Re: [RPSEC] DDoS of routing ?

Iljitsch, Senthil-

<AD hat off wrt this draft>

Thursday, March 13, 2003, 5:58:00 AM, Iljitsch van Beijnum wrote:
> On Thu, 13 Mar 2003, Ayyasamy, Senthilkumar  (UMKC-Student) wrote:

>> while a DoS attack of routing pkts by a peer can lead to RT
>> exhaustion, is DDoS of routing pkts observed previously?

> I think attacks on port 179 of routers have been observed in the wild.

This is what I have heard second hand too.

Note, btw, that user-level attacks against routers are not limited to
those using routing protocols or targeted to CPU/queue exhaustion.
Vulnerabilities related to various forms of buffer overflow, and other
implementations bugs/suboptimalities have been known for long time.
Those can be potentially exploited too.

And the attacks are getting more and more sophisticated, an example
is the recently announced OSPF exploit where an attacker can make
a router execute malicious code.

>> Actually, i had an offline discussion with sandy long back and she
>> mentioned that it doesn't exist.

> You're not saying we should wait to fix holes until someone falls in
> them, are you?

> At the same time, IGPs are somewhat hard to attack as they use
> multicasts that routers aren't going to forward.

This is not entirely true.

IS-IS is indeed not susceptible to user-level attacks, as, in its
original form it uses L2 encapsulation for its PDUs, and because those
are unroutable, a user can't sent an IS-IS packet to a router.
However, I'm hearing that some vendors have actually implemented
ISIS-over-IPv4 though it wasn't accepted by the IS-IS WG. This could
leave a potential backdoor for an attacker if the implementation just
listens to this IP protocol or has it enabled on a set of interfaces.
It would be as good/bad as in the OSPF case, no extra.

OSPF, on the other hand, uses unicast quite extensively. First, on
broadcast media all neighbor-to-neighbor OSPF packet exchanges from
ExStart and higher are done in unicast. Plus we have virtual links
that are exclusively unicast. Besides, the specification suggests to
treat both unicast and multicast packets equally, which is what many
implementations do, especially if they allow manually configured
neighbors. So, it is very possible for an attacker to send a packet to
a router and it will be allowed to go all the way up to the OSPF
process (unless MD5 is done on the LC, of course).

>> context: zinin-rtg-dos-00
>> I guess, zinin draft talks only about DDoS of data traffic.

> Doesn't look that way to me.

Right.

In fact, it does not talk at all about data traffic DDoS. It is all
about protecting routers' control plane from user-level attacks.

Alex

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec