A presentation given at APRICOT 2015 during the APCERT (4) session.

1. www.internetsociety.org
Collective responsibility
for security and resilience
of the global routing system
Andrei Robachevsky <robachevsky@isoc.org>

2. The Internet Society
Let us look at the problem first
• BGP is based on trust
• No validation of the legitimacy of
updates
• Tools outside BGP exist, but not
widely deployed
• BGPSEC is under development in
the IETF
2

3. The Internet Society
Let us look at the problem first
• Prefix hijack
• Announcing a prefix that does not belong to a
network
• Can involve “ASN hijacking”
• “Route leak”
• Violation of a “valley-free” principle
• E.g. a customer becoming a transit provider
3

4. The Internet Society
But also
• Source IP address spoofing
• Forging the source IP address of packets
• Collaboration
• How you reach someone on the other side of
the Net to help you out?
• How do you mitigate a DDoS?
4

5. The Internet Society
Impact
• Prefix hijack
• Denial of service, impersonating a
network or a service, traffic intercept
• “Route leak”
• Traffic intercept, but may result in denial
of service
• IP spoofing
• The root cause of reflection DDoS attacks
5

6. The Internet Society
Some cases
• DoS attacks
• Classics:
http://www.ripe.net/internet-coordination/news/industry-developments/youtube-hijacking-a-
ripe-ncc-ris-case-study
• https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho/
• IP squatting and spammers
• http://www.bgpmon.net/using-bgp-data-to-find-spammers/
• http://www.internetsociety.org/doc/mind-your-blocks-stealthiness-malicious-bgp-hijacks
• Traffic interception and impersonation
• http://research.dyn.com/2013/11/mitm-internet-hijacking/
• http://www.secureworks.com/cyber-threat-intelligence/threats/bgp-hijacking-for-
cryptocurrency-profit/
• http://www.bgpmon.net/turkey-hijacking-ip-addresses-for-popular-global-dns-providers/
6

7. The Internet Society
How do we address these problems?
• Tools
• Prefix and AS-PATH filtering, RPKI, IRR, …
• Ingress and egress anti-spoofing filtering, uRPF, …
• Coordination and DDoS mitigation
• Challenges
• Your safety is in someone other’s hands
• Too many problems to solve, too many cases
7

8. The Internet Society
The Mutually Agreed Norms for Routing Security
(MANRS)
8
• https://www.routingmanifesto.org/manrs/
• Defines a minimum package
• Emphasizes collective focus
“While the mass media often create awareness-knowledge of an
innovation, interpersonal communication with peers is necessary to
persuade most individuals to adopt a new idea”
(Rogers & Kincaid, 1981).

9. The Internet Society
The MANRS document, in more detail
• Principles of addressing issues of routing resilience
• Interdependence and reciprocity (including collaboration)
• Commitment to Best Practices
• Encouragement of customers and peers
• “The package” indicating the most important actions
• BGP Filtering
• Anti-spoofing
• Coordination and collaboration
• High-level document specifying “what”
• “How” is in external documents (e.g. BCPs)
9

10. The Internet Society
Where does the MANRS fit?
10
BCPs, BCOPs, RFCs, Operational
documentation, etc.
HOW?
WHAT is the minimum “PACKAGE”
and WHO supports it?
Real-life examples, threat analysis,
community aspirations
PROBLEM?
MANRS

11. The Internet Society
Good MANRS
1. Prevent propagation of incorrect
routing information
2. Prevent traffic with spoofed source
IP address
3. Facilitate global operational
communication and coordination
between the network operators
11

12. The Internet Society
Actions (1)
Prevent propagation of incorrect routing information
Network operator defines a clear routing policy and implements a system that
ensures correctness of their own announcements and announcements
from their customers to adjacent networks with prefix and AS-path granularity.
Network operator is able to communicate to their adjacent networks which
announcements are correct.
Network operator applies due diligence when checking the correctness of their
customer’s announcements, specifically that the customer legitimately holds
the ASN and the address space it announces.
12

13. The Internet Society
Actions (2)
Prevent traffic with spoofed source IP address
Network operator implements a system that enables source address
validation for at least single-homed stub customer networks, their
own end-users and infrastructure. Network operator implements anti-
spoofing filtering to prevent packets with an incorrect source IP address from
entering and leaving the network.
13

14. The Internet Society
Actions (3)
Facilitate global operational communication and
coordination between the network operators
Network operators should maintain globally accessible up-to-date
contact information.
14

15. The Internet Society
Actions (4)
Facilitate validation of routing information on a
global scale.
Network operator has publicly documented routing policy,ASNs and
prefixes that are intended to be advertised to external parties.
15

16. The Internet Society
MANRS is not (only) a document – it is a
commitment
1) The company supports the Principles and implements at least one of the
Actions for the majority of its infrastructure. Implemented Actions are marked with
a check-box. The Action "Facilitate global operational communication" cannot be
the only one and requires that another Action is also implemented.
2) The company becomes a Participant of MANRS, helping to maintain and improve
the document, for example, by suggesting new Actions and maintaining an up-to-
date list of references to BCOPs and other documents with more detailed
implementation guidance.
16

17. The Internet Society
Public launch of the initiative - 6 November 2014
17

18. The Internet Society
A growing list of participants
18

19. The Internet Society
Next Steps
• Expanding the group of participants
• Looking for industry leaders in the region
• Expanding the scope of the MANRS
• Raising the bar – defining new Actions
• Developing better guidance
• Tailored to MANRS
• In collaboration with existing efforts, like BCOP
19

20. The Internet Society
Further development
20

21. The Internet Society
Are you interested in participating?
21
Anti-Spoofing
Filtering
Coordination
Global scale

22. www.internetsociety.org
https://www.routingmanifesto.org/
https://www.manrs.org/