Server Siblings: Identifying Shared IPv4/IPv6 Infrastructure via - PowerPoint PPT Presentation

Server Siblings: Identifying Shared IPv4/IPv6 Infrastructure via Active Fingerprinting Robert Beverly ∗ , Arthur Berger † ∗ Naval Postgraduate School † MIT/Akamai March 20, 2015 PAM 2015 - 16th Passive and Active Measurement Conference R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 1 / 24

What/Why Outline What/Why 1 Methodology 2 Results 3 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 2 / 24

What/Why IPv4/IPv6 Siblings IPv4/IPv6 “Siblings:” Given a candidate ( IPv 4 , IPv 6 ) address pair, determine if these addresses are assigned to the same physical machine. Related IPv6 Research: IPv6 adoption, routing, performance [DLHEA12], [CAZIOB14] Passive client IPv4/IPv6 sibling associations: e.g. web-bugs, javascript, flash [ZAAHM12] DNS server IPv4/IPv6 siblings [BWBC13] Our work: Targeted, active test: on-demand for any given pair Infrastructure: finding server siblings R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 3 / 24

What/Why IPv4/IPv6 Siblings IPv4/IPv6 “Siblings:” Given a candidate ( IPv 4 , IPv 6 ) address pair, determine if these addresses are assigned to the same physical machine. Related IPv6 Research: IPv6 adoption, routing, performance [DLHEA12], [CAZIOB14] Passive client IPv4/IPv6 sibling associations: e.g. web-bugs, javascript, flash [ZAAHM12] DNS server IPv4/IPv6 siblings [BWBC13] Our work: Targeted, active test: on-demand for any given pair Infrastructure: finding server siblings R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 3 / 24

What/Why Motivation Question? Is IPv6 infrastructure being deployed with separate hardware or by adding IPv6 to existing machines? Why? Adoption: Track IPv6 infrastructure evolution, how deployed Bootstrapping: IPv6 geolocation, reputation by correlating to IPv4 counterpart Security: Better understand correlated failures Lack of IPv6 security, tunnel to circumvent firewalls (e.g. an attack on IPv6 resource affecting IPv4 service) Performance: Isolate path vs. host performance when comparing IPv4 and IPv6 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 4 / 24

What/Why Motivation Question? Is IPv6 infrastructure being deployed with separate hardware or by adding IPv6 to existing machines? Why? Adoption: Track IPv6 infrastructure evolution, how deployed Bootstrapping: IPv6 geolocation, reputation by correlating to IPv4 counterpart Security: Better understand correlated failures Lack of IPv6 security, tunnel to circumvent firewalls (e.g. an attack on IPv6 resource affecting IPv4 service) Performance: Isolate path vs. host performance when comparing IPv4 and IPv6 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 4 / 24

What/Why Motivation Question? Is IPv6 infrastructure being deployed with separate hardware or by adding IPv6 to existing machines? Why? Adoption: Track IPv6 infrastructure evolution, how deployed Bootstrapping: IPv6 geolocation, reputation by correlating to IPv4 counterpart Security: Better understand correlated failures Lack of IPv6 security, tunnel to circumvent firewalls (e.g. an attack on IPv6 resource affecting IPv4 service) Performance: Isolate path vs. host performance when comparing IPv4 and IPv6 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 4 / 24

What/Why Motivation Question? Is IPv6 infrastructure being deployed with separate hardware or by adding IPv6 to existing machines? Why? Adoption: Track IPv6 infrastructure evolution, how deployed Bootstrapping: IPv6 geolocation, reputation by correlating to IPv4 counterpart Security: Better understand correlated failures Lack of IPv6 security, tunnel to circumvent firewalls (e.g. an attack on IPv6 resource affecting IPv4 service) Performance: Isolate path vs. host performance when comparing IPv4 and IPv6 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 4 / 24

What/Why Motivation Question? Is IPv6 infrastructure being deployed with separate hardware or by adding IPv6 to existing machines? Why? Adoption: Track IPv6 infrastructure evolution, how deployed Bootstrapping: IPv6 geolocation, reputation by correlating to IPv4 counterpart Security: Better understand correlated failures Lack of IPv6 security, tunnel to circumvent firewalls (e.g. an attack on IPv6 resource affecting IPv4 service) Performance: Isolate path vs. host performance when comparing IPv4 and IPv6 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 4 / 24

What/Why Contributions IPv4/IPv6 Server Sibling Inference, Contributions Develop an active IPv4/IPv6 sibling inference measurement 1 technique by extending prior fingerprinting work Validate and evaluate technique on ground-truth 2 Use technique to survey top Alexa IPv6 capable web servers 3 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 5 / 24

