Deployment of Source Address Validation by Network Operators: A Randomized Control Trial

Abstract

IP spoofing, sending IP packets with a false source IP address, continues to be a primary attack vector for largescale Denial of Service attacks. To combat spoofing, various interventions have been tried to increase the adoption of source address validation (SAV) among network operators. How can SAV deployment be increased? In this work, we conduct the first randomized control trial to measure the effectiveness of various notification mechanisms on SAV deployment.We include new treatments using nudges and channels, previously untested in notification experiments. Our design reveals a painful reality that contrasts with earlier observational studies: none of the notification treatments significantly improved SAV deployment compared to the control group. We explore the reasons for these findings and report on a survey among operators to identify ways forward. A portion of the operators indicate that they do plan to deploy SAV and ask for better notification mechanisms, training, and support materials for SAV implementation.

Who's Got My Back? Measuring the Adoption of an Internet-wide BGP RTBH Service

“…While it is not surprising to see the former two because these are the most developed regions in the world, Brazil is an unexpected member. At the same time, a recent study shows [30] that the adoption of the anti-DDoS security best practices (namely, source address validation) in Brazilian ISPs is significantly faster than in the rest of the world.…”

Understanding Route Origin Validation Deployment in the Real World and Why MANRS Action 1 Is Not Followed

“…Previous studies frequently encounter a high email bounce rate of over 50% [39], [40], [41], due to the incorrect or outof-date contact information in WHOIS [42]. Recently, Lone et al [43] propose that the reachability of notification emails can be effectively improved by prioritizing PeeringDB [44] and technical contacts. Therefore, we adopt the same method as Lone et al in our notification experiment.…”

“…To determine the appropriate contact for every non-deploying AS, we first check whether there is a technical email address in PeeringDB or WHOIS. If they correspond to two different technical email addresses, we prioritize the technical contact in PeeringDB because contacts in PeeringDB are considered more reliable [43], [45], [46]. If we cannot find a technical contact in PeeringDB and WHOIS, we choose to use the abuse contact and also prioritize the abuse contact in PeeringDB.…”

Routing Loops as Mega Amplifiers for DNS-Based DDoS Attacks

“…Several initiatives aim at reducing the possibility of DDoS attacks [1,5,6,11,27,28,30,34,37,38,46,47,49,55,61], for instance, measurements of the amplification potential of different protocols and notifications of the affected parties. Other non-profit initiatives, such as Shadowserver Foundation [51], provide daily reports to network operators and 132 national Computer Security Incident Response Teams (CSIRTs).…”

“…Thus, DNS packets with spoofed IP addresses can leave the network. Recent work showed that such misconfigured networks are still not uncommon on the Internet[33,31] and they are publicly listed[8]. The attacker does not have any special hardware or software requirements, because a single DNS packet, occasionally resent, is enough to keep the loop going.…”