Down the Black Hole: Dismantling Operational Practices of BGP - - PowerPoint PPT Presentation

▶
down the black hole dismantling operational practices of
SMART_READER_LITE
LIVE PREVIEW

Down the Black Hole: Dismantling Operational Practices of BGP - - PowerPoint PPT Presentation

Jun 03, 2023 346 likes •1.15k views

Down the Black Hole: Dismantling Operational Practices of BGP Blackholing at IXPs Marcin Nawrocki, Jeremias Blendin, Christoph Dietzel, Thomas C. Schmidt, Matthias Whlisch Christmas is near!

slide-1
SLIDE 1

Down the Black Hole: Dismantling Operational Practices of BGP Blackholing at IXPs

Marcin Nawrocki, Jeremias Blendin, Christoph Dietzel, Thomas C. Schmidt, Matthias Wählisch

slide-2
SLIDE 2

Christmas is near!

2 https://www.shutterstock.com/video/clip-1584091-small-red-christmas-present-looping-on-white

slide-3
SLIDE 3

3

slide-4
SLIDE 4

4

I hate Christmas ...

https://indac.org/blog/the-grinch-official-trailer-3/

slide-5
SLIDE 5

5

I hate Christmas ...

https://indac.org/blog/the-grinch-official-trailer-3/ https://blogvaronis2.wpengine.com/wp-content/uploads/2019/09/ddos-attack-hero-1200x401.png

slide-6
SLIDE 6

6

slide-7
SLIDE 7

The Internet suffers

DDoS

The problem!

Black ckholi

  • ling

The solution?

7

slide-8
SLIDE 8

Common (mis) belief

Blackholing is an effective measure to mitigate DDoS

8

slide-9
SLIDE 9

Common (mis) belief

Blackholing is an effective measure to mitigate DDoS

9

? ?

slide-10
SLIDE 10

Our results. In a nutshell.

Blackholing drops only 50% of unwanted traffic. Fine-grained blacklisting of attack signatures is an effective mitigation strategy. Only 27% of Blackhole Events correlate with DDoS. Other use cases exist for Blackholing but are very rare.

10

Efficiency Use Cases

slide-11
SLIDE 11

Agenda

  • I. Background

How does BGP Blackholing work at IXPs?

  • II. Deployment Status

How well deployed is Blackholing in the real world?

  • III. Future Enhancements

How should we configure fine-grained filtering?

11

slide-12
SLIDE 12
  • I. How does BGP Blackholing work at IXPs?

12 https://www.hasepost.de/freiwillige-feuerwehr-sammelt-tannenbaeume-ein-2114/

slide-13
SLIDE 13

Remotely-Triggered Blackholing at IXPs

13

IXP Routeserver Peer AS1 Peer AS3 Peer AS2 Peering platform Webserver Victim AS

slide-14
SLIDE 14

Remotely-Triggered Blackholing at IXPs

14

IXP Routeserver Peer AS1 Peer AS3 Peer AS2 Peering platform Webserver Victim AS DDoS Traffic Legitimate Traffic

slide-15
SLIDE 15

Remotely-Triggered Blackholing at IXPs

15

IXP Routeserver Peer AS1 Peer AS3 Peer AS2 Peering platform Webserver Victim AS Blackhole BGP Signal: RTBH for 1.2.3.4/32 IP: 1.2.3.4

slide-16
SLIDE 16

Remotely-Triggered Blackholing at IXPs

16

IXP Routeserver Peer AS1 Peer AS3 Peer AS2 Peering platform Webserver Victim AS Blackhole BGP Signal: RTBH for /32

That's the simple case. BGP policies apply in the real world.

slide-17
SLIDE 17

Remotely-Triggered Blackholing and BGP Policies

17

IXP Routeserver Peer AS1 Peer AS3 Peer AS2 Peering platform Webserver BGP Signal: RTBH for 1.2.3.4/32 Victim AS BGP Rejection Policy

slide-18
SLIDE 18

Remotely-Triggered Blackholing and BGP Policies

18

IXP Routeserver Peer AS1 Peer AS3 Peer AS2 Peering platform Webserver Victim AS BGP Rejection Policy Blackhole

slide-19
SLIDE 19
  • II. How well deployed is BGP Blackholing in the real world?

