Software Systems for Surveying
Spoofing Susceptibility
Matthew Luckie, Ken Keys, Ryan Koga,
Bradley Huffaker, Robert Beverly, kc claffy
https://spoofer.caida.org/IIJ, November 21st 2017w w w .caid a.org

What is the Problem?
• Lack of filtering allows anonymous denial of service attacks.
• Example: CloudFlare reports 400Gbps attacks on theirsystems through 2016

400Gbps
240Gbps
80Gbps
Feb 7

Feb 13

Feb 19Feb 25https://blog.cloudflare.com/a-winter-of-400gbps-weekend-ddos-attacks/2

What is the Problem?
• Lack of filtering allows anonymous denial of service attacks.
• Example: CloudFlare reports >1K DoS attack events on

their systems, per day, starting Feb 2016

1.4K
1K
600200
OctNovDecJanFebMar
https://blog.cloudflare.com/a-winter-of-400gbps-weekend-ddos-attacks/3

Why does spoofing matter?
• Attacker sends packet with spoofed source IP address• Receiver cannot always know if packet’s source is authentic

src dstsmall
requestpackets

V R
V R

src dstlarge
response
payload R Vpackets
payload R V

Attacker A
Receiver RVictim V
Volumetric Reflection-Amplification Attack4

Defenses• BCP38: Network ingress filtering: defeating denial of service

attacks which employ IP Source Address Spoofing- https://tools.ietf.org/html/bcp38- May 2000

• BCP84: Ingress filtering for multi-homed networks- https://tools.ietf.org/html/bcp84- March 2004
• Not always straightforward to deploy “source addressvalidation” (SAV): BCP84 provides advice how to deploy
5Tragedy of the Commons• Deploying source address validation is primarily for thebenefit of other networks• Incentive