Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/13/2016
04:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Internet Routing Security Effort Gains Momentum

More than 40 network operators agree to filter routing information, prevent IP address-spoofing, and to work together to thwart Internet traffic abuse and problems.

Cybercriminals and nation-state hackers routinely hide behind phony IP addresses to mask their location and identity, but an Internet initiative that seeks to thwart that and other malicious and inadvertent traffic on the global Net now has on board some 42 network operators crisscrossing 21 nations.

The Internet Society's Mutually Agreed Norms for Routing Security (MANRS), which launched nearly two years ago as a plan for advancing the security and resilience of the Net's routing infrastructure, has signed up network operators in Asia, North and South America, Africa, and Europe, including six network providers from Russia, five in the Netherlands, five in the US, and four in Germany. AT&T, Comcast, and Level 3, are among the largest US ISPs that have joined the effort.

MANRS consists of four practices: filtering, anti-spoofing, coordination among providers, and global validation. Participating network providers must deploy at least one of them (and it can't just be the coordination activity). According to the Internet Society, the majority of providers have deployed all four practices and none so far have enacted less than three of them.

The effort is one element of the overall vision of updating the aging Internet architecture to address the security issues that weren't an issue back when the Net was built. Security experts such as Dan Kaminsky have been calling for better security on the Net to restore trust and thwart attackers who use it to do their dirty work.

Andrei Robachevsky, technology programme manager for the Internet Society, says the challenge with routing on the Net today is that each network operator must implicitly trust the routing information provided by its neighboring provider when moving traffic.

"Many network operators do this blindly: what my peer said might be true … But it's really easy for false information [to be sent] on the Internet. That results in a situation where traffic and flow goes to an undesired path, or traffic can go to an undesired destination and not the real destination," such as to a malicious actor or for malicious activity, he says.

Network routing errors also can cause big Internet traffic problems. Take the YouTube outage of 2008, he says, which was caused by Pakistan Telecom trying to censor YouTube from that nation. The network provider impersonated YouTube for its local operators in order to keep customers from viewing YouTube, but due to an error in configuration that spread to the larger Internet, most users worldwide were knocked off YouTube for two hours, he recalls. "It was a misconfiguration," Robachevsky says. "The majority [of route filtering] is misconfigurations or mistakes. But there are also malicious attacks that abuse the routing system."

MANRS basically defines a specific set of minimum measures to provider routing security across the Net, he says. Filtering helps prevent phony or incorrect routing information. "You clean your side of the street," he says.

Preventing traffic with spoofed IP addresses can help thwart distributed denial-of-service (DDoS) attacks, which often hide behind phony IPs. "A huge class of volumetric reflection amplification DDoS attacks' root cause is the ability to spoof traffic and IP addresses," he says. "If you close this … it will significantly diminish the prevalence of those attacks."

The other two measures are about network operators working more closely together: one is to communicate and coordinate among their peer networks to stop security threats, for example. It will help network operators know who to contact in the event of a network incident, and to keep their information updated.

The other such practice is validating routing information, so now there will be a database of that information that can be used for reference, he says.

Not all network operators will participate or cooperate, of course. Network operators or regions that abuse the Internet infrastructure for cybercrime or other nefarious activity won't join MANRS, according to Robachevsky, but their lack of participation ultimately could make them more conspicuous.

"We’re closing the window," he says.

Internet pioneer Paul Vixie says MANRS is an important effort in securing the Internet infrastructure. "Look no further than the war I've been fighting against [malicious] source addresses," says Vixie, CEO of FarSight Security. "We would like this looking at source addresses to become a norm … This self-regulation can work."

Don't expect abuse of the Net to decline dramatically right away, however. "The fact that you can rule out certain sources where this packet came from gives us a smaller number of suspects you [network operators] can focus your energy on," Vixie says.

MANRS could provide just the push needed for other areas of improving Internet infrastructure security. "If this succeeds, it's going to inspire something similar in other communities, like DNS," Vixie says. "It's also going to cause people to say now that we've removed the low-hanging fruit and filtered out the obvious bad crap, we can finally see what the landscape looks like … and we may see another landscape we need to address."

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7964
PUBLISHED: 2020-01-24
An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
CVE-2020-5224
PUBLISHED: 2020-01-24
In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the sess...
CVE-2020-7052
PUBLISHED: 2020-01-24
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.
CVE-2014-4172
PUBLISHED: 2020-01-24
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service paramet...
CVE-2013-1597
PUBLISHED: 2020-01-24
A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let a malicious user obtain user credentials.