create an overlay network (IP tunneling)
In the event of a DoS attacks, the ISP diverts the flow of attack packets from the existing ISP network onto overlay tracking network
The attack packets can now be easily traced back, hop-by-hop, through the overlay network

10. Near-Term Solutions (3) Ingress Filtering or Egress Filtering
Network Ingress Filtering
Discard all packets that contain source IP addresses that do not match the valid range of the customer’s known IP addresses.
Network egress Filtering
Corporate network administrator
IETF
Internet Best current Practices for the Internet Community

11. Near-Term Solutions (4) Backscatter Traceback
Steps
The attack is reported to an ISP
The ISP configures all its router to reject all packets destined for the victim
Rejected packets are “returned to sender”
The ISP configures all of its router to blackhole many of the ICMP error packet with illegitimate destination IP address
Analysis by the blackhole machine quickly traces the attack to one or more routers at the outermost boundary of the ISP’s network
The ISP removes the filter blocking the victim’s IP address from all router except those serving as the entry points for the DDoS attack
The ISP asks neighboring ISPs, upstream of the attack, to continue the trace

13. Near-Term Solutions (5) Probabilistic Approaches
ICMP Traceback
ICMP traceback message
Probabilistic Packet Marking
IP header

14. Near-Term Solutions (6) Single-Packet IP Traceback
In theory
Keeping a log at each router in the Internet
Tamper-proof
Fully-authenticated
Technical infeasibility
Storage
Privacy
Hash-Based IP Traceback
Packet digests
Reduce storage requirement to 0.5% of the link capacity per unit of time and help privacy
Issues
Computational resources
Transformation information (Fragmentation, tunneling) corresponding to the packet digests is store in a transformation lookup table

15. Long-Term Solutions (1) Issues of Next-Generation Internet Protocol
Next-generation Internet protocols will be required to deal with trust not on a binary basis.
Entry-point anonymity refer the in ability to link an Internet IP address to any human actor or organization.
Can next-generation protocols be designed so as to increase the cost to the attacker and decrease the cost to the defender?
Supporting vigilant resource consumption.
Supporting marketplace negotiation of trust versus privacy trade-offs (trust broker).
Next-generation Internet protocols must allow for variable levels of trust under various attack states (situation-sensitive).
Sufficient header space for tracking information.

16. Long-Term Solutions (2) Emerging Next-Generation Security Protocols
Internet Protocol Security (IPSec)
Characteristics
AH (Authentication Header)
ESP (Encapsulating Security Payload)
IKE (Internet Key Exchange)
Shortfalls
Vigilant resource consumption
Fine-grained authentication of trust
Situation-sensitive
Internet Protocol Version 6 (IPv6)
IP address is 128 bits long.
IPSec built in.
Flexible header structure
Address space is enormous