An Toàn L P 3 - Routing Attacks: Nguyen Hong Son Ptithcm

1
AN TOÀN LỚP 3– ROUTING ATTACKS

Nguyen Hong Son
PTITHCM
2
Overview
• Router
• Routing
• Forwarding
• RoutingTable
• Routing algorithms
• Routing protocols
• Routed protocols
3
Routing protocol vulnerability (1/2)

• The routing update messages sent by the routing
protocols are maliciously modified or deleted the routing
table may contain wrong entries that could result in
the breakdown of one or more domains
• Existing routing protocols were designed in a more
beginning era in the Internet, and assumed to be run in a
trustful environment
• The primary source of vulnerability of routing protocols is
the lack of verification of routing information
4
Routing protocol vulnerability (2/2)

• When a router is attacked, it is possible that the whole
network is affected. Some of the consequences include:

• Loop: Could be caused by incorrect routing advertisements.
• Delay: When longer/slower route is incorrectly assumed to be the
optimal path.
• Destination unreachable: Packets may be redirected to a black hole.
• Link congestion: Could be caused when a link is wrongly

advertised as having a higher bandwidth than its original value.
• Network load: Loop and retransmissions increase the overall

network load.
5
Routing attacks
• Two sources of incorrect routing information – by internal and external
attacks :
• External attacks, also called link attacks
• Internal attacks, also called router attacks
6
External Attacks: Finding Routers

• To attack the routing infrastructure, the first thing to know is the information of
routers.
• A simple example is the default gateway
• Another simple way to learn the information of routers is the use of
the traceroute utility.
• The best way is to listen to routers’ signaling. Any host computer which
shares the same broadcast domain with the routers or knows the
corresponding multicast address (see below), is able to obtain the routing
protocol messages.
7
External Attacks: Forms of Link Attacks

• Interruption: It is to intercept routing messages and stop
them from propagating further
• Modificiation: to modify the content of existing routing
update messages
• Fabricaton: to create new update messages that look
legitimate
• Replication: to capture routing update messages and
replay them at a later time

8
Common solutions to external attacks (1/2)

• Most routers support route distribution lists that are used to
restrict the spread of routing updates
• One can use network analyzer software to sniff the network traffic.
The traffic can contain information that can be used to map the
network and identify its weak points to sniff the traffic, the network
interface has to be in promiscuous mode to identify which
computer is sniffing the traffic, we can detect which network
interfaces are in promiscuous mode (by tools)
• Many existing routing protocols such as RIP2, OSPF, and BGP
support password authentication. However, many of them transfer
password in clear text format
9
Common solutions to external attacks (2/2)

• Digital signature is a mechanism to ensure the integrity and
authenticity of update messages.
• Acertificate authority (CA) trusted byall routers has to exist. The authority is
responsible to issue a pair of Public Key and Private Key to all the routers in the
network
10
Internal Attacks
• Incorrect routing information is sent from a router. There are
different kinds of router attack:
• Masquerading routers: forges the identity of an authorized router, a
result of the IP spoofing or source routing attacks.
• Subverted routers: An authorized router is caused to disobey the
routing protocols, or forced to claim incorrect system parameter, by
ways: making use of the bugs in the router operating system,
miconfiguring the system files, or causing a router to load malicious
software
• Unauthorized routers: A router is not authorized but manages to join
the routing network and participate in the routing protocol
exchange dialog. It can occur if the access control mechanisms are
not well designed or configured
11
Internal Attacks: Breaking into router OS

• Network devices perform according to what they are
configured to perform.
• Whoever controls these devices could control the

network
• Code leakage of router operating system
• Software network devices is getting popular, even from
Cisco, suffer from the software flaws or exploitation

12
Internal Attacks: Password cracking

• Using default or easy-guessing passwords, and retrieving the
device configure file from TFTP server that does not need
authentication
• To crack a MD5 hash of password, the brute force process can be
performed. There are a lot of tools performing this process:
• John the Ripper, (http://www.openwall.com/john)
• HTC-Hydra (http://freeworld.thc.org/thc-hydra)
• Cain & Abel package (http://www.oxid.it/cain.html)
• Countermeasure for the process of bruteforcing: lengthy password

containing a mixture of numbers, letters, and special characters
13
Internal Attacks: Abusing password recovery

• Another way to crack the password is to achieve by
performing the password recovery process
• Password recovery procedure is to instruct the router to
boot without concerning the configuration file.
• Recovery procedure is available on the router manual and the
Internet
• The only way to prevent this is through the use of basic
physical countermeasure such as locking the router in a

rack placed in a secure room
14
RIP Attacks
• A malicious router advertising routing update messages
with incorrect information (e.g., wrong hop count).
• Routers do not have the full network topology, will believe
the content of the messages and update its routing table

accordingly.
• Router redirect traffic to an undesired path, causing
problems such as traffic congestion and even denial of

service
15
RIP Attacks: Countermeasures

• Using common knowledge of all the routers in the network
• By running a path-based algorithm in the routers,

example:
• Consistency Check (CC)
• Pivot-based Algorithm for Inconsistency Recovery (PAIR)

16
Consistency Check Algorithm

• Use of the predecessor information to verify the consistency
and integrity of a given update entry
• A distance vector update consists of multiple entries, and
each entry has three columns: 1) destination node, 2) shortest
distance, and 3) the predecessor for each shortest path
• Whenever a node receives an update, it carries out a
consistency check process to verify the path consistency
• During the consistency check, path will be traced back to each
destination. If there is no conflict, it implies that the just
received update can be trusted
17
Consistency Check Algorithm: Identify a

correct update
• Node 3 has just advertised a routing update
message.
• its neighbors (i.e., nodes 1, 4 and 5) will
perform a consistency check by tracing the
paths from each destination to node 3
• Node 1 starts the checking from the
destination node 6 (to node 3)
• Since the number of trace back (2) matches
the hop counts (L=2) listed in the update
message, the CC algorithm proves that the
path from node 6 to node 3 is consistent
18
Consistency Check Algorithm: Identify an

incorrect update
19
Consistency Check Algorithm: Fail to identify an

incorrect update
20
Pivot-based Algorithm for Inconsistency Recovery

(PAIR)
• Pivot-based Algorithm for Inconsistency Recovery (PAIR)
is another path-based algorithm to detect router attacks.
• The merit of it over the CC algorithm is that it provides the
error recovery functionality

21
PAIR: Operations
1. Tree Construction
2. Metrics Calculation
3. Detection Procedure
4. Recovery Procedure
22
Tree Construction
23
Metrics Calculation
24
Detection Procedure
25
Recovery Procedure
Refer to:
Anirban Chakrabarti and G. Manimaran, “A Scalable

Algorithm for Malicious Update Detection & Recovery in
Distance Vector Protocols,” in DCNL Technical Report, July
2002.
26
OSPF Attacks
• Open Shortest Path First (OSPF) is the most popular link state
protocol
• The operations of OSPF consist of three phases:
1. Meeting the neighbors

2. Exchanging link information
3. Calculating shortest routes
• Phase 2 is crucial to the correct routing operations. If a
malicious LSA is received, the content of the link state
database and the calculated shortest paths will become
incorrect
27
OSPF Attacks: Countermeasures

• Cryptography solutions
• Hash Chains
28
BGP Attacks
• Primary Vulnerabilities
• Attack Objectives
• Black Hole
• Traffic Redirection
• Traffic Subversion
• Instability
• Attack Mechanisms
• Prefix Hijacking
• Prefix De-aggregation
• Contradictory Advertisements
• Exploitation of route damping
29
BGP Attacks: Countermeasures

• Route filtering
• Secure BGP (S-BGP)
• Secure Origin BGP (so-BGP)
• Interdomain Routing Validation (IRV)

An Toàn L P 3 - Routing Attacks: Nguyen Hong Son Ptithcm

Uploaded by

Copyright:

Available Formats

An Toàn L P 3 - Routing Attacks: Nguyen Hong Son Ptithcm

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

An Toàn L P 3 - Routing Attacks: Nguyen Hong Son Ptithcm

Uploaded by

Copyright:

Available Formats

1

AN TOÀN LỚP 3– ROUTING ATTACKS

Routing protocol vulnerability (1/2)

Routing protocol vulnerability (2/2)

network is affected. Some of the consequences include:

• Delay: When longer/slower route is incorrectly assumed to be the

• Destination unreachable: Packets may be redirected to a black hole.

• Link congestion: Could be caused when a link is wrongly

• Network load: Loop and retransmissions increase the overall

External Attacks: Finding Routers

• A simple example is the default gateway

• Another simple way to learn the information of routers is the use of

the traceroute utility.

External Attacks: Forms of Link Attacks

them from propagating further

• Modificiation: to modify the content of existing routing

• Fabricaton: to create new update messages that look

• Replication: to capture routing update messages and

replay them at a later time

Common solutions to external attacks (1/2)

Common solutions to external attacks (2/2)

Internal Attacks: Breaking into router OS

• Whoever controls these devices could control the

• Code leakage of router operating system

• Software network devices is getting popular, even from

Cisco, suffer from the software flaws or exploitation

Internal Attacks: Password cracking

• Cain & Abel package (http://www.oxid.it/cain.html)

• Countermeasure for the process of bruteforcing: lengthy password

Internal Attacks: Abusing password recovery

• Password recovery procedure is to instruct the router to

boot without concerning the configuration file.

• Recovery procedure is available on the router manual and the

• The only way to prevent this is through the use of basic

physical countermeasure such as locking the router in a

with incorrect information (e.g., wrong hop count).

• Routers do not have the full network topology, will believe

the content of the messages and update its routing table

• Router redirect traffic to an undesired path, causing

problems such as traffic congestion and even denial of

RIP Attacks: Countermeasures

• By running a path-based algorithm in the routers,

• Pivot-based Algorithm for Inconsistency Recovery (PAIR)

Consistency Check Algorithm

Consistency Check Algorithm: Identify a

Consistency Check Algorithm: Identify an

Consistency Check Algorithm: Fail to identify an

Pivot-based Algorithm for Inconsistency Recovery

• Pivot-based Algorithm for Inconsistency Recovery (PAIR)

is another path-based algorithm to detect router attacks.

• The merit of it over the CC algorithm is that it provides the

error recovery functionality

Anirban Chakrabarti and G. Manimaran, “A Scalable

1. Meeting the neighbors

OSPF Attacks: Countermeasures

BGP Attacks: Countermeasures

You might also like