An Internet-Scale Feasibility Study of BGP Poisoning Jared M . - - PowerPoint PPT Presentation

▶
an internet scale feasibility study of bgp poisoning
SMART_READER_LITE
LIVE PREVIEW

An Internet-Scale Feasibility Study of BGP Poisoning Jared M . - - PowerPoint PPT Presentation

Sep 17, 2023 143 likes •534 views

An Internet-Scale Feasibility Study of BGP Poisoning Jared M . Smith, Kyle Birkeland, Tyler McDaniel, Max Schuchard AIMS 2019, 4/16/18 jms@vols.utk.edu Full Paper: https://tiny.utk.edu/bgp BGP Poisoning Conflicting research, not actively

slide-1
SLIDE 1

Full Paper: https://tiny.utk.edu/bgp

An Internet-Scale Feasibility Study of BGP Poisoning

Jared M. Smith, Kyle Birkeland, Tyler McDaniel, Max Schuchard AIMS 2019, 4/16/18 jms@vols.utk.edu

slide-2
SLIDE 2

Full Paper: https://tiny.utk.edu/bgp

BGP Poisoning

  • Conflicting research, not actively measured:
  • Smith et al. Nyx (S&P ‘18) vs. Feasible Nyx Tran et al. (S&P ‘19)
  • Schuchard et al. RAD (CCS ‘12) vs. Nasr et al. Waterfall of Decoys (CCS’ 17)
  • Existing research, limited measurements:
  • Anwar et al. Interdomain Policies (IMC ‘15)
  • Katz-Basset et al. LIFEGUARD (SIGCOMM ’12)
  • Existing research, dated measurements:
  • Bush et al. Internet Optometry (IMC ‘09)
  • Specifications versus reality
  • BGP RFC best practices doc recommends filtering over 50 AS-path length
  • Community forums and BGP observations show paths over 50
slide-3
SLIDE 3

We aim to resolve these issues, highlight discrepancies, evaluate accuracy of BGP simulation/emulation, and inspire future BGP poisoning work, with active measurements and analysis.

slide-4
SLIDE 4

Full Paper: https://tiny.utk.edu/bgp

Detour Path Discovery System

  • Executes BGP Poisoning for

arbitrary steered AS

  • Can be executed from any BGP

router for specified prefix

  • Entirely done with software
  • Coordinated through globally

distributed infrastructure

Our Approach

slide-5
SLIDE 5

Full Paper: https://tiny.utk.edu/bgp

Infrastructure

Infrastructure Source 5 BGP routers PEERING and UT 8 IP prefixes PEERING and UT 5,000+ distinct vantage points RIPE ATLAS 3 countries US, Amsterdam, Brazil 32 BGP collectors CAIDA BGPStream*

*Collects BGP Updates from RouteViews and RIPE RIS

slide-6
SLIDE 6

In total, we measure 1,460 instances of BGP poisoning across 3% of ASes on the Internet.

(Largest BGP Poisoning sample size in any existing literature)

slide-7
SLIDE 7

Full Paper: https://tiny.utk.edu/bgp

Active Measurements

  • Ability to re-route across entire original AS-path
  • Real-world comparison with prior simulations
  • Predicting who can re-route w/ BGP poisoning
  • Filtering of poisoned routes
  • Routing Working Groups behavior
  • Default route prevalence
  • Reachability of /25’s
slide-8
SLIDE 8

BACKGROUND

slide-9
SLIDE 9

1

2 3 4

Victim AS Critical AS

BGP Poisoning

slide-10
SLIDE 10

1

2 4

Victim AS Critical AS

BGP Poisoning

3

slide-11
SLIDE 11

1

2 3 4 Prefer 2 over 4

Victim AS Critical AS

BGP Poisoning

slide-12
SLIDE 12

1

2 3 4 Prefer 2 over 4 Want to Avoid

Victim AS Critical AS

BGP Poisoning

slide-13
SLIDE 13

1

2 3 4 Prefer 2 over 4

AS Path: 1, 2, 1

Victim AS Critical AS

BGP Poisoning

slide-14
SLIDE 14

1

2 3 4 Prefer 2 over 4

AS Path: 1, 2, 1 AS Path: 4, 1, 2, 1

Victim AS Critical AS

BGP Poisoning

slide-15
SLIDE 15

1

2 3 4

AS Path: 1, 2, 1 AS Path: 4, 1, 2, 1 LOOP! *dropping*

Prefer 2 over 4

Victim AS Critical AS

BGP Poisoning

slide-16
SLIDE 16

1

2 3 4

AS Path: 1, 2, 1 AS Path: 4, 1, 2, 1 LOOP! *dropping*

Victim AS Critical AS

BGP Poisoning

slide-17
SLIDE 17

1

2 3 4

AS Path: 1, 2, 1 AS Path: 4, 1, 2, 1 LOOP! *dropping*

Victim AS Critical AS

BGP Poisoning

Now prefers 4 over 2

slide-18
SLIDE 18

1

2 3 4

AS Path: 1, 2, 1 AS Path: 4, 1, 2, 1 LOOP! *dropping*

Now prefers 4 over 2

Victim AS Critical AS

Works with normal BGP and no assistance needed from providers!

BGP Poisoning

slide-19
SLIDE 19

IS IT FEASIBLE?

slide-20
SLIDE 20

How well can we re-route?

slide-21
SLIDE 21

How performant are FRRP paths?

slide-22
SLIDE 22

Emulation of BGP Poisoning vs. Practice

20+%

slide-23
SLIDE 23

Graph-Theoretic Analysis of Return Paths

  • Avg. Betweenness of 0.667
  • Paths are not completely identical
  • There is some diversity, but

bottlenecks exist

  • Low min. cut means

bottlenecks that Nyx/RAD cannot avoid

  • For 90% of links, a bottleneck
  • f at most 2 links occurs
  • Tier 1 ASes with inf. weight à

bottlenecks not result of single unavoidable provider

  • Within unweighted min cut à

widely differing barriers to cut based on bandwidth

slide-24
SLIDE 24

WHO CAN RE-ROUTE?

slide-25
SLIDE 25

How well can we predict success with FRRP?

slide-26
SLIDE 26

What link and AS properties are important for FRRP?

slide-27
SLIDE 27

A Deeper Look at the Most Important Feature

Poisoning AS Next-Hop AS Rank High Rank Matters

slide-28
SLIDE 28

HOW MUCH CAN WE POISON?

slide-29
SLIDE 29

How long can poisoned paths be?

~75%

slide-30
SLIDE 30

WHO FILTERS POISONS?

slide-31
SLIDE 31

Filtering by Large ISPs

Large window

slide-32
SLIDE 32

Filtering by Small ISPs + Stubs

Small window

slide-33
SLIDE 33

Do the Policy Leaders “Walk the Walk”?

“Mutually Agreed Norms for Routing Security” Selected Participants (total=146):

  • CenturyLink
  • Charter
  • Cogent
  • Google
  • Indiana U.
  • …
slide-34
SLIDE 34

Does AS-Degree of the Poisoned AS affect Filtering?

OriginAS HighDegreeAS OriginAS OriginAS SmallDegreeAS OriginAS …(in increments of 5)…

slide-35
SLIDE 35

DEFAULT ROUTES AND REACHIBILITY

(NOW VS. 2009)

slide-36
SLIDE 36

Full Paper: https://tiny.utk.edu/bgp

Default Route Metrics

Comparison 2009*: 77% of Stubs had default routes (out of 24,224 with ping) 2018: 36.7% of Stubs had default routes (out of 845 with traceroute)

*Bush et al. Internet Optometry, IMC 2009

slide-37
SLIDE 37

Full Paper: https://tiny.utk.edu/bgp

Reachibility of /25 vs. /24

Comparison 2009*: 1% of BGP Monitors Saw (11/615), 5% Data-Plane Reachability 2018: 50% of BGP Monitors Saw (21/37), 31% Data-Plane Reachability

*Bush et al. Internet Optometry, IMC 2009

slide-38
SLIDE 38

Full Paper: https://tiny.utk.edu/bgp

Where do we go from here?

  • BGP poisoning can provide helpful functionality
  • Allows exertion of unconventional behavior with a conventional protocol
  • Open Questions for AIMS:
  • Deployment/Usage: Where? For what?
  • Integration: CAIDA systems? NANOG/RIPE/etc.? MANRS?
  • Collaboration: Always interested in extending to new use cases/measurements.

Jared M. Smith Twitter jaredthecoder Email jms@vols.utk.edu Web volsec.org