Re: Re: [RPSEC] DDoS of routing ?

[John Ioannidis <[e-mail]>]

DoS attacks on the BGP port are apparently fairly common, at least
according to what I heard at the last NANOG.  The problem is that the
pipe *to* the RP in many current routers is not all that fat, and even
a small flooding attack against port 179 can take out the RP, and
hence the router.

That particular vulnerability is fairly easy to fix; just deny
anything *to* port 179 that's not coming from an adjacent router (that
is, with TTL 255 or 254, depending on exactly what you are running),
and that can stop all simple attacks.  Obviously, this doesn't work
against multihop BGP; there you need crypto that's actually terminated
at the line card (or outside the router); again, you don't want the
cryptographic verification of your packets happening on the RP, for
obvious reasons.

/ji


On Thu, Mar 13, 2003 at 06:55:21PM -0800, Alex Zinin wrote:
> Iljitsch, Senthil-
> 
> <AD hat off wrt this draft>
> 
> Thursday, March 13, 2003, 5:58:00 AM, Iljitsch van Beijnum wrote:
> > On Thu, 13 Mar 2003, Ayyasamy, Senthilkumar  (UMKC-Student) wrote:
> 
> >> while a DoS attack of routing pkts by a peer can lead to RT
> >> exhaustion, is DDoS of routing pkts observed previously?
> 
> > I think attacks on port 179 of routers have been observed in the wild.
> 
> This is what I have heard second hand too.
> 
> Note, btw, that user-level attacks against routers are not limited to
> those using routing protocols or targeted to CPU/queue exhaustion.
> Vulnerabilities related to various forms of buffer overflow, and other
> implementations bugs/suboptimalities have been known for long time.
> Those can be potentially exploited too.
> 
> And the attacks are getting more and more sophisticated, an example
> is the recently announced OSPF exploit where an attacker can make
> a router execute malicious code.
> 
> >> Actually, i had an offline discussion with sandy long back and she
> >> mentioned that it doesn't exist.
> 
> > You're not saying we should wait to fix holes until someone falls in
> > them, are you?
> 
> > At the same time, IGPs are somewhat hard to attack as they use
> > multicasts that routers aren't going to forward.
> 
> This is not entirely true.
> 
> IS-IS is indeed not susceptible to user-level attacks, as, in its
> original form it uses L2 encapsulation for its PDUs, and because those
> are unroutable, a user can't sent an IS-IS packet to a router.
> However, I'm hearing that some vendors have actually implemented
> ISIS-over-IPv4 though it wasn't accepted by the IS-IS WG. This could
> leave a potential backdoor for an attacker if the implementation just
> listens to this IP protocol or has it enabled on a set of interfaces.
> It would be as good/bad as in the OSPF case, no extra.
> 
> OSPF, on the other hand, uses unicast quite extensively. First, on
> broadcast media all neighbor-to-neighbor OSPF packet exchanges from
> ExStart and higher are done in unicast. Plus we have virtual links
> that are exclusively unicast. Besides, the specification suggests to
> treat both unicast and multicast packets equally, which is what many
> implementations do, especially if they allow manually configured
> neighbors. So, it is very possible for an attacker to send a packet to
> a router and it will be allowed to go all the way up to the OSPF
> process (unless MD5 is done on the LC, of course).
> 
> >> context: zinin-rtg-dos-00
> >> I guess, zinin draft talks only about DDoS of data traffic.
> 
> > Doesn't look that way to me.
> 
> Right.
> 
> In fact, it does not talk at all about data traffic DDoS. It is all
> about protecting routers' control plane from user-level attacks.
> 
> Alex
> 
> _______________________________________________
> RPSEC mailing list
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/rpsec
_______________________________________________
RPSEC mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/rpsec