19 https://unternehmensberatungralfmueller .wordpress.com/ 2011/12/15/weihnachten-einfach-weihnachten/

slide-20
SLIDE 20

Our measurement approach

One of the worlds-largest IXPs as a central vantage point Wholistic view: >100 days, all related data - no exceptions!

20

slide-21
SLIDE 21

Our measurement approach

One of the worlds-largest IXPs as a central vantage point Wholistic view: >100 days, all related data - no exceptions!

BGP data

  • All RTBH messages from all route-

servers

  • RTBH announcements identifiable

by BGP community and next-hop-IP

21

BGP Signal: RTBH for 1.2.3.4/32

slide-22
SLIDE 22

Our measurement approach

One of the worlds-largest IXPs as a central vantage point Wholistic view: >100 days, all related data - no exceptions!

Flow data

  • All packets from/to prefixes, which

have been blackholedat least once

  • All packets which traverse the public

switch-fabric (Sampling: 1/10000)

  • Dropped packets identifiable by

special MAC-address

22

DDoS Traffic Legitimate Traffic

slide-23
SLIDE 23

Our measurement approach

One of the worlds-largest IXPs as a central vantage point Wholistic view: >100 days, all related data - no exceptions!

Flow data

  • All packets from/to prefixes, which

have been blackholedat least once

  • All packets which traverse the public

switch-fabric (Sampling: 1/10000)

  • Dropped packets identifiable by

special MAC-address BGP data

  • All RTBH messages from all route-

servers

  • RTBH announcements identifiable

by BGP community and next-hop-IP

23

We verified: Time is in sync!

slide-24
SLIDE 24

Do all IXP member accept RTBH announcements ?

24

slide-25
SLIDE 25

Successful mitigation depends on the announced RTBH prefix length

25

slide-26
SLIDE 26

Successful mitigation depends on the announced RTBH prefix length

26

slide-27
SLIDE 27

Successful mitigation depends on the announced RTBH prefix length

27

/32-RTBHs have a mean drop rate of 50%. But they cover 99% of the to-be-blackholed traffic.

slide-28
SLIDE 28

How fast do IXP members react to DDoS events?

28

slide-29
SLIDE 29

Measurement challenge Multiple RTBHs cover the same attack

29

slide-30
SLIDE 30

Measurement chall llen enge Multiple RTBHs cover the same attack

30

slide-31
SLIDE 31

Measurement chall llen enge Multiple RTBHs cover the same attack

31

Multiple RTBHs!

slide-32
SLIDE 32

Measurement challenge Multiple RTBHs cover the same attack

32

Time-based clustering

  • f RTBHs
slide-33
SLIDE 33

Measurement challenge Multiple RTBHs cover the same attack

33

What happens before RTBH Events?

slide-34
SLIDE 34

Analysis of 72 72 hours bef efore an RTBH Event

Use a sliding window algorithm (EWMA) to infer whether one of the monitored features exhibits an anomalous peak:

i. number of packets ii. number of unique destination ports

  • iii. number of flows
  • iv. number of unique source IP addresses

v. number of non-TCP flows

34

slide-35
SLIDE 35

Analysis of 72 72 hours bef efore an RTBH Event

35

TCP SYN Attacks GRE Floods Amplification Attacks

Use a sliding window algorithm (EWMA) to infer whether one of the monitored features exhibits an anomalous peak:

i. number of packets ii. number of unique destination ports

  • iii. number of flows
  • iv. number of unique source IP addresses

v. number of non-TCP flows

slide-36
SLIDE 36

Most anomalies occur up to 10 minutes before an RTBH Event

36

slide-37
SLIDE 37

Most anomalies occur up to 10 minutes before an RTBH Event

37

This short reaction time indicates automatic DDoS mitigation.

slide-38
SLIDE 38

But: Anomalie ies bef efore RTBH are uncommon!

38

Traffic ≤ 72 hours Anomaly ≤ 10 min % RTBH Events ✓ ✓ 27% ✓ ✗ 27% ✗

  • 46%
slide-39
SLIDE 39

WHY? Y?

39

slide-40
SLIDE 40

Other use-cases?

40

Prefix Squatting Protection

Prevent hijacking of address space that is assigned but not announced. Prefix squatting is easy to deploy because there is no competitive announcement. Deploy censorship by blackholing traffic to content servers. Block malicious clients, e.g., port & vulnerability scanners.

Content Blocking

slide-41
SLIDE 41

Prefix Squatting Protection

41

Prefix Length [bits]

RTBH Events (log10)

slide-42
SLIDE 42

Other use-cases?

42

Prefix Squatting Protection

Prevent hijacking of address space that is assigned but not announced. Prefix squatting is easy to deploy because there is no competitive announcement. Deploy censorship by blackholing traffic to content servers. Block malicious clients, e.g., port & vulnerability scanners.

Content Blocking

New use-cases are infrequent. 70% of RTBH Events still inexplicable.

slide-43
SLIDE 43

Vantage point bias?

  • 1. Packet sampling and private-network-

interconnectionshide traffic.

43

https://de.wikipedia.org/wiki/Datei:Iceberg.jpg

slide-44
SLIDE 44

Vantage point bias?

  • 1. Packet sampling and private-network-

interconnectionshide traffic.

  • 2. ASes might announce RTBHs at all point-of-

presence despite local attacks.

44

https://de.wikipedia.org/wiki/Datei:Iceberg.jpg

slide-45
SLIDE 45

Vantage point bias?

  • 1. Packet sampling and private-network-

interconnectionshide traffic.

  • 2. ASes might announce RTBHs at all point-of-

presence despite local attacks. But: Related work [IMC'18] using distributed measurements reached similar results!

45

https://de.wikipedia.org/wiki/Datei:Iceberg.jpg Jonker et al, A First Joint Look at DoS Attacks and BGP Blackholing, IMC 2018

slide-46
SLIDE 46
  • III. How should we configure fine-grained filtering?

46 https://community.today.com/parentingteam/post/what-are-the-best-christmas-gifts-for-kids-this-year https://www.youtube.com/watch?v=-pH9VX324rI

slide-47
SLIDE 47

RTBH - Pro and Con

RTBHs drop DDoS traffic early in the network. RTBHs complete the attack, the victim is unreachable.

47

THE GOOD THE UGLY

slide-48
SLIDE 48

RTBH - Pro and Con

RTBHs drop DDoS traffic early in the network. RTBHs complete the attack, the victim is unreachable.

48

THE GOOD THE UGLY Fine-grained filtering would keep a service reachable.

slide-49
SLIDE 49

Blackhole

Wh Whit itel elistin ing vs. blacklisting of ports

49

IXP Routeserver Peer AS1 Peer AS3 Peer AS2 Peering platform Webserver Victim AS IP: 1.2.3.4 Legitimate Traffic: Port 80 and 443

slide-50
SLIDE 50

Challenge We cannot whitelist client traffic, because client traffic is highly variable.

50

slide-51
SLIDE 51

RadViz Projection

51

Visualizing multidimensional port information allows a classification into clients and servers

https://de.wikipedia.org/wiki/Datei:Jahn-Bergturnfest_2006_tug_of_war .jpg

slide-52
SLIDE 52

RadViz Projection

52

Visualizing multidimensional port information allows a classification into clients and servers

https://de.wikipedia.org/wiki/Datei:Jahn-Bergturnfest_2006_tug_of_war .jpg

FEATURE 2: number of different source ports FEATURE 1: number of different destination ports

slide-53
SLIDE 53

Many blackholed IP addresses exhibit high port fluctuations

53

slide-54
SLIDE 54

Many blackholed IP addresses exhibit high port fluctuations

54

Most of the protected IP addresses are clients.

slide-55
SLIDE 55

Cross-validation using PeeringDB

55

slide-56
SLIDE 56

Cross-validation using PeeringDB

56

Most clients located in DSL networks. PeeringDB supports our classification.

slide-57
SLIDE 57

Esports Disputes

57 https://www.nytimes.com/2018/11/07/movies/the-grinch-review.html

slide-58
SLIDE 58

Esports Disputes

58 https://www.nytimes.com/2018/11/07/movies/the-grinch-review.html https://knowyourmeme.com/memes/first-day-on-the-internet-kid

slide-59
SLIDE 59

Esports Disputes

59 https://www.nytimes.com/2018/11/07/movies/the-grinch-review.html https://knowyourmeme.com/memes/first-day-on-the-internet-kid https://blogvaronis2.wpengine.com/wp-content/uploads/2019/09/ddos-attack-hero-1200x401.png

slide-60
SLIDE 60

Potentials of fine-grained whitelisting?

Clients are often affected by BGP Blackholing. Whitelisting of regular, expected traffic patterns is not an option.

60

slide-61
SLIDE 61

Can we easily improve by black cklisting attack traffic?

61

slide-62
SLIDE 62

Most RTBH traffic is UDP traffic

  • >90% of RTBH Events (with packets and a preceding anomaly) contain

almost exclusively UDP amplification traffic

  • Multi-vector attacks are common, but usually do not utilize more

than three amplification vectors:

62

slide-63
SLIDE 63

Fine-Grained Blacklisting

Fine-grained filtering based on source- ports is very effective and potentially saves legitimate traffic! Filter example: CharGEN/19, DNS/53, NTP/123

63

slide-64
SLIDE 64

64

Have you been a good network operator?

http://phdcomics.com/comics/archive.php?comicid=395

But how?

slide-65
SLIDE 65
  • Summary. Advices for operators.
  • 1. Check BGP policies.

Accept more specific prefixes, in particular /32, in case of RTBH announcements.

  • 2. Check routing tables for RTBH 'zombies'.

Routing tables may contain many unnecessary/inexplicable RTBH

  • entries. Contact peers to understand the RTBH use cases.
  • 3. Consider fine-grained filtering.

Majority of DDoS attacks are still not complex. Simple port-based blacklisting (ACLs, BGP Flowspec) can be very effective.

65

slide-66
SLIDE 66

66

slide-67
SLIDE 67

BACKUP SLIDES

slide-68
SLIDE 68

Prefix Lengths and Traffic Share

68

slide-69
SLIDE 69

AS Drop Consistency

69

slide-70
SLIDE 70

RTBH Propagation Filter

70

slide-71
SLIDE 71

Maximum RTBH Distance Δ

71

slide-72
SLIDE 72

Attack Visibility and Sampling

  • Median DDoS attack size in mid 2018 was

1287 Mbps

  • Dividing by a MTU of 1500 Bytes, this

corresponds up to 100k packets per second

  • We expect to observe attacks despite

sampling!

72

slide-73
SLIDE 73

List of Amplification Protocols

73

slide-74
SLIDE 74

Share of UDP Amplification Traffic

74

slide-75
SLIDE 75

Sources of amplification attacks

75

slide-76
SLIDE 76

EWMA and Anomaly Amplification Factor

76

slide-77
SLIDE 77

Port Variance vs Port Stability

77

slide-78
SLIDE 78

Challenges of Quantifying Collateral Damage

  • 1. Servers and clients are victims of DDoS
  • 2. Passive inference of services is biased

by scans and spoofed traffic

  • 3. Very sparse data outside of RTBH

Events

  • 4. Attack traffic might be also present
  • utside of RTBH Events
  • 5. Legitimate traffic pattern change

during an attack

78

slide-79
SLIDE 79

Collateral Damage for Servers

slide-80
SLIDE 80

Classification Result

80