Subject: [SAVA] Note on ingress filtering

From: sunshine at cis.udel.edu (Jelena Mirkovic)
Date: Mon Mar 19 05:59:39 2007

Hi everyone

I talked to Aaron Falk recently about some work I am doing on spoofed 
packet filtering and he suggested that it would be good to send a brief 
note about motivation for going beyond ingress filtering to this mailing 
list. I'll give you two notes - one purely technical and the other one 
practical. I'll then send another email that gives a brief overview of 
spoofing defenses proposed so far.

Technical note:
----------------
Gist: Ingress filtering is not deployed to a sufficient extent to prevent
high-rate attacks with spoofed traffic. DDoS attacks still use spoofing and
reflector attacks are on the increase. Spoofing is thus very much an open 
problem.

Many researchers believe that spoofing is a solved problem based on two 
arguments: (1) a recent Spoofer project's study [spoofer] that estimates that 
80% of networks deploy ingress filtering and (2) prevalence of non-spoofed 
DDoS attacks.

The Spoofer project [spoofer] uses a set of distributed agents (volunteers that
sign up to participate)  that spoof packets to a monitoring machine at MIT, 
to measure the prevalence of ingress filtering in networks hosting the agents. 
Spoofer measurements show that around 80% of networks participating in the 
project deploy ingress filtering. While this is encouraging news, the results
cannot be extrapolated to the entire Internet for the following reasons. 
(1) The number of machines probed as of today (3/18/07) is around 9.5 K. 
This number is too small when compared to 433 M hosts estimated as connected 
to the Internet as of January 2007 [isc]. (2) Participation in the survey is
voluntary and majority of participants are from the US. The survey was 
advertised at networking meetings and conferences so the volunteers 
are likely to be from universities or companies with well-secured networks, 
and strong interest in networking and security. This introduces bias toward
well-secured networks, while a lot of compromised machines used for 
large-scale attacks with spoofing are home machines in third-world countries.
>From this point of view the results of the survey are discouraging since 20% 
of networks that should be well-secured allow spoofing. Finally, even if only 
20% of all networks in the Internet allowed spoofing, they could still 
generate high-volume spoofed and reflected traffic to any target.

Contemporary DDoS techniques have gravitated toward flash-crowd type attacks 
that do not use spoofing. Still, there are a significant number of DDoS 
attacks that take advantage of spoofing. For example, recent analysis of 
backscatter traffic [savage] used replies to spoofed packets to infer that 
there were several hundred DDoS attacks with IP spoofing per day in 
2001---2004, and via personal communication with the study's authors we 
confirmed that the data for 2005 and 2006 look similar. Thus, while there are 
many other DDoS attacks that do not use spoofing and could not be observed in 
backscatter traffic, it is certain that several hundred attacks per day use 
spoofing --- a large number to be discarded as insignificant. Further, 
reflector attacks have recently become popular for recursive DNS attacks [dns].
Reflector attacks are not observable in the backscatter survey and present
further evidence that spoofing can still be misused for large-scale attacks
in spite of current ingress filtering deployment.

[spoofer] Advanced Network Architecture Group. ANA Spoofer Project. 
http://spoofer.csail.mit.edu/

[isc] Internet Systems Consortium, ISC Domain Survey, Number of Internet
Hosts, http://www.isc.org/index.pl?/ops/ds/

[savage] D. Moore, C. Shannon, D. J. Brown, G. M. Voelker, and S. Savage. 
Inferring Internet denial-of-service activity. ACM Transactions on 
Computer Systems (TOCS), 24(2), May 2006.

[dns]  D. Kawamoto. DNS recursion leads to nastier DoS attacks. ZDNet.co.uk, 
17 March 2006.

Practical note:
----------------
Gist: The nature of spoofing problem is such that ingress filtering alone 
cannot solve it.

Ingress filtering only affects the outgoing traffic from deploying networks. 
Even if there are only a few (e.g. 100) networks that do not deploy ingress 
filtering, these networks can generate high-rate spoofed traffic to any 
destination EVEN IF this destination deploys ingress filtering. 
They can also generate high-rate reflected traffic to any 
destination by spoofing its address to multiple legitimate servers, EVEN IF 
these servers' networks and the destination network deploy ingress filtering.
Thus ingress filtering alone cannot solve spoofing unless deployed at 100% of
networks. What is needed is something in the middle - a defense that sits 
on many traffic paths and can detect and filter spoofed packets. Good 
news here is that according to the AS map of the Internet selected 50 ASes
that belong to ~20 large ISPs can see 99% of all source-destination paths. 
We need an effective defense deployed at those 20 ISPs.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Jelena Mirkovic, Assistant Professor
CIS, University of Delaware
412 Smith Hall, Newark, DE 19716
phone: 302-831-6052, fax: 302-831-8458
http://www.cis.udel.edu/~sunshine
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---

From: sunshine at cis.udel.edu (Jelena Mirkovic)
Date: Mon Mar 19 05:59:39 2007

Here is a brief overview of defenses proposed so far against spoofing.
I am sending this since I noticed that 
http://www1.tools.ietf.org/bof/trac/wiki#TimeframeIETF68Prague
only lists three of those.

There are seven defenses proposed so far that detect and filter spoofed 
packets: ingress filtering [ingress], 
hop-count filtering (HCF)  [hcf], route-based filtering (RBF) [rbf], 
inter-domain packet filtering (IDPF) [idpf], spoofing prevention method 
(SPM) [spm], packet passports (PASS) [pass] and StackPI (SPI) [spi]. 
Each of these defenses builds a table that associates some traffic 
parameter with a source address. When a packet arrives the defense compares
the parameter value in the packet with the value in the table for the packet's
source. If there is a mismatch the packet is considered spoofed.

HCF associates the router hop count, inferred from TTL field, with a source.

RBF (listed on your page as DPF) associates one previous hop of the route
from source to the filter, with this source. It is difficult to infer the 
knowledge of the correct previous hop for each source and SAVE paper aimed
to improve this situation but resulted in non-scalable algorithm. Some of 
my recent work actually solves this problem but isn't published yet.

IDPF addresses the problem of previous hop inference from another perspective.
It associates a source with several POSSIBLE previous hops, that are inferred
from BGP information assuming No-Valley-Customer-Prefer routing. Thus if 
a neighbor advertises a given destination to the filter this neighbor is 
also a possible previous hop from the same address (as a source) to the filter.
IDPF has much lower effectiveness than RBF because multiple possible previous
hops allow more freedom for spoofing.

SPI uses markers in the middle of the 
Internet that place a small deterministic mark in the packet's header. The
marks are "stacked" - each router shifts the current mark sequence and appends
its own mark. The sequence of marks in a packet reaching the filter is 
associated with its source, and called a "path identifier". Note that HCF, 
RBF, IDPF and SPI associate sources with some property of the route to the 
filter and are thus sensitive to route changes, dynamic routing, etc.

SPM and PASS are very similar. SPM lets each participant exchange a secret
key with each other participant. This key is used as a mark between this
pair of hosts. There are a lot of security vulnerabilities because the mark
is placed in clear, but they can be fixed. PASS lets each end-host 
participant exchange a secret with each transit AS. When an end host sends
packets it includes a sequence of marks derived using keys for transit ASes
that this packet will cross. Each AS can then verify that the packet was
sent by the alleged source. In other words both SPM and PASS associate a source
with the secret that the source has communicated to the filter. PASS has 
many more security mechanisms but in essence it's the same idea. SPM and PASS
have a large problem in that they can only stop spoofing OF PARTICIPANT'S 
addresses. If number of participants is small they can see no reduction in
spoofed traffic they receive, since spoofing can be done using 
non-participant's addresses. Even small number of participants can see 
reduction in reflected traffic with PASS but not with SPM. Let me illustrate 
this: let A and B be end hosts and C a router between them. A and B use
SPM. Thus noone can spoof A to B or B to A but packets spoofing A or B to 
other destinations, and packets spoofing other sources to A and B can still
go through. Now let A, B and C use PASS. Noone can spoof A or B in packets 
that will be seen by C. If C sits on a popular route it can prevent reflector
attacks on A and B. Still, packets spoofing other sources can reach A and B
even if they cross C.

My research has also shown that RBF, HCF and SPI can eliminate 95-97% of 
spoofed and reflected traffic when deployed at 50 selected ASes (that 
belong to 20 selected ISPs which are all tier-1 providers). It's still 
unpublished but if there is an interest I can send a pointer to the draft.

[ingress]  P. Ferguson and D. Senie. Network Ingress Filtering: Defeating 
Denial of Service Attacks which employ IP Source Address Spoofing. 
IETF RFC 2267.

[hcf] C. Jin, H. Wang, and K.G. Shin. Hop-count filtering: an effective 
defense against spoofed DDoS traffic. In Proc. of the 10th ACM conference 
on Computer and communications security, 2003.

[rbf] K. Park and H.Lee. On the effectiveness of route-based packet filtering 
for distributed DoS attack prevention in power-law Internets. In Proc. 
of ACM SIGCOMM, 2006.

[idpf] Z. Duan, X. Yuan, and J. Chandrashekar. Constructing Inter-Domain 
Packet Filters to  Control IP Spoofing Based on BGP Updates. In Proc. of 
INFOCOM, 2006.

[spm] A. Bremler-Barr and H. Levy. Spoofing Prevention Method. In Proc. of 
INFOCOM, 2005.

[pass] X. Liu, X. Yang, D. Wetherall, and T. Anderson. Efficient and Secure 
Source Authentication with Packet Passports. In Proc. of SRUTI, 2006.

[spi] A. Perrig, D. Song, and A. Yaar. StackPi: A New Defense Mechanism 
against IP Spoofing and DDoS Attacks. Technical Report 
CMU-CS-02-208, CMU Technical Report, February 2003.

---

From: bgreene at cisco.com (Barry Greene (bgreene))
Date: Mon Mar 19 07:09:14 2007

> Gist: Ingress filtering is not deployed to a sufficient 
> extent to prevent high-rate attacks with spoofed traffic. 
> DDoS attacks still use spoofing and reflector attacks are on 
> the increase. Spoofing is thus very much an open problem.

Data? I hear this thrown around "spoofed attacks are on the increase
...." - but I never see the data to support that assertion. Contrast the
data seen in the security operations world (DA, NSP-SEC, etc.) and you
scratch you head - cause you don't see spoofed attacks as prime driver
nor a growing trend.

---

From: sunshine at cis.udel.edu (Jelena Mirkovic)
Date: Mon Mar 19 07:12:49 2007

> scratch you head - cause you don't see spoofed attacks as prime driver

The rest of the note contained a reference to backscatter study that 
supports claim of 100-attacks-per-day-w-spoofing and a reference to 
recursive DNS attacks that use spoofing for reflection and were on the 
rise in 2006. Would you like more references? There is no "global" 
reference, just a lot of attack cases that pop and that use spoofing. I 
don't think spoofing is on the rise but I do think it is still very much 
present.

Jelena