Re: [Sidrops] Stalloris: RPKI Downgrade Attack

sure.. this seems pretty obvious from the system design.
I think you COULD say: "well, then unknowns also die in a fire with
invalids!"
but.. that's going to leave you with a very small internet :(

Ideally publication point operators are buidling robust and distributed
deployments that can be resilient in the face of both network problems and
bad actors.
Ideally publication retrievers are operating systems which are both nice to
the overall system and resilient in the case of network problems or remote
system problems.

I imagine we are a ways off from the perfect operations though.

On Tue, May 3, 2022 at 9:23 AM Hove, K.W. van (Koen, Student M-CS) <
k.w.vanhove@student.utwente.nl> wrote:

> Dear all,
>
> I recently became aware of this new pre-publication [1] from the
> Fraunhofer Institute for Secure Information Technology SIT and National
> Research Center for Applied Cybersecurity ATHENE titled " Stalloris: RPKI
> Downgrade Attack", that I believe might be of interest to you as well.
>
> The abstract reads:
>
> > We demonstrate the first downgrade attacks against RPKI. The key design
> property in RPKI that allows our attacks is the tradeoff between
> connectivity and security: when networks cannot retrieve RPKI information
> from publication points, they make routing decisions in BGP without
> validating RPKI. We exploit this tradeoff to develop attacks that prevent
> the retrieval of the RPKI objects from the public repositories, thereby
> disabling RPKI validation and exposing the RPKI-protected networks to
> prefix hijack attacks.
> > We demonstrate experimentally that at least 47% of the public
> repositories are vulnerable against a specific version of our attacks, a
> rate-limiting off-path downgrade attack. We also show that all the current
> RPKI relying party implementations are vulnerable to attacks by a malicious
> publication point. This translates to 20.4% of the IPv4 address space.
> > We provide recommendations for preventing our downgrade attacks.
> However, resolving the fundamental problem is not straightforward: if the
> relying parties prefer security over connectivity and insist on RPKI
> validation when ROAs cannot be retrieved, the victim AS may become
> disconnected from many more networks than just the one that the adversary
> wishes to hijack. Our work shows that the publication points are a critical
> infrastructure for Internet connectivity and security. Our main
> recommendation is therefore that the publication points should be hosted on
> robust platforms guaranteeing a high degree of connectivity.
>
> Personally, I do wonder how feasible this is in practice. I am in the
> process of trying to reproduce the experiment using the methods they
> describe, but so far to no avail. Should anyone else have any success (or
> lack thereof), please let me know.
>
> Cordially,
> Koen van Hove
>
> [1]
> https://www.usenix.org/conference/usenixsecurity22/presentation/hlavacek
>
> _______________________________________________
> Sidrops mailing list
> Sidrops@ietf.org
> https://www.ietf.org/mailman/listinfo/sidrops
>