Internet Infrastructure

Size: px

Start display at page:

Download "Internet Infrastructure"

Juliet Fitzgerald
6 years ago
Views:

1 Internet Infrastructure

2 Internet Infrastructure Local and inter-domain routing TCP/IP for routing and messaging BGP for routing announcements Domain Name System Find IP address from symbolic name (

A network that peers some of its network access and purchases some of it. 3.

3 3 2 1 Level: Tier One Tier Two Tier Three Infrastructure Quiz Match the level to its description Descriptions: 1. A network that purchases all transit from other networks. 2. A network that peers some of its network access and purchases some of it. 3. A network can reach every other network through peering. Peering: ISPs connect their networks together. Traffic is allowed to flow across a network in exchange for free access to other networks

4 Infrastructure Quiz NAME AT&T Cogent Communications CenturyLink Deutsche Telekom AG KPN International Level 3 Communications NTT Communications (America) Orange Sprint Tata Communications (America) Telecom Italia Sparkle Telefonica Global Solutions Telia Carrier Verizon Enterprise Solutions Zayo Group -----

5 TCP Protocol Stack Application Transport Application Protocol TCP Protocol Application Transport Network IP Protocol IP IP Protocol Network Link Data Link Network Access Data Link Link

6 TCP Protocol Stack: Data Formats TCP Header Application Transport (TCP,UDP) Network(IP) Message Segment Packet Application message - data TCP data TCP data TCP data IP TCP data Link Layer Frame IP Header EIT IP TCP data ETF Link (Ethernet) Header Link (Ethernet) Trailer

Address of Originating Host Destination Address of Target Host Options Padding IP

7 Internet Protocol: IP Routing Version Header Length Type of Service Total Length Identification Flags Fragment Offset Time to Live Protocol Header Checksum Source Address of Originating Host Destination Address of Target Host Options Padding IP Data Connectionless Unreliable Best effort Notes: src and dest ports not parts of IP hdr

Internet Protocol: IP Routing Alice PACKET Source 121.42.

8 Internet Protocol: IP Routing Alice PACKET Source Destination Office gateway Bob ISP Typical route uses several hops IP: no ordering or delivery guarantees

know route to other networks Fragmentation and

9 IP Protocol Functions (Summary) Routing IP host knows location of router (gateway) IP gateway must know route to other networks Fragmentation and reassembly If max-packet-size less than the user-data-size

10 IP Protocol Functions (Summary) Error reporting ICMP packet to source if packet is dropped TTL field: decremented after every hop Packet dropped if TTL=0. Prevents infinite loops.

11 IP Quiz Select all the true statements about Internet Protocol (IP). IP is a connectionless and reliable protocol. IP provides only best effort delivery, it is not guaranteed. Due the connectionless nature of IP, data corruption, packet loss, duplication, and out-of-order delivery can occur.

IP Authentication Client is trusted to embed correct source IP Easy to override using raw sockets Libnet: a library for formatting raw packets with arbitrary IP

12 IP Authentication Client is trusted to embed correct source IP Easy to override using raw sockets Libnet: a library for formatting raw packets with arbitrary IP headers The problem: No Source IP authentication Anyone who owns their machine can send packets with arbitrary source IP, and a response will be sent back to forged source IP

13 IP Authentication Client is trusted to embed correct source IP Easy to override using raw sockets Libnet: a library for formatting raw packets with arbitrary IP headers The problem: No Source IP authentication Implications: Anonymous DoS attacks; Anonymous infection/malware attacks

14 Transmission Control Protocol Connection-oriented, preserves order Book

15 Transmission Control Protocol Sender : Break data into packets Attach packet numbers Book Mail each page

16 Transmission Control Protocol Receiver: Acknowledge receipt; lost packets are resent Reassemble packets in correct order Book Mail each page Reassembled Book

17 Transmission Control Protocol TCP Header Source port Dest port ver hlen TOS Pkt len Identification flg fragment offset TTL protocol header checksum Source IP address Destination IP address IP Header U R G SEQ Number ACK Number A P P S C S S Y K H R N Other Stuff F I N TCP Header

18 Review TCP Handshake C S Received packets with SN too far out of window are dropped SYN: SYN/ACK: ACK: SN C rand C AN C 0 SN S rand S AN S SN C +1 SN C SN C +1 AN C SN S +1 Listening Store SN C, SN S Wait Established

19 TCP Basic Security Problems 1 Network packets pass by untrusted hosts Eavesdropping, packet sniffing Especially easy when attacker controls a machine close to victim (e.g. WiFi routers) 2 TCP state easily obtained by eavesdropping Enables spoofing and session hijacking 3 Denial of Service (DoS) vulnerabilities See DDoS lesson

IP information cannot be protected by transport layer controls.

