Subject: [RPSEC] Topic 9: Section 4.10 Network Mapping Threat

From: [email-masked]
Date: Tue, 11 Mar 2003 17:50:48 -0500 (EST)

Not sure of the purpose of this section.  If network mapping is a threat
action (attack), what is it an attack against?

It seems to me to fit better as a threat consequence - if your routing
info is exposed (through an interception attack), then people could map your
network.

Given that there are those who worry that a map of their network would
assist bad guys in launching some other sort of attack, I could
understand why the ability to develop a network map would be a
problem.  But the discussion of deriving a prediction of future
situations is unclear in purpose.  I'm not exactly sure what is being
predicted about future situations or why someone would care to predict
what your network would do - perhaps an example of what could be done
with this prediction would help.

What are "informal knowledge networks within an organization"?  Is that
supposed to be the routing network?  Or is this comment taken from
some other context?

What does "unauthorized access to intelligence" mean?  Is "intelligence"
in this case the routing information? 

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: "Scott Rose" <[email-masked]>
Date: Wed, 12 Mar 2003 15:27:36 -0500

----- Original Message -----
From: <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, March 11, 2003 5:50 PM
Subject: [RPSEC] Topic 9: Section 4.10 Network Mapping Threat

> action (attack), what is it an attack against?
Agree.  It is really more of a "threat" than an "attack" since it could be
seen as a prelude to an attack, or something that makes an attack more
possible or more effective.

> info is exposed (through an interception attack), then people could map
your
This issue comes up in the DNS security area as well.  Every few months the
issue of "zone mapping" as a security risk is discussed on the mailing list.

The usual answer is:  "Is that really a threat/attack, given that the
information is public anyway?"  If there are other ways of finding the same
public information, then it is not really an threat.  If an observer can
obtain the same information (network map/routing info) through normal
transactions, then this type of threat is impossible to defend against (or
too expensive to be worth defending).

One questions that needs to be asked is whether the network map or "global
routing table" (if there could be said to be one) is to be considered public
knowledge or not.

> in this case the routing information?

Scott

=================================
Scott Rose
Adv. Network Technology Div., NIST
http://www.antd.nist.gov/proj/dnssec

ph - 301-975-8439
==================================

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 12 Mar 2003 22:50:54 +0100 (CET)

> routing table" (if there could be said to be one) is to be considered public

Obviously that's not the real question (try "telnet
route-views.oregon-ix.net" if you disagree). If there even is a question
here, it would "is it possible to for the global routing table to not be
public knowledge". Every multiconnected non-stub AS needs path
information for loop protection. The number of people running these
networks is too large (and also spread out over the entire world) so
having them keep it a secret won't really work. Also, the operators are
probably not going to like anything like this as it makes
troubleshooting hell. And of course there's always tracroute.

I think if certain organizations want to keep their topology secret they
should probably hide behind some big fat layer 4 (or higher) firewalls.
Just filtering or NAT isn't enough because the other side still gets to
see the TTL and RTTs which are enough for rudimentary network mapping.

---

From: "Dijiang Huang" <[email-masked]>
Date: Thu, 13 Mar 2003 02:10:29 -0600

>troubleshooting hell. And of course there's always tracroute.

Hiding routing information is a very interesting issue.
If we categorize the attack source by insiders and outsiders, we can easily
guard against outsiders using strong authentication (Sandy's comments on
attack
source). But, considering insider attacks, the routing information may be
(or should be) very valuable to attackers. (Here, I assume the one who can
physically
access to the communication links or routers as an insider, where the
outsider can not access to).
There are two type of hiding information: the network topology
and traffic pattern (i.e. ospf, the metric in LSA can tell attackers the BW
allocation).
The network topology information may help the insiders to
quickly identify the partition (cut) nodes and disable the network more
easily,
such as destroy the partition nodes or cut the partition links. The traffic
pattern
information can help attackers to guess what communication links may carry
the
"important" data traffic, then exert passive attacks (wiretap etc.), or can
help
to figure out how to inject forged routing information to switch the traffic
to the routers or links that under the attackers control. There are can be
multiple
ways to derive network topology and traffic pattern. But, I think that
analyze the
routing data is one of the easy ways to do it.

