Using Loops Observed in Traceroute to Infer the Ability to Spoof

Abstract

Abstract. Despite source IP address spoofing being a known vulnerability for at least 25 years, and despite many efforts to shed light on the problem, spoofing remains a popular attack method for redirection, amplification, and anonymity. To defeat these attacks requires operators to ensure their networks filter packets with spoofed source IP addresses, known as source address validation (SAV), best deployed at the edge of the network where traffic originates. In this paper, we present a new method using routing loops appearing in traceroute data to infer inadequate SAV at the transit provider edge, where a provider does not filter traffic that should not have come from the customer. Our method does not require a vantage point within the customer network. We present and validate an algorithm that identifies at Internet scale which loops imply a lack of ingress filtering by providers. We found 703 provider ASes that do not implement ingress filtering on at least one of their links for 1,780 customer ASes. Most of these observations are unique compared to the existing methods of the Spoofer and Open Resolver projects. By increasing the visibility of the networks that allow spoofing, we aim to strengthen the incentives for the adoption of SAV.

Don’t Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic

“…• Autonomous systems: while based on a few received queries, we cannot by any means conclude on the filtering policies of the whole AS-they reveal SAV compliance for a part of it [3,4,18,19].…”

“…The reasons for not performing packet filtering include incidentally filtering out legitimate traffic, equipment limitations, and lack of a direct economic benefit. The last aspect assumes outbound SAV when the deployed network can become an attack source but cannot [20,15] outbound absence yes yes Traceroute loops [18] outbound absence yes yes Passive detection [16,21] outbound both no no Our method [5] inbound both yes no be attacked itself. Performing inbound SAV protects networks from, for example, the threats described above, which is beneficial from the economic perspective.…”

Inferring the Deployment of Inbound Source Address Validation Using DNS Resolvers

“…There exist methods aimed at enumerating networks without packet filtering [1][2][3][8][9][10][11][12][13][14][15]. However, a great majority of the existing work concentrates on outbound SAV, the root of DDoS attacks [8].…”

vrfinder

“…When a router receives a packet to an unused portion of internal address space, the destination address may match a default route and return via the router interface that received the packet. In 2017, Lone et al [39] used detection of these persistent forwarding loops to infer networks that did not deploy source address validation (SAV) to filter packets with spoofed source IP addresses; in Fig. 2 1 should discard packets with source address 203.0.113.1 because the address is not valid for that attachment point, i.e., does not match a route via 3 .…”