Don’t Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic

Abstract

This paper concerns the problem of the absence of ingress filtering at the network edge, one of the main causes of important network security issues. Numerous network operators do not deploy the best current practice-Source Address Validation (SAV) that aims at mitigating these issues. We perform the first Internet-wide active measurement study to enumerate networks not filtering incoming packets by their source address. The measurement method consists of identifying closed and open DNS resolvers handling requests coming from the outside of the network with the source address from the range assigned inside the network under the test. The proposed method provides the most complete picture of the inbound SAV deployment state at network providers. We reveal that 32 673 Autonomous Systems (ASes) and 197 641 Border Gateway Protocol (BGP) prefixes are vulnerable to spoofing of inbound traffic. Finally, using the data from the Spoofer project and performing an open resolver scan, we compare the filtering policies in both directions.

Inferring the Deployment of Inbound Source Address Validation Using DNS Resolvers

“…We have started longitudinal measurements to infer the deployment of SAV in both IPv4 and IPv6 address spaces [6] and plan to notify all parties affected by the vulnerability.…”

“…In this paper, we report on the results of the Closed Resolver Project [6,7,19]. We propose a new method to identify networks not filtering inbound traffic based on source IP addresses.…”

Security Reputation Metrics

“…ISPs should also follow security bestpractices to mitigate abuse. Examples of some security best-practices for ISPs include the use of walled-gardens to quarantine and isolate infected machines connected to the Internet (C ¸etin et al 2018, 2019), or deploying Source Address Validation, also known as BCP38, to prevent Distributed Denial-of-Service (DDoS) attacks from being launched via their infrastructure (Luckie et al 2019; Korczyński et al 2020;Lone et al 2017). Yet, again, the voluntary nature of implementing such best practices results in certain ISPs experiencing a higher level of abuse than others due to having laxer security practices.…”

A Matter of Degree: Characterizing the Amplification Power of Open DNS Resolvers

“…Lack of destination side source address validation results in hosts behind a firewall to become partially accessible to externals leveraging source IP address spoofing [16,22]. DNS resolvers residing in such networks are known to be vulnerable to DNS cache poisoning attacks, but can also be misused in DDoS attacks.…”