20 TCP IP Security Issues Quiz Select all the true statements: Application layer controls can protect application data, and IP addresses. IP information cannot be protected by transport layer controls. Network layer controls can protect the data within the packets as well as the IP information for each packet. Data link layer controls can protect connections comprised of multiple links

session on behalf of forged source IP Breaks IP-based

21 Random Initial Sequence Numbers Suppose initial seq. numbers (SN C, SN S ) are predictable: Attacker can create TCP session on behalf of forged source IP Breaks IP-based authentication (e.g. SPF, /etc/hosts ) Random seq. num. do not prevent attack, but make it harder

22 Random Initial Sequence Numbers TCP SYN srcip=victim Victim Attacker ACK srcip=victim AN=predicted SN S +1 Command SYN/ACK dstip=victim SN=server SN S Server thinks command is from victim IP addr

23 Example DoS Vulnerability: Reset Attacker sends a Reset packet on an open socket If correct SN S then connection will close DoS Naively, success prob. is 1/232 (32-bit seq. # s). but, many systems allow for a large window of acceptable seq. # s. Much higher success probability. Attacker can flood with RST packets until one works

24 Protocols Quiz Match the protocol with its description: B C A Protocol: Address Resolution Protocol (ARP) Open Shortest Path First (OSPF) Border Gateway Protocol (BGP) Descriptions: A. protocol designed to exchange routing and reachability information among autonomous systems (AS) B. protocol designed to map IP network addresses to the hardware addresses used by a data link protocol C. protocol uses a link state routing algorithm and falls into the group of interior routing protocols

25 Protocols Quiz ARP request message sent out IP: IP: Router or Host IP:

26 Protocols Quiz IP: Router or Host ARP reply IP: IP:

27 Protocols Quiz R1 R2 R3 R4 R5

28 Protocols Quiz Router A Router B AS 200 AS 100 AS 300 Router C

29 Routing Security: Interdomain Routing Earthlnk.net Gatech.edu BGP OSPF Autonomous System Connected group of one or more Internet Protocol prefixes under a single routing policy (aka domain)

30 Routing Protocols ARP (addr resolution protocol): IP addr eth addr Security issues: (local network attacks) Node A can confuse gateway into sending it traffic for Node B By proxying traffic, node A can read/inject packets into B s session (e.g. WiFi networks)

31 Routing Protocols BGP: routing between Autonomous Systems Security issues: unauthenticated route updates Anyone can cause entire Internet to send traffic for a victim IP to attacker s address Example: Youtube-Pakistan mishap Anyone can hijack route to victim

32 BGP [D. Wetherall]

33 BGP: Security Issues BGP path attestations are un-authenticated Anyone can inject advertisements for arbitrary routes Advertisement will propagate everywhere Used for DoS, spam, and eavesdropping (details in DDoS lecture)

34 BGP: Example path hijack Normally: Alestra (Mexico) PCCW (Texas) Qwest (DC) Feb 2013: Guadalajara Washington DC via Belarus Person browsing the Web in DC cannot tell by traceroute that HTTP Responses are routed through Moscow

35 BGP Attacks Quiz Match the attack to its characteristic: D E C B A Denial of Service Sniffing Attack: Routing to Endpoints in Malicious Networks Creating Route Instabilities Revelation of Network Topologies Characteristic: A. Unmasking the AS relationships by hacking the routing table. B. Not yet used by hackers because damage cannot be contained. It can blowback to the attacker. C. The first step is to hijack traffic from a legitimate host. D. Create a false route or kill a legitimate one. E. The attacker must control a device along the victim s communication path.

36 BGP: Security Issues Solutions: RPKI: AS obtains a certificate (ROA) from regional authority (RIR) and attaches ROA to path advertisement. Advertisements without a valid ROA are ignored. Defends against a malicious AS (but not a network attacker) SBGP: sign every hop of a path advertisement

37 S-BGP Design Overview IPsec: secure point-to-point router communication Public Key Infrastructure: authorization for all S-BGP entities Attestations: digitally-signed authorizations Address: authorization to advertise specified address blocks Route: Validation of UPDATEs based on a new path attribute, using PKI certificates and attestations

38 S-BGP Design Overview Repositories for distribution of certificates, CRLs, and address attestations Tools for ISPs to manage address attestations, process certificates & CRLs, etc.

39 S-BGP Design Overview AS Host1 Host2 Hostn Address blocks

40 S-BGP Overview: Address Attestation Indicates that the final AS listed in the UPDATE is authorized by the owner of those address blocks Includes identification of: owner s certificate AS to be advertising the address blocks address blocks expiration date

41 S-BGP Overview: Address Attestation Digitally signed by owner of the address blocks Used to protect BGP from erroneous UPDATEs (authenticated but misbehaving or misconfigured BGP speakers)

42 S-BGP Overview: Route Attestation Indicates that the speaker or its AS authorizes the listener s AS to use the route in the UPDATE Includes identification of: AS s or BGP speaker s certificate issued by owner of the AS the address blocks and the list of ASes in the UPDATE the neighbor expiration date

43 S-BGP Overview: Route Attestation Digitally signed by owner of the AS (or BGP speaker) distributing the UPDATE, traceable to the IANA Used to protect BGP from erroneous UPDATEs (authenticated but misbehaving or misconfigured BGP speakers)

44 S-BGP Overview: Route Attestation To validate a route from AS n, AS n+1 needs: address attestation from each organization owning an address block(s) in the NLRI address allocation certificate from each organization owning address blocks in the NLRI route attestation from every AS along the path (AS 1 to AS n ), where the route attestation for AS k specifies the NLRI and the path up to that point (AS 1 through As k-1 ) certificate for each AS or router along path (AS 1 to AS n ) to check signatures on the route attestations all the relevant CRLs must have been checked

Lecture 6. Internet Security: How the Internet works and some basic vulnerabilities. Thursday 19/11/2015

Lecture 6. Internet Security: How the Internet works and some basic vulnerabilities. Thursday 19/11/2015 Lecture 6 Internet Security: How the Internet works and some basic vulnerabilities Thursday 19/11/2015 Agenda Internet Infrastructure: Review Basic Security Problems Security Issues in Routing Internet