Obviously, hiding routing information violate the fundamental philosophy of
the
Internet. Moreover, the fundamental relationship among routers are
cooperation and
coordination. Hiding routing information may require additional key
management overhead.
And the network operator may also get "mad" that make him feel like losing
the control of the
network. I consider this is a tussle within current Internet. As described
in David Clark's
paper (http://www.acm.org/sigs/sigcomm/sigcomm2002/papers/tussle.pdf):

"One of the most profound and irreversible changes in the
Internet is that by and large, many of the users don't trust
each other. The users of the Internet no longer represent
a single community with common motivation and shared
trust. There are parties with adverse interests, and some
genuine "bad guys" out there. This implies that mechanisms
that regulate interaction on the basis of mutual trust should
be a fundamental part of the Internet of tomorrow."

I consider the tussle between hiding routing information and the openness,
transparency is
another design consideration of network routing protocol. Besides the
cooperation's network,
in public routing domain, BGP can also hide
some information through its policy from some Internet users.
I don't know how to solve the "curiosity" of some operators to know the
network
topology. Maybe the trust relations can help network operators to know the
routing
information belong to their trust region.

I am not sure my arguments are valid or not, please "hit" me if they are not
correct.

--Dijiang Huang

---

From: Tony Tauber <[email-masked]>
Date: Thu, 13 Mar 2003 14:32:46 -0500 (EST)

> Hiding routing information is a very interesting issue.

A few comments:

Remember, the work is not just for the public Internet but
for the protocols which comprise it.  Most or all of these
can also be used in more circumscribed settings, but the
security considerations often won't change.  That is, don't
just think about "the Internet" but any place a routing protocol
is used.

Certainly the "route servers" (a technical misnomer and "looking
glass" is unfortunately no better) are orthogonal to protocol design;
just an operational contrivance.  Not to say anyone was confused, just
thoguht I'd throw that clarification out there.

To the real meat:

Routing Protocols share or hide information by design -

- share to discover topology and get traffic moving quickly and
  efficiently
- hide to improve scaling by supressing extraneous topology details
  or as an instrument of policy

I'm not sure that security can really speak to these directly other
than to improve the "assuredness" of their operation, eg. in the
authorization of the exchange or the validation of its contexts.

I had a similar thought about the "deliberate exposure" idea.
Is it not the job of the routing protocol to expose information?

What do others think?

I'm wondering if there should be (or is?) some parallel routing
requirements description as there are things that a routing protocol
must do to be effective which can't be "compromised" by over-zealous
security design.

Tony

> I consider the tussle between hiding routing information and the
> openness, transparency is another design consideration of network
> routing protocol. Besides the cooperation's network, in public
> routing domain, BGP can also hide some information through its
> policy from some Internet users.  I don't know how to solve the
> "curiosity" of some operators to know the network topology. Maybe
> the trust relations can help network operators to know the routing
> I am not sure my arguments are valid or not, please "hit" me if they
> are not correct.
>
> --Dijiang Huang

---

From: Russ White <[email-masked]>
Date: Sat, 15 Mar 2003 09:10:08 -0500 (Eastern Standard Time)

I would say that there's a difference between reachability information and
topology information. I might have 1000 subnets, but if I advertise them
all as one large aggregate, then block pings and traceroutes, and most
other icmp into my network that could be used for mapping it out in any
way, I've hidden my topology pretty effectively.

And there may be reasons for me to want to do this--for instance, I might
not want people to find out what my broadcast addresses are, to prevent
various sorts of DOS attacks.

Discovering topology information isn't an attack, it's a threat, possibly,
a prelude to other possible attacks. At least it seems to me that it might
be valuable information that some networks may want to hide for various
reasons.

:-)

Russ

--
[email-masked] CCIE <>< Grace Alone
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec