Secure Communication Properties

Properties of Secure Communication

• There are certain properties to ensure secure communication, even with attackers present

Sender, Receiver, and Intruder

• Communication involves a secure sender (e.g., Alice), a secure receiver (e.g., Bob), and a potential intruder (e.g., Trudy)

Confidentiality

• Confidentiality ensures that the message is understood only by the sender and receiver
• An intruder could perform an eavesdropping attack by sniffing and recording control and data messages
• Encrypting the message acts as a countermeasure, making it impossible to understand if intercepted

Integrity

• Integrity ensures the message remains unmodified during transit from sender to receiver
• An intruder could attack by modifying, inserting, or deleting parts of the message
• Changes can occur maliciously, or accidentally during transmission

Authentication

• Authentication confirms that the communicating parties are who they claim to be
• An intruder may impersonate another entity to steal information
• Authentication techniques are used as a countermeasure to verify identities

Availability

• Availability ensures the information or service provided is accessible when needed
• Proper functioning of the communication channel is needed in the presence of failures or denial-of-service attacks

DNS Abuse

• Attackers abuse DNS protocols to extend uptime of domains, used for malicious purposes like command and control, phishing, spam, and illegal content
• The goal is to remain undetectable for longer

Round Robin DNS (RRDNS)

• Used by large websites to distribute incoming requests to multiple servers at a single location
• Responds to a DNS request with a list of DNS A records, cycled through in a round robin fashion
• DNS client chooses a record using strategies like selecting the first record or the closest one
• Time to Live (TTL) specifies how long the response is valid
• Client receives the same set of records, in a different order, if the lookup is repeated while the mapping is active

DNS-based Content Delivery

• Content Distribution Networks (CDNs) distribute content using more complex DNS-based strategies
• CDNs distribute load among multiple servers across different locations
• The CDN computes the 'nearest edge server' based on network topology and link characteristics, returning its IP address to the DNS client

Fast-Flux Service Networks

• Fast-Flux Service Networks (FFSN) is an extension of RRDNS and CDN
• It uses rapid changes in DNS answers, with a TTL lower than that of RRDNS and CDN
• Returns a different set of A records from a larger set of compromised machines after the TTL expires
• Compromised machines act as proxies between incoming requests and a control node, forming a resilient one-hop overlay network

Content Retrieval Process for Benign HTTP Server

• DNS lookup returns the IP address of the control node of the domain
• HTTP GET request is sent to this control node
• The control node provides content directly

Content Retrieval Process for Content being Hosted in Fast-Flux Service Network

• The DNS lookup returns several IP addresses from compromised machines (flux agents)
• Each time the TTL expires, a lookup returns completely different IP addresses
• The flux agent relays HTTP GET requests to the control node, which sends the content back to the agent and the client

Inferring Network Reputation: Evidence of Abuse

• FIRE (Finding Rogue nEtworks) monitors the Internet for rogue networks involved in malicious activities like phishing and hosting spam
• Rogue networks are networks whose main purpose is malicious activity such as phishing, hosting spam pages, hosting pirated software, etc
• Uses three data sources to identify likely rogue networks

Botnet Command and Control Providers

• A bot-master prefers to host their C&C (Command and Control) on networks unlikely to be taken down
• IRC-based botnets and HTTP-based botnets are two main types of botnets that are considered

Drive-by-Download Hosting Providers

• Drive-by-download is malware installation without user interaction, often through a vulnerable browser

Phish Housing Providers

• URLs of servers host phishing are included
• Phishing pages mimic sites to steal login credentials, credit card numbers and data
• These pages are hosted on compromised servers and often only active for a short time

FIRE (Finding Rogue Networks) processes

• Legitimate networks remove malicious content within a few days, rogues can last weeks
• Disregards IP addresses active a short time to ignore phishing attacks
• Each data source produces a list of malicious IP addresses daily

FIRE identifies rogue AS

• Approach identifies the most malicious networks as having the highest ratio of malicious IP addresses to total owned IP addresses

Inferring Network Reputation: Interconnection Patterns

• Data plane monitoring flags networks with a large concentration of blacklisted IPs as malicious
• Requires observation of malicious behavior for a long time
• This analysis focuses on data plane monitoring, where a large number of IPs belonging to an AS were blacklisted for spamming, phishing, and hijacking

ASwatch

• ASwatch uses, exclusively, information from the control plane (i.e. routing behavior) to identify malicious networks
• ASwatch monitors global BGP routing to learn control plane behaviors
• Has two phases: A training phase, and an operational phase

Training Phase

• System learns control-plane behaviours, typical of known malicious and legitimate ASes
• Keeps track of businesses relationships and BGP updates/withdrawals
• Computes statistical features of each AS

Rewiring Activity

• Frequent changes in customers or providers and connecting with less popular providers are suspicious

IP Space Fragmentation and Churn

• Malicious ASes use small prefixes to partition their IP space, advertising small sections

BGP Routing Dynamics

• Malicious BGP announcements and withdrawals follow different patterns for short period of time

Operational Phase

• Calculates features for unknown ASes, and assigns a reputation score by a trained model
• A low reputation score for several days is deemed malicious

Inferring Network Reputation: Likelihood of Breach

• This estimates likelihood of security breach within an organization using external observable data
• Features used to train a Random Forest, resulting risk probability

Features Used

• Mismanagement which indicates gaps of failing to prevent attacks
• Open Recursive Resolvers - misconfigured open DNS resolvers
• DNS Source Port Randomization – many servers still do not implement this
• BGP Misconfiguration – short-lived routes can cause unnecessary updates to global routing table
• Untrusted HTTPS Certificates – can detect validity by TLS handshake, and Open SMTP Mail Relays

Malicious Activities

• Level to find sources from organization networks and infrastructure by using spam traps/darknet/DNS monitors to create a blacklist
• Capturing spam activity
• Capturing phishing and malware activities
• Capturing scanning activity

Security Incident Reports

• Data is based on actual incidents to train the machine model for wider coverage

Random Forest Algorithm

• Classifier compares it to baseline by support
• Vector Machine (SVM) has 258 features
• Division to test by timer value, secondary/statistics from said features, and organization size
• Inputs are processed and then fed to RF to produce a risk probability (float) by data

Traffic Attraction Attacks: BGP Hijacking

• BGP hijacking attacks classified in by different groups

Types of Classification

• By Affected Prefix: Concerns IP prefixes in Advertisement of Prefix
• Exact Prefix Hijacking: When two different ASes (one is genuine and the other one is counterfeit) announce a path for the same prefix that disrupts routing traffic toward hijacker

AS-Path Announcement

• AS for Path without ownership rights which has different ways to be achieved

Type-0

• Prefix not owned by the the annoucing AS

Type-N

• Counterfeit announces illegitimate path that does not own to create a fake link (path)

Type-U

• Hijacking AS change

Data-Plane Traffic Manipulation

• Intention to hijack network traffic and manipulate redirected network while on way to the AS
• Attacker intercepts in three ways to be achieved: Dropped, Eavesdropped that becomes man in middle, and Impersonated

Traffic Attraction Attacks: Motivations

• Can be classified by causes and motivations
• Human Error: Accidental routing occurs due to manual errors that leads to hijack of prefix
• Targeted Attack: Hijacking AS intercepts network traffic (MM attack) and operates in stealth mode to remain on radar
• High Impact Attack: Causes wide disruption of services such that Pakistan, and essentially blackholing to all of YouTube services for 2 hours

Example BGP Hijack Attacks

• Different of how attacks are carried out
• In legitimate, the AS announces and gets acknowledged by others
• In attac, announces to fake addresses

Announcing a New Prefix

• Attacker is announced through a router, that falls outside of its AS number

Scenario: Hijacking a Path

• Manipulates updates and is made by announcing prefix

Defending against Hijacking Attacks

ARTEMIS is run by local operators to ensure that safeguards are present toward a BPG hijacking attempts by self described manner

Key Aspects Behind Artemis

• Configuration file, as it will have records, and the mechanism for receiving and monitoring

Attacks by Mitigation Techniques

• Prefix deaggregation: Affected network contacts to simply deaggregates where attacked
• Mitigation with Multiple Origin AS (MOAS): Third party organizations and service of DDoS attac

Findings

• Outsourcing BGP announcements to thirds
• Comparison of outsourcing BGP against prefix filtering

Background

• Russian isp sends distress code to Nanog

Takeaway

• Attacker uses second to hijack to announce unallocated

HIJacking

• Made using vulnerability on DNS

DDS

• Background is spoofing, a DOS attack

Master

• Sends controlled messages directed to huge traffic to the victim

Spoofing IP

• Set of packet, which results with response on sever when is not intended but legitimate but for user on intended attack

DDOS

• Refection Attack on servers like DNS

Traffic Scrubbing Service

• Diverts the attack traffic to a specialized server, scrubb and clean traffic