Subject: Re: [RPSEC] Topic 2: Section 4.5 Underclaiming - is this a legitimate threat?

From: [email-masked]
Date: Fri, 14 Mar 2003 17:11:51 -0500 (EST)

>One example in my mind is, an underclaiming by misconfiguration, which
>doesn't have to happen on the provider side. Customer is running BGP to
>its provider and makes some mis-configuration on the customer side so no
>one prefix is advertised to the provider.  Isn't this mis-configuration a
>threat launched by a subverted router?:-)

I don't think of the customer's failure to announce his own address as
a threat.  It certainly doesn't hurt anyone but the customer.  And I regard
anything that a router says about its own state, the data that it is
exclusively knowledgeable about, as its own exclusive authority.  So
whatever it says is authentic.

Suppose a BGP peer is mis-configured and doesn't accept connections from
its legitimate peer?  I don't consider that an attack.  A failure, sure,
but not an attack.

And to reiterate:  can you imagine that the routing protocol would have
any chance in the world of distinguishing a legitimate case of hiding
from an illegitimate case?  In your example, is there any way the
routing protocol at the customer could protect itself from that
mis-configuration?

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Yi Yang <[email-masked]>
Date: Fri, 14 Mar 2003 21:21:00 -0500 (EST)

Sandy,

> whatever it says is authentic.

Based on this, the overclaiming should not be a threat either.

> routing protocol at the customer could protect itself from that

You are right that we can't find a way to protect against this. But can we
say a threat doesn't exist because we can't find a defense?

Yi

---

From: Curtis Villamizar <[email-masked]>
Date: Fri, 14 Mar 2003 22:39:00 -0500

In message <[email-masked]>, Yi Yan
> Based on this, the overclaiming should not be a threat either.

Not admiting you can reach a destination only affects your own
service.  It is an error and if there is an alternate path, at worst
suboptimal routing occurs.  It is not possible to add to the protocols
to determine if a site has a misconfiguration, or software error or
legitimately can't reach the destination at the moment.

By claiming that you can reach a network that you cannot reach and
have no authority to be advertising can be used as a DoS attack to
divert traffic and black hole it.  It is also something that can be
verified.

If you had any knowledge at all of operational issues you'd know that
this has been used as a DoS attack and it has been an issue discussed
for over a decade and considerable work has gone into defenses mostly
based on cooperative maintenance of routing registries or other
out-of-band means of verification.

> say a threat doesn't exist because we can't find a defense?

There is over a decade of operational experience and where the issues
of advertising routes that one has no connectivity to has arisen, been
partially or quite completely addressed by some parties, and widely
discussed.  Identifying routers who are failing to advertise something
which is reachable is widely considered an intractable problems for
very obvious reasons and while you might find a sematic argument about
it ammusing, such an argument is non-productive.

Perhaps you should abandon this nonsensical argument and try to
contribute some productive comments on this issue.

> Yi

Have a nice day,

Curtis

---

From: Russ White <[email-masked]>
Date: Sat, 15 Mar 2003 08:36:37 -0500 (Eastern Standard Time)

> Not admiting you can reach a destination only affects your own service.
> It is an error and if there is an alternate path, at worst suboptimal
> routing occurs.  It is not possible to add to the protocols to determine
> if a site has a misconfiguration, or software error or legitimately can't
> reach the destination at the moment.

Well, I don't know.... I would say that if you have a single path, and
someone maliciously breaks into the router and kills that path (the path to
your ebusiness site, and your competitor hires a hacker to kill access to
your site during your first 24 hours of new product they know will really
ruin your business.

The only possible defense, however, is to tell the customer not to put
themselves in this position; redundancy is your friend.

:-)

Russ

--
[email-masked] CCIE <>< Grace Alone
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Curtis Villamizar <[email-masked]>
Date: Sat, 15 Mar 2003 11:52:03 -0500

> themselves in this position; redundancy is your friend.

This is an attack on an individual network element.  There is nothing
the protocols can do to prevent this.  Redundancy is a partial
solution because if an implementation is full of security holes the
attacker can just take out network elements at will.

If someone breaks into *my* router because I was careless and
configured it poorly, protocols can be design to prevent that breach
from taking out *your* service.

Curtis

---

From: Birger Toedtmann <[email-masked]>
Date: Mon, 17 Mar 2003 11:45:26 +0100

> legitimately can't reach the destination at the moment.

On the other hand, underclaiming may result in adverse effects on the 
routers of the alternative paths.  Guess I want to disrupt the services
of some transit net from which I know it won't be able to handle all 
the traffic for me - underclaiming on the main path might do the trick.  

I'll be hurting myself as well ('suicide attack' may be the correct
name), so this is not very likely to be seen.  However it's a threat 
especially when using networks I "own" but don't use right now.

Birger

---

From: Stephen Kent <[email-masked]>
Date: Mon, 17 Mar 2003 10:03:57 -0500

At 11:45 AM +0100 3/17/03, Birger Toedtmann wrote:
>>  In message 
>><[email-masked]>, Yi Yan
>>  g writes:
>>  > Sandy,
>>  >

I believe there is no requirement that an ISP advertise all of the 
address space it holds to all of its neighbors. The decision of what 
to advertise and to whom is presumably a local ploicy decision. Thus 
this seems like an inappropriate notion of enforceable correct 
operation for BGP.

Steve

---

From: Birger Toedtmann <[email-masked]>
Date: Mon, 17 Mar 2003 16:25:35 +0100

Stephen Kent schrieb am Mon, Mar 17, 2003 at 10:03:57AM -0500:
[...]
> this seems like an inappropriate notion of enforceable correct 

When reading the draft I got the impression that it's about threats,
i.e. "things that could be done and cause harm".  If underclaiming is
such an action in a situation where it is a requirement to advertise
address space to avoid overloading (such a situation may be uncommon
but existent), I'd refer to it as a valid threat source.  Attackers 
are quite inventive.

Regards,

Birger

---

From: Stephen Kent <[email-masked]>
Date: Mon, 17 Mar 2003 11:39:21 -0500

>but existent), I'd refer to it as a valid threat source.  Attackers

Briger,

Fair point, but as noted before, while a list of attacks has some 
merit, it is not a substitute for a well-reasoned, top-down 
requirements list, which is what we eventually need. Essentially, the 
list of attacks we know of now is useful mostly as a check to make 
sure that the requirements specification has not missed anything.

Also, we have enough trouble dealing with what are arguably 
violations of correct operation by routing protocols. I think we are 
ill served by worrying about behavior that might be adverse.  We 
don't want to inherit the problems that intrusion detection systems 
exhibit, overwhelming operators with largely false positive warnings 
about "suspicious" behavior.

Steve

Steve

---

From: Stephen Kent <[email-masked]>
Date: Tue, 18 Mar 2003 11:50:22 -0500

>Based on this, the overclaiming should not be a threat either.

How do you justify this statement? not choosing to advertise a prefix 
might be justified by a local policy decision.  Advertising what you 
have not been authorized to advertise is clearly a security problem 
that cannot be justified by local policy in the normal meaning of the 
term.

>say a threat doesn't exist because we can't find a defense?

The point is not that one does not have a defense for this, but that 
the behavior is indistinguishable from legitimate behavior, at least 
in some contexts. For example, maybe the ISP is not advertising the 
prefix because the subscriber failed to pay its bills :-).

Steve

---

From: Russ White <[email-masked]>
Date: Wed, 19 Mar 2003 19:10:24 -0500 (EST)

So, from this discussion, and the discussion at the mic during the meeting,
it seems like underclaiming, by defintion, is _currently_ defined as not
advertising something you are authorized to advertise for reasons of
configuration or bugs. Is it possible to simply redefine it, so we can
seperate the specific threat of someone killing off reachability by
maliciously killing off an advertisement, rather than simply bundling that
sort of attack under some other category?

Is it useful to provide a classification for that sort of attack through
redefinition?

:-)

Russ

> prefix because the subscriber failed to pay its bills :-).

__________________________________
[email-masked] CCIE <>< Grace Alone

---

From: Tony Tauber <[email-masked]>
Date: Thu, 20 Mar 2003 01:34:06 -0500 (EST)

On Wed, 19 Mar 2003, Russ White wrote:
> > >You are right that we can't find a way to protect against this.
> > >But can we say a threat doesn't exist because we can't find a
> > >defense?
> >
> So, from this discussion, and the discussion at the mic during the
> meeting, it seems like underclaiming, by defintion, is _currently_
> defined as not advertising something you are authorized to advertise
> for reasons of configuration or bugs. Is it possible to simply
> redefine it, so we can seperate the specific threat of someone
> killing off reachability by maliciously killing off an
> advertisement, rather than simply bundling that sort of attack under
> some other category?
>
> Is it useful to provide a classification for that sort of attack
> through redefinition?
>
> Russ

Right, like could we decompose things?

I'm coming to understand, at last, what Sandy refers to as
"correctness" issues.  That being that a router correctly functions
according to what it thinks to be the state.

OTOH, it's not hard to concieve of an attack where a bogus update is
injected into a router to cause it to withdraw a legitimate, ie.
desired, advertisement.  That example of underclaiming could likely
be redefined as actually being something else.  I can't think of
another example right now.  A bit sleepy.

Tony

---

From: Yi Yang <[email-masked]>
Date: Thu, 20 Mar 2003 14:36:55 -0500 (EST)

Steve,

> might be justified by a local policy decision.

there are two cases not advertising a prefix:

1. Legetimatekly not adverting, which can be justified by contract/local
policy
2. Illegetimately, which might be caused by subverted router or otehr
reasons.

As you mentioned, right now, the difficulty is routing systems have no
ways to distinguish these two cases, but, IMHO, this doesn't justify that
the case 2 is not a threat.

Yi

> Advertising what you