Network Hygiene, Incentives, and Regulation

Abstract

The Spoofer project has collected data on the deployment and characteristics of IP source address validation on the Internet since 2005. Data from the project comes from participants who install an active probing client that runs in the background. The client automatically runs tests both periodically and when it detects a new network attachment point. We analyze the rich dataset of Spoofer tests in multiple dimensions: across time, networks, autonomous systems, countries, and by Internet protocol version. In our data for the year ending August 2019, at least a quarter of tested ASes did not filter packets with spoofed source addresses leaving their networks. We show that routers performing Network Address Translation do not always filter spoofed packets, as 6.4% of IPv4/24 tested in the year ending August 2019 did not filter. Worse, at least two thirds of tested ASes did not filter packets entering their networks with source addresses claiming to be from within their network that arrived from outside their network. We explore several approaches to encouraging remediation and the challenges of evaluating their impact. While we have been able to remediate 352 IPv4/24, we have found an order of magnitude more IPv4/24 that remains unremediated, despite myriad remediation strategies, with 21% unremediated for more than six months. Our analysis provides the most complete and confident picture of the Internet's susceptibility to date of this long-standing vulnerability. Although there is no simple solution to address the remaining long-tail of unremediated networks, we conclude with a discussion of possible non-technical interventions, and demonstrate how the platform can support evaluation of the impact of such interventions over time. CCS CONCEPTS• Networks → Network security.

Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

“…It can be divided into inbound source address validation (ISAV) and outbound source address validation (OSAV) [22], [14], [41]. While a majority of observed networks (∼85% prefixes and ∼70% autonomous systems) have deployed OSAV according to the Spoofer project [47], [9], [6], the lack of ISAV is much more pervasive [14], [41]. Therefore, it is crucial to understand the Internet-wide ISAV deployment.…”

“…While previous work for ISAV deployment measurements mainly relied on in-network volunteers [47], [9], [6] or DNS resolvers [41], [14], all of our measurements can be performed from one local vantage point with better coverage, and do not rely on in-network volunteers or in-network open DNS servers. Our measurements cover ∼9.7k ASes, finding that ∼79% of them are (partially) vulnerable to spoofing, which is the most large-scale measurement study of IPv6 ISAV to date.…”

“…IP source address spoofing refers to the process of sending packets having arbitrary IP addresses as their source IP addresses. These spoofed packets are difficult to trace and usually result in reflection and amplification attacks [47], [50], [41], flooding the victim with traffic. For example, a spoofingbased reflection attack against Amazon Web Services in 2020 resulted in record-breaking traffic of 2.3 Tbps [69].…”

“…Since the source address of inbound packets is unlikely to belong to the destination network, ISAV filters such packets to reduce the potential risk of spoofing-based attacks. Measurement studies already show that lack of ISAV is much more severe than OSAV [47], [9], [14], [41].…”

Routing Loops as Mega Amplifiers for DNS-Based DDoS Attacks

“…Thus, DNS packets with spoofed IP addresses can leave the network. Recent work showed that such misconfigured networks are still not uncommon on the Internet[33,31] and they are publicly listed[8]. The attacker does not have any special hardware or software requirements, because a single DNS packet, occasionally resent, is enough to keep the loop going.…”