Methodology Outline What/Why 1 Methodology 2 Results 3 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 6 / 24

Methodology Sibling Identification Targeted, Active Sibling Identification Intuition: IPv4 and IPv6 share a common transport-layer (TCP) Combine, extend, and reappraise prior TCP fingerprinting work: Coarse-grained: TCP options signature [Nmap] Fine-grained: TCP timestamp clockskew [Kohno 2005] R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 7 / 24

Methodology Course-Grained Sibling Identification Course-Grained Sibling Identification Presence of TCP options is common-case Order and packing of options is implementation dependent, e.g.: Win: <mss, nop, wscale 5, nop, nop, TS, sackOK> FreeBSD: <mss, nop, wscale 3, sackOK, TS> Linux: <mss, sackOK, TS, nop, wscale 4> We: Strip timestamp value Strip MSS value (unreliable, not just IPv4 MSS-20) Preserve order, compare between IPv4 and IPv6 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 8 / 24

Methodology Fine-Grained Sibling Identification Fine-Grained Sibling Identification TCP timestamp option: “TCP Extensions for High Performance” [RFC1323, May 1992]. Universally supported, enabled by default. Option value: 4 bytes containing current clock TS clock: Value not specified in RFC (only used to detect duplicate segments) � = system clock Frequently unaffected by system clock adjustments (e.g. NTP) Connect to remote TCP periodically over time, fetch TS Fingerprint is TS clock skew or drift R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 9 / 24

Methodology Examples TCP Timestamp Clock Skew Skew-based Fingerprinting Idea: Use linear program to find 40 slope of points 30 Here, different skews (one 20 observed offset (msec) 10 negative) 0 -10 y = 0 . 0299 x skew ( ≈ -20 1.8ms/min, ≈ 15 min/year) -30 -40 Then: Host A (IPv6) -50 Host B (IPv4) α =0.029938 β =-3.519 -60 Compare IPv4 and IPv6 α =-0.058276 β =-1.139 -70 slopes 0 200 400 600 800 1000 measurement time(sec) Siblings if angle less than threshold R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 10 / 24

Methodology Examples Example: Ground Truth Visualization 40 10 30 0 20 -10 observed offset (msec) 10 observed offset (msec) 0 -20 -10 -30 -20 -40 -30 -40 -50 Host A (IPv6) Host A (IPv6) -50 Host B (IPv4) Host A (IPv4) -60 α =0.029938 β =-3.519 α =-0.058253 β =-1.178 -60 α =-0.058276 β =-1.139 α =-0.058276 β =-1.139 -70 -70 0 200 400 600 800 1000 0 200 400 600 800 1000 measurement time(sec) measurement time(sec) Non-Siblings Siblings Host A IPv4 vs. Host A IPv6: identical slopes ( θ = 0 . 0098) Host A IPv6 vs. Host B IPv4: different slopes ( θ = 31 . 947) Of course, more complicated in practice! R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 11 / 24

Methodology Examples Probing Outcomes No options returned: Infrequent, limits to coarse Timestamps: Not present: e.g., middlebox, limits to coarse Non-monotonic: (between connections) e.g., load-balancer Random: e.g., BSD’s random per-flow offset Monotonic: fine-grained fingerprinting For example, raw TCP timestamps: 2e+15 4.5e+09 209.85.225.160 apache.org V4 2001:4860:b007::a0 apache.org V6 0 4e+09 -2e+15 3.5e+09 -4e+15 3e+09 observed offset (msec) -6e+15 TCP Timestamp 2.5e+09 -8e+15 -1e+16 2e+09 -1.2e+16 1.5e+09 -1.4e+16 1e+09 -1.6e+16 5e+08 -1.8e+16 -2e+16 0 0 10000 20000 30000 40000 50000 60000 70000 0 50 100 150 200 measurement time(sec) TCP Packet Sample Random across connects Non-monotonic across connects R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 12 / 24

Methodology Examples Methodology Server Sibling Inference Propose and evaluate two algorithms: Options signature and basic timestamp skew (Alg 1) 1 Additional, parameterized logic (Alg 2) 2 (See paper for gory algorithm details) Test against ground truth Periodically probe Alexa IPv4 and IPv6 targets once every ∼ 3.5 hours for ∼ 17 days R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 13 / 24

Results Outline What/Why 1 Methodology 2 Results 3 R. Beverly & A. Berger (NPS) IPv4/IPv6 Server Siblings PAM 2015 14 / 24