Mind Your Blocks: On the Stealthiness of Malicious BGP Hijacks

Vervier, Pierre-Antoine; Thonnard, Olivier; Daciér, Marc

doi:10.14722/ndss.2015.23035

Cited by 65 publications

(44 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since suspicious routes are typically short-lived [25], the performance of PG-BGP is usually similar to that of RPKI and ROVER. Therefore, for the purpose of our evaluation, we only simulate the performance of RPKI and ROVER.…”

Section: Hijack Prevention Using Prefix Originmentioning

confidence: 99%

Does scale, size, and locality matter? Evaluation of collaborative BGP security mechanisms

Hiran

Carlsson

Shahmehri

2016

2016 IFIP Networking Conference (IFIP Networking) and Workshops

View full text Add to dashboard Cite

Abstract-The Border Gateway Protocol (BGP) was not designed with security in mind and is vulnerable to many attacks, including prefix/subprefix hijacks, interception attacks, and imposture attacks. Despite many protocols having been proposed to detect or prevent such attacks, no solution has been widely deployed. Yet, the effectiveness of most proposals relies on largescale adoption and cooperation between many large Autonomous Systems (AS). In this paper we use measurement data to evaluate some promising, previously proposed techniques in cases where they are implemented by different subsets of ASes, and answer questions regarding which ASes need to collaborate, the importance of the locality and size of the participating ASes, and how many ASes are needed to achieve good efficiency when different subsets of ASes collaborate. For our evaluation we use topologies and routing information derived from real measurement data. We consider collaborative detection and prevention techniques that use (i) prefix origin information, (ii) route path updates, or (iii) passively collected round-trip time (RTT) information. Our results and answers to the above questions help determine the effectiveness of potential incremental rollouts, incentivized or required by regional legislation, for example. While there are differences between the techniques and two of the three classes see the biggest benefits when detection/prevention is performed close to the source of an attack, the results show that significant gains can be achieved even with only regional collaboration.

show abstract

Section: Hijack Prevention Using Prefix Originmentioning

confidence: 99%

Does scale, size, and locality matter? Evaluation of collaborative BGP security mechanisms

Hiran

Carlsson

Shahmehri

2016

2016 IFIP Networking Conference (IFIP Networking) and Workshops

View full text Add to dashboard Cite

show abstract

“…One-way to hijack IPs is by using BGP hijacking attacks [25]. BGP/IP hijacking is much more common than current researchers think and it is hard to be detected in the form of local BGP hijacking [26,27]. Furthermore, IP-based authentication suffers many other limitations due to current Internet infrastructure including (1) extensive use of NAT, especially the use of Carrier Grade NAT (CGN) or Large Scale NAT (LSN) [28], and (2) complex and inconsistent IP address configuration policies by different ISPs.…”

Section: Related Workmentioning

confidence: 99%

CLAS: A Novel Communications Latency Based Authentication Scheme

Dou

Khalil²,

Khreishah

2017

Security and Communication Networks

View full text Add to dashboard Cite

We design and implement a novel communications latency based authentication scheme, dubbed CLAS, that strengthens the security of state-of-the-art web authentication approaches by leveraging the round trip network communications latency (RTL) between clients and authenticators. In addition to the traditional credentials, CLAS profiles RTL values of clients and uses them to defend against password compromise. The key challenges are (i) to prevent RTL manipulation, (ii) to alleviate network instabilities, and (iii) to address mobile clients. CLAS addresses the first challenge by introducing a novel network architecture, which makes it extremely difficult for attackers to simulate legitimate RTL values. The second challenge is addressed by outlier removal and multiple temporal profiling, while the last challenge is addressed by augmenting CLAS with out-of-band-channels or other authentication schemes. CLAS restricts login to profiled locations while demanding additional information for nonprofiled ones, which highly reduces the attack surface even when the legitimate credentials are compromised. Additionally, unlike many state-ofthe-art authentication mechanisms, CLAS is resilient to phishing, pharming, man-in-the-middle, and social engineering attacks. Furthermore, CLAS is transparent to users and incurs negligible overhead. The experimental results show that CLAS can achieve very low false positive and false negative rates.

show abstract

“…Since suspicious routes are typically short-lived [152], the performance of PG-BGP is usually similar to that of RPKI and ROVER. Therefore, for the purpose of our evaluation, we only simulate the performance of RPKI and ROVER.…”

Section: Collaborative Information Sharingmentioning

confidence: 99%

Collaborative Network Security: Targeting Wide-area Routing and Edge-network Attacks

Hiran

2016

Linköping Studies in Science and Technology. Dissertations

View full text Add to dashboard Cite

To ensure that services can be delivered reliably and continuously over the Internet, it is important that both Internet routes and edge networks are secured. However, the sophistication and distributed nature of many attacks that target wide-area routing and edge networks make it difficult for an individual network, user, or router to detect these attacks. Therefore collaboration is important. Although the benefits of collaboration between different network entities have been demonstrated, many open questions still remain, including how to best design distributed scalable mechanisms to mitigate attacks on the network infrastructure. This thesis makes several contributions that aim to secure the network infrastructure against attacks targeting wide-area routing and edge networks.First, we present a characterization of a controversial large-scale routing anomaly, in which a large Telecom operator hijacked a very large number of Internet routes belonging to other networks. We use publicly available data from the time of the incident to understand what can be learned about large-scale routing anomalies and what type of data should be collected in the future to diagnose and detect such anomalies.Second, we present multiple distributed mechanisms that enable collaboration and information sharing between different network entities that are affected by such attacks. The proposed mechanisms are applied in the contexts of collaborating Autonomous Systems (ASes), users, and servers, and are shown to help raise alerts for various attacks. Using a combination of data-driven analysis and simulations, based on publicly available real network data (including traceroutes, BGP announcements, and network relationship data), we show that our solutions are scalable, incur low communication and processing overhead, and provide attractive tradeoffs between attack detection and false alert rates.Finally, for a set of previously proposed routing security mechanisms, we consider the impact of regional deployment restrictions, the scale of the collaboration, and the size of the participants deploying the solutions. Although regional deployment can be seen as a restriction and the participation of large networks is often desirable, we find interesting cases where regional deployment can yield better results compared to random global deployment, and where smaller networks can play an important role in achieving better security gains. This study offers new insights towards incremental deployment of different classes of routing security mechanisms.This work was supported by the Swedish National Graduate School of Computer Science (CUGS) and the Internet Foundation in Sweden (IIS). iii Populärvetenskaplig sammanfattningInternet och dess tjänsterär mycket exponerade för attacker. Många av de kritiska protokoll och mekanismer som behövs för att leverera tjänsteröver internet designades för flera decennier sedan. Dessa protokoll och mekanismerär starkt beroende av tillit mellan olika nätverkskomponenter, såsom routers och servrar. Den ex...

show abstract

Mind Your Blocks: On the Stealthiness of Malicious BGP Hijacks

Cited by 65 publications

References 28 publications

Does scale, size, and locality matter? Evaluation of collaborative BGP security mechanisms

Does scale, size, and locality matter? Evaluation of collaborative BGP security mechanisms

CLAS: A Novel Communications Latency Based Authentication Scheme

Collaborative Network Security: Targeting Wide-area Routing and Edge-network Attacks

Contact Info

Product

Resources

About