Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/13/2016
04:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Internet Routing Security Effort Gains Momentum

More than 40 network operators agree to filter routing information, prevent IP address-spoofing, and to work together to thwart Internet traffic abuse and problems.

Cybercriminals and nation-state hackers routinely hide behind phony IP addresses to mask their location and identity, but an Internet initiative that seeks to thwart that and other malicious and inadvertent traffic on the global Net now has on board some 42 network operators crisscrossing 21 nations.

The Internet Society's Mutually Agreed Norms for Routing Security (MANRS), which launched nearly two years ago as a plan for advancing the security and resilience of the Net's routing infrastructure, has signed up network operators in Asia, North and South America, Africa, and Europe, including six network providers from Russia, five in the Netherlands, five in the US, and four in Germany. AT&T, Comcast, and Level 3, are among the largest US ISPs that have joined the effort.

MANRS consists of four practices: filtering, anti-spoofing, coordination among providers, and global validation. Participating network providers must deploy at least one of them (and it can't just be the coordination activity). According to the Internet Society, the majority of providers have deployed all four practices and none so far have enacted less than three of them.

The effort is one element of the overall vision of updating the aging Internet architecture to address the security issues that weren't an issue back when the Net was built. Security experts such as Dan Kaminsky have been calling for better security on the Net to restore trust and thwart attackers who use it to do their dirty work.

Andrei Robachevsky, technology programme manager for the Internet Society, says the challenge with routing on the Net today is that each network operator must implicitly trust the routing information provided by its neighboring provider when moving traffic.

"Many network operators do this blindly: what my peer said might be true … But it's really easy for false information [to be sent] on the Internet. That results in a situation where traffic and flow goes to an undesired path, or traffic can go to an undesired destination and not the real destination," such as to a malicious actor or for malicious activity, he says.

Network routing errors also can cause big Internet traffic problems. Take the YouTube outage of 2008, he says, which was caused by Pakistan Telecom trying to censor YouTube from that nation. The network provider impersonated YouTube for its local operators in order to keep customers from viewing YouTube, but due to an error in configuration that spread to the larger Internet, most users worldwide were knocked off YouTube for two hours, he recalls. "It was a misconfiguration," Robachevsky says. "The majority [of route filtering] is misconfigurations or mistakes. But there are also malicious attacks that abuse the routing system."

MANRS basically defines a specific set of minimum measures to provider routing security across the Net, he says. Filtering helps prevent phony or incorrect routing information. "You clean your side of the street," he says.

Preventing traffic with spoofed IP addresses can help thwart distributed denial-of-service (DDoS) attacks, which often hide behind phony IPs. "A huge class of volumetric reflection amplification DDoS attacks' root cause is the ability to spoof traffic and IP addresses," he says. "If you close this … it will significantly diminish the prevalence of those attacks."

The other two measures are about network operators working more closely together: one is to communicate and coordinate among their peer networks to stop security threats, for example. It will help network operators know who to contact in the event of a network incident, and to keep their information updated.

The other such practice is validating routing information, so now there will be a database of that information that can be used for reference, he says.

Not all network operators will participate or cooperate, of course. Network operators or regions that abuse the Internet infrastructure for cybercrime or other nefarious activity won't join MANRS, according to Robachevsky, but their lack of participation ultimately could make them more conspicuous.

"We’re closing the window," he says.

Internet pioneer Paul Vixie says MANRS is an important effort in securing the Internet infrastructure. "Look no further than the war I've been fighting against [malicious] source addresses," says Vixie, CEO of FarSight Security. "We would like this looking at source addresses to become a norm … This self-regulation can work."

Don't expect abuse of the Net to decline dramatically right away, however. "The fact that you can rule out certain sources where this packet came from gives us a smaller number of suspects you [network operators] can focus your energy on," Vixie says.

MANRS could provide just the push needed for other areas of improving Internet infrastructure security. "If this succeeds, it's going to inspire something similar in other communities, like DNS," Vixie says. "It's also going to cause people to say now that we've removed the low-hanging fruit and filtered out the obvious bad crap, we can finally see what the landscape looks like … and we may see another landscape we need to address."

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12551
PUBLISHED: 2019-07-22
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
CVE-2019-12552
PUBLISHED: 2019-07-22
In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.
CVE-2019-3414
PUBLISHED: 2019-07-22
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front en...
CVE-2019-10102
PUBLISHED: 2019-07-22
tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". Th...
CVE-2019-10102
PUBLISHED: 2019-07-22
aubio 0.4.8 and earlier is affected by: null pointer. The impact is: crash. The component is: filterbank. The attack vector is: pass invalid arguments to new_aubio_filterbank. The fixed version is: after commit eda95c9c22b4f0b466ae94c4708765eaae6e709e.