USA 2002

### Overview This presentation examines the security landscape of IP backbone infrastructure, focusing on external and interior routing protocols, denial-of-service (DoS) detection and mitigation, and emerging technologies like MPLS and IPv6. In the post-9/11 context, the Internet is increasingly recognized as critical infrastructure that relies on a concentrated ecosystem of key protocols (BGP and DNS), a small number of major hardware vendors (such as Cisco and Juniper), and uniform software releases. The speakers review how misconfigurations, prefix hijackings, routing flaps, and advanced protocol-level attacks threaten backbone availability, before walking through tactical defense configurations, traffic accounting tools, and future traceback architectures.

### Key Topics - **Internet Vulnerabilities & Critical Infrastructure**: Risks posed by ISP collapses (e.g., WorldCom/UUNET), lack of validation between allocated prefixes and autonomous systems (AS), and relaxed filtering policies at major peering points and Internet Exchange Points (IXPs). - **Routing Protocol Security (BGP, OSPF, IS-IS)**: Vulnerabilities in BGPv4 (session dropping, TCP reset attacks, AS-path manipulation, deaggregation memory exhaustion) alongside IGP issues in OSPF (LSA injection, designated router hijacking) and IS-IS (data-link layer attacks, overload bit abuse). - **DoS Detection via NetFlow**: Using Cisco NetFlow (versions 5 and 8) alongside analysis tools like Caida's cflowd and FlowScan to identify abnormal traffic spikes, protocol anomalies, and packet size shifts. - **DoS Mitigation & Traceback Techniques**: Tactical countermeasures including Unicast RPF (uRPF in strict vs. loose mode), rate limiting, null-routing via BGP community/next-hop blackholing, and emerging academic traceback proposals. - **MPLS & IPv6 Security Considerations**: Architectural risks of Multi-Protocol Label Switching (MPLS) used as virtual circuits without native encryption or authentication, and security concerns at IPv4-to-IPv6 transition gateways.

### Technical Details - **BGP Hardening**: Speakers recommend deploying MD5 authentication, establishing BGP sessions over loopback interfaces, implementing maximum prefix limits to avoid routing table bloat (noting 110,000–140,000 routes at the time), and enforcing strict Ingress/Egress filtering against RFC 1918 and unallocated/bogon space using ACLs or routing to `null0` (`discard` on Juniper). The status of Secure BGP (S-BGP) from BBN is discussed as a promising PKI/origin-validation approach that requires extensive vendor implementation. - **IGP Protections**: In OSPF, attackers can exploit multicast LSA distribution or replay MD5 LSAs to break adjacencies; mitigation includes strict boundary filtering, turning networks into NBMA point-to-point configurations, and isolating customer interfaces. In IS-IS, which operates directly over Layer 2 without IP, tools must defend against LSP flooding and rogue DR preemption using HMAC-MD5 authentication (TLV 54). - **Mitigation Mechanisms**: - *Blackholing via BGP*: Configuring a static route to `null0` (e.g., using test network addresses) across all routers, then advertising the attack target's or source's next-hop to that blackhole route using private AS or no-export BGP communities. - *uRPF*: Enforcing strict mode where the reverse path must match the ingress interface, or loose check mode when asymmetric routing is present. - *Rate Limiting & NBAR*: Cisco Network-Based Application Recognition (NBAR) can detect worm patterns (like Code Red and Nimda) but is severely limited by router CPU impact, lack of Unicode/HTTPS inspection, and inspection bounds (only the first 400 bytes). - *Traceback Concepts*: Surveyed research concepts including ICMP Traceback, IP Traceback (using the IP ID field), snoop/SPIE traffic sampling, Pushback rate limiting, IDIP, and CenterTrack overlay networks. - **MPLS Realities**: MPLS acts purely as an ATM/Frame Relay-style virtual circuit for traffic engineering and Layer 2 transport, providing routing separation rather than confidentiality. Core injection attacks or signaling manipulation (via BGP/IS-IS) can silently alter VPN topologies; hence, MPLS should never be extended directly to customer premises equipment (CPE).

### Takeaways Backbone security relies on defense-in-depth and operational discipline rather than protocol defaults. Network operators must enforce strict prefix filtering, deploy MD5 authentication on all BGP and IGP peering sessions, avoid running dynamic routing protocols toward untrusted endpoints, and prepare automated BGP null-routing templates before DoS attacks occur. Furthermore, organizations should not treat MPLS VPNs as inherently secure encryption mechanisms and must protect underlying routing signaling to prevent silent traffic redirection.