Re: [RPSEC] DDoS of routing ?

JI,

Thursday, March 13, 2003, 8:49:46 PM, John Ioannidis wrote:
> DoS attacks on the BGP port are apparently fairly common, at least
> according to what I heard at the last NANOG.  The problem is that the
> pipe *to* the RP in many current routers is not all that fat, and even
> a small flooding attack against port 179 can take out the RP, and
> hence the router.

The problem is actually not BGP specific. BGP (as well as OSPF, or
LDP) just opens a generic queue and CPU exhaustion vulnerability.
Whenever a potentially forged packet (be that OSPF, RIP, or BGP)
shares resources with a valid packet (any type again), an attack is
possible.

Strictly speaking, the attack is not even MD5-specific, MD5 just
makes its success chances higher because it reduces the rate of
queue draining and increases CPU utilization.

> That particular vulnerability is fairly easy to fix; just deny
> anything *to* port 179 that's not coming from an adjacent router (that
> is, with TTL 255 or 254, depending on exactly what you are running),
> and that can stop all simple attacks.  Obviously, this doesn't work
> against multihop BGP;

Correct. BTSH solves a very focused problem--eBGP. The TTL hack
principle could be described using the notion of "trust radius", which
is (255-TTL). When it is 0 or 1, you're fine, because you don't expect
an attacker to be so close to your eBGP speaker. Once you increase it,
the probability of an attacker being within the trust proximity grows
very fast. So, this does not work for iBGP, or OSPF VLs (as well as
other multihop protocols used within a SP's network such as SSH or
SNMP).

> there you need crypto that's actually terminated
> at the line card (or outside the router); again, you don't want the
> cryptographic verification of your packets happening on the RP, for
> obvious reasons.

draft-zinin-rtg actually tries to solve a generic problem of attacks
from users (the iBGP and OSPF included) without the need for
additional HW, which should allow it to be implemented even on already
installed routers.

Alex

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec