Vulnerabilities / Threats

10/13/2016
04:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Internet Routing Security Effort Gains Momentum

More than 40 network operators agree to filter routing information, prevent IP address-spoofing, and to work together to thwart Internet traffic abuse and problems.

Cybercriminals and nation-state hackers routinely hide behind phony IP addresses to mask their location and identity, but an Internet initiative that seeks to thwart that and other malicious and inadvertent traffic on the global Net now has on board some 42 network operators crisscrossing 21 nations.

The Internet Society's Mutually Agreed Norms for Routing Security (MANRS), which launched nearly two years ago as a plan for advancing the security and resilience of the Net's routing infrastructure, has signed up network operators in Asia, North and South America, Africa, and Europe, including six network providers from Russia, five in the Netherlands, five in the US, and four in Germany. AT&T, Comcast, and Level 3, are among the largest US ISPs that have joined the effort.

MANRS consists of four practices: filtering, anti-spoofing, coordination among providers, and global validation. Participating network providers must deploy at least one of them (and it can't just be the coordination activity). According to the Internet Society, the majority of providers have deployed all four practices and none so far have enacted less than three of them.

The effort is one element of the overall vision of updating the aging Internet architecture to address the security issues that weren't an issue back when the Net was built. Security experts such as Dan Kaminsky have been calling for better security on the Net to restore trust and thwart attackers who use it to do their dirty work.

Andrei Robachevsky, technology programme manager for the Internet Society, says the challenge with routing on the Net today is that each network operator must implicitly trust the routing information provided by its neighboring provider when moving traffic.

"Many network operators do this blindly: what my peer said might be true … But it's really easy for false information [to be sent] on the Internet. That results in a situation where traffic and flow goes to an undesired path, or traffic can go to an undesired destination and not the real destination," such as to a malicious actor or for malicious activity, he says.

Network routing errors also can cause big Internet traffic problems. Take the YouTube outage of 2008, he says, which was caused by Pakistan Telecom trying to censor YouTube from that nation. The network provider impersonated YouTube for its local operators in order to keep customers from viewing YouTube, but due to an error in configuration that spread to the larger Internet, most users worldwide were knocked off YouTube for two hours, he recalls. "It was a misconfiguration," Robachevsky says. "The majority [of route filtering] is misconfigurations or mistakes. But there are also malicious attacks that abuse the routing system."

MANRS basically defines a specific set of minimum measures to provider routing security across the Net, he says. Filtering helps prevent phony or incorrect routing information. "You clean your side of the street," he says.

Preventing traffic with spoofed IP addresses can help thwart distributed denial-of-service (DDoS) attacks, which often hide behind phony IPs. "A huge class of volumetric reflection amplification DDoS attacks' root cause is the ability to spoof traffic and IP addresses," he says. "If you close this … it will significantly diminish the prevalence of those attacks."

The other two measures are about network operators working more closely together: one is to communicate and coordinate among their peer networks to stop security threats, for example. It will help network operators know who to contact in the event of a network incident, and to keep their information updated.

The other such practice is validating routing information, so now there will be a database of that information that can be used for reference, he says.

Not all network operators will participate or cooperate, of course. Network operators or regions that abuse the Internet infrastructure for cybercrime or other nefarious activity won't join MANRS, according to Robachevsky, but their lack of participation ultimately could make them more conspicuous.

"We’re closing the window," he says.

Internet pioneer Paul Vixie says MANRS is an important effort in securing the Internet infrastructure. "Look no further than the war I've been fighting against [malicious] source addresses," says Vixie, CEO of FarSight Security. "We would like this looking at source addresses to become a norm … This self-regulation can work."

Don't expect abuse of the Net to decline dramatically right away, however. "The fact that you can rule out certain sources where this packet came from gives us a smaller number of suspects you [network operators] can focus your energy on," Vixie says.

MANRS could provide just the push needed for other areas of improving Internet infrastructure security. "If this succeeds, it's going to inspire something similar in other communities, like DNS," Vixie says. "It's also going to cause people to say now that we've removed the low-hanging fruit and filtered out the obvious bad crap, we can finally see what the landscape looks like … and we may see another landscape we need to address."

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10008
PUBLISHED: 2019-04-24
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login a...
CVE-2019-9950
PUBLISHED: 2019-04-24
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials agains...
CVE-2019-9951
PUBLISHED: 2019-04-24
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php...
CVE-2018-10055
PUBLISHED: 2019-04-24
Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.
CVE-2018-7577
PUBLISHED: 2019-04-24
Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.