A Study of Prefix Hijacking and Interception in the internet - - PowerPoint PPT Presentation

▶
a study of prefix hijacking and interception in the
SMART_READER_LITE
LIVE PREVIEW

A Study of Prefix Hijacking and Interception in the internet - - PowerPoint PPT Presentation

Mar 19, 2023 474 likes •873 views

A Study of Prefix Hijacking and Interception in the internet Hitesh Ballani, Paul Francis, Xinyang Zhang Presented by: Tony Z.C Huang, Adapted from slides by Hitesh Ballani Prefix Hijacking/ Interception Internet AS CIA AS U Owning

slide-1
SLIDE 1

A Study of Prefix Hijacking and Interception in the internet

Hitesh Ballani, Paul Francis, Xinyang Zhang Presented by: Tony Z.C Huang, Adapted from slides by Hitesh Ballani

slide-2
SLIDE 2

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U Owning Prefix p

slide-3
SLIDE 3

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U Owning Prefix p

slide-4
SLIDE 4

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U Owning Prefix p

slide-5
SLIDE 5

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U

  • Prefix ¡Hijacking:AS ¡CIA ¡

adver8ses ¡a ¡prefix ¡

  • wned ¡by ¡AS ¡U.
  • Creates ¡a ¡black-­‑

hole ¡in ¡the ¡internet

Owning Prefix p

slide-6
SLIDE 6

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U

  • Prefix ¡Hijacking:AS ¡CIA ¡

adver8ses ¡a ¡prefix ¡

  • wned ¡by ¡AS ¡U.
  • Creates ¡a ¡black-­‑

hole ¡in ¡the ¡internet

Owning Prefix p

slide-7
SLIDE 7

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U

  • Prefix ¡Hijacking:AS ¡CIA ¡

adver8ses ¡a ¡prefix ¡

  • wned ¡by ¡AS ¡U.
  • Creates ¡a ¡black-­‑

hole ¡in ¡the ¡internet

Owning Prefix p You can route to AS U through me

slide-8
SLIDE 8

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U

  • Prefix ¡Hijacking:AS ¡CIA ¡

adver8ses ¡a ¡prefix ¡

  • wned ¡by ¡AS ¡U.
  • Creates ¡a ¡black-­‑

hole ¡in ¡the ¡internet

Owning Prefix p You can route to AS U through me

slide-9
SLIDE 9

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U

  • Prefix ¡Hijacking:AS ¡CIA ¡

adver8ses ¡a ¡prefix ¡

  • wned ¡by ¡AS ¡U.
  • Creates ¡a ¡black-­‑

hole ¡in ¡the ¡internet

Owning Prefix p You can route to AS U through me

slide-10
SLIDE 10

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U

  • Prefix ¡Hijacking:AS ¡CIA ¡

adver8ses ¡a ¡prefix ¡

  • wned ¡by ¡AS ¡U.
  • Creates ¡a ¡black-­‑

hole ¡in ¡the ¡internet

Owning Prefix p

  • Prefix ¡Intercep8on:AS ¡

CIA ¡routes ¡the ¡ intercepted ¡traffic ¡back ¡ to ¡AS ¡U

  • AS ¡U ¡would ¡not ¡find ¡
  • ut ¡the ¡traffic ¡has ¡

been ¡intercepted.

You can route to AS U through me

slide-11
SLIDE 11

Prefix Hijacking/ Interception

AS ¡CIA

Internet

AS ¡U

  • Prefix ¡Hijacking:AS ¡CIA ¡

adver8ses ¡a ¡prefix ¡

  • wned ¡by ¡AS ¡U.
  • Creates ¡a ¡black-­‑

hole ¡in ¡the ¡internet

Owning Prefix p

  • Prefix ¡Intercep8on:AS ¡

CIA ¡routes ¡the ¡ intercepted ¡traffic ¡back ¡ to ¡AS ¡U

  • AS ¡U ¡would ¡not ¡find ¡
  • ut ¡the ¡traffic ¡has ¡

been ¡intercepted.

You can route to AS U through me

slide-12
SLIDE 12

Focus of the paper

  • 1) Analyze the probability of traffic hijacking/

Interception.

  • 2) Use routing tables from Route-Views, estimate

the actual probability that an AS can hijack/ intercept traffics from other ASes.

  • 3) Implement interception methodology and

intercept real traffic.

  • 4) Try to detect actual interception in the

internet.

slide-13
SLIDE 13

Hijacking Analysis

AS ¡CIA AS ¡Z AS ¡U AS ¡B AS ¡al-­‑ Qaeda AS ¡C

  • wner of prefix p

AS-PATH = [... A] AS- PATH = [B, ... ,A] AS-PATH = [C, B, ... ,A] AS-PATH = [... , CIA] AS-PATH = [Z, ... CIA]

  • Question: Can CIA hijacks prefix p’s traffic from AS al-Qaeda?
  • AS U Needs to choose between two routes
  • Valid routes: AS-Path = [C,B,... A], length = n;
  • Invalid routes: AS-Path = [Z, ... CIA], length = i;
  • Assumption: AS U has typical policies:
  • customer routes > peer routes > provider routes
slide-14
SLIDE 14

AS ¡CIA AS ¡Z AS ¡U AS ¡B AS ¡al-­‑ Daeda AS ¡C

  • wner of prefix p

AS-PATH = [... A] AS- PATH = [B, ... ,A] AS-PATH = [B, C, ... ,A] AS-PATH = [... , CIA] AS-PATH = [Z, ... CIA]

Length Customer Peer Provider Customer Customer Customer Peer Peer Peer Provider Provider Provider

i<n X X X i=n

  • X

X i>n Y X X i<n Y X X i=n Y

  • X

i>n Y Y X i<n Y Y X i=n Y Y

  • i>n

Y Y Y

  • X: The traffic can not be hijacked.
  • Y: The traffic can be hijacked.
slide-15
SLIDE 15

Discussion

slide-16
SLIDE 16

Discussion

  • Better way to hijack the traffic?
slide-17
SLIDE 17

Discussion

  • Better way to hijack the traffic?
  • Yes, by announcing a more specific prefix.
slide-18
SLIDE 18

Discussion

  • Better way to hijack the traffic?
  • Yes, by announcing a more specific prefix.
  • But in practice, BGP filter out prefixes

more specific than /24. So analysis in this paper is still useful.

slide-19
SLIDE 19

Interception Analysis

  • The problem is routing the traffic back to the original As.
  • The problem is, if AS CIA’s existing routes also switches

to the invalid routes, then AS CIA can not route the traffic back to AS al-Qaeda.

  • Safety Condition: AS CIA should have a valid route for

prefix p during the Interception.

AS ¡CIA AS ¡Z AS ¡U AS ¡B AS ¡al-­‑ Qaeda AS ¡C

  • wner of prefix p
slide-20
SLIDE 20

Interception Analysis

  • The problem is routing the traffic back to the original As.
  • The problem is, if AS CIA’s existing routes also switches

to the invalid routes, then AS CIA can not route the traffic back to AS al-Qaeda.

  • Safety Condition: AS CIA should have a valid route for

prefix p during the Interception.

AS ¡CIA AS ¡Z AS ¡U AS ¡B AS ¡al-­‑ Qaeda AS ¡C

  • wner of prefix p

Some ¡Ases...

slide-21
SLIDE 21

Interception Analysis

  • Two assumptions
  • customer routes > peer routes >

provider routes

  • “Valley-free” property

i.e, after traversing a provider-to- customer edge or a peer edge, the path cannot traverse another customer-to- prover or peer edge.

slide-22
SLIDE 22

Interception Analysis

  • Case 1, AS CIA’s

current route is a customer routes. Namely, AS al- Qaeda is a customer of AS- CIA.

  • Conclusion: AS-

CIA can advertise the invalid route to all its neighbors, and still satisfies the safety condition.

AS ¡CIA AS ¡Z AS ¡al-­‑ Qaeda Customer-to-Provider edge Peer edge

slide-23
SLIDE 23

Interception Analysis

  • Case 1, AS CIA’s

current route is a customer routes. Namely, AS al- Qaeda is a customer of AS- CIA.

  • Conclusion: AS-

CIA can advertise the invalid route to all its neighbors, and still satisfies the safety condition.

AS ¡CIA AS ¡Z AS ¡al-­‑ Qaeda Customer-to-Provider edge Peer edge

slide-24
SLIDE 24

Interception Analysis

  • Case II, AS CIA’s

current route is a peer routes. Namely, AS al- Qaeda is a peer of AS-CIA.

  • Conclusion:

Similar to Case I, AS CIA can propagate to any

  • f the ASes along

the path without violating the safety condition.

AS ¡CIA AS ¡Z1 Customer-to-Provider edge Peer edge AS ¡al-­‑ Qaeda AS ¡Z

slide-25
SLIDE 25

Interception Analysis

  • Case II, AS CIA’s

current route is a peer routes. Namely, AS al- Qaeda is a peer of AS-CIA.

  • Conclusion:

Similar to Case I, AS CIA can propagate to any

  • f the ASes along

the path without violating the safety condition.

AS ¡CIA AS ¡Z1 Customer-to-Provider edge Peer edge AS ¡al-­‑ Qaeda AS ¡Z

slide-26
SLIDE 26

Interception Analysis

  • Case III, AS

CIA’s current route is a provider routes.

  • Conclusion: AS

CIA can only advertises the path to its customer and peers, but not to its provider.

AS ¡CIA Customer-to-Provider edge Peer edge AS ¡Z2 AS ¡Z1 AS ¡Z AS ¡al-­‑ Qaeda

slide-27
SLIDE 27

Interception Analysis

  • Case III, AS

CIA’s current route is a provider routes.

  • Conclusion: AS

CIA can only advertises the path to its customer and peers, but not to its provider.

AS ¡CIA Customer-to-Provider edge Peer edge AS ¡Z2 AS ¡Z1 AS ¡Z AS ¡al-­‑ Qaeda

slide-28
SLIDE 28

Hijacking/Interception Estimate

  • Analysis results applied to Route-Views ASes
  • Route-view repository comprised of 34 ASes (RV-

Set)

  • 7 tier-1 ASes, 19 tier-2, 8 others.
  • Parameter of Interest
  • Probability of Hijacking: Fraction of ASes whose

traffic is hijacked by the hijacking AS, averaged across all ASes and all prefixes.

  • Probability of Interception is defined similarly.
slide-29
SLIDE 29

20 40 60 80 100 T>=3 T-2 T-1 All Probability (%) Type of Intercepting AS Hijacking (LB) Hijacking (UB) Interception (LB) Interception (UB) 20 40 60 80 100 T>=3 T-2 T-1 All Probability (%) Type of Intercepting AS Hijacking (LB) Hijacking (UB) Interception (LB) Interception (UB)

slide-30
SLIDE 30

20 40 60 80 100 T>=3 T-2 T-1 All Probability (%) Type of Intercepting AS Hijacking (LB) Hijacking (UB) Interception (LB) Interception (UB) 20 40 60 80 100 T>=3 T-2 T-1 All Probability (%) Type of Intercepting AS Hijacking (LB) Hijacking (UB) Interception (LB) Interception (UB)

  • Probability of hijacking ~ 40-60%
  • Probability of interception ~ 30-50%
slide-31
SLIDE 31

20 40 60 80 100 T>=3 T-2 T-1 All Probability (%) Type of Intercepting AS Hijacking (LB) Hijacking (UB) Interception (LB) Interception (UB) 20 40 60 80 100 T>=3 T-2 T-1 All Probability (%) Type of Intercepting AS Hijacking (LB) Hijacking (UB) Interception (LB) Interception (UB)

  • Probability of hijacking for tier-1 ISPs ~ 50-80%
  • Probability of interception for tier-1 ISPs ~ 50-80%
slide-32
SLIDE 32

20 40 60 80 100 T>=3 T-2 T-1 All Probability (%) Type of Intercepting AS Hijacking (LB) Hijacking (UB) Interception (LB) Interception (UB) 20 40 60 80 100 T>=3 T-2 T-1 All Probability (%) Type of Intercepting AS Hijacking (LB) Hijacking (UB) Interception (LB) Interception (UB)

slide-33
SLIDE 33

Hijacking/Interception Real Traffic

Internet

WCG ATT NTT

  • Hijacking

Experiment: Have

  • ne of the server

acts as owner of the prefix, and

  • ther 4 servers try

to hijack the traffic.

  • Interception

Experiment: Have two of the servers intercepts the traffic and routes the traffic back to the

  • wner using the
  • ther two server.

Berkeley

Pittsburgh Seattle Ithaca Otemachi

slide-34
SLIDE 34

Ber Pit Sea Ith Ote % of traffic % of traffic Hijacked Intercepted O ! ! " " 91.7 78.8 ! O ! " " 68.8 67.5 ! ! O " " 97.4 66.2 ! ! ! O " 66.0 47.3 " " " ! O 76.1 23.4 O

: Site owning the prefix

!

: Site not advertising an invalid route during interception

"

: Site advertising an invalid route during interception

slide-35
SLIDE 35

Discussion

slide-36
SLIDE 36

Discussion

  • Is prefix-hijack preventable under the current

internet architecture?

slide-37
SLIDE 37

Discussion

  • Is prefix-hijack preventable under the current

internet architecture?

  • Generally, is prefix-hijack preventable under a

fully distributed architecture? How about centralized/semi-centralized architecture?

slide-38
SLIDE 38

Discussion

  • Is prefix-hijack preventable under the current

internet architecture?

  • Generally, is prefix-hijack preventable under a

fully distributed architecture? How about centralized/semi-centralized architecture?

  • Among all the new architecture we have seen

(NIRA, Pathlet, MINT, DONA), which one will help defend against prefix-hijacking? which one will make it worse? Makes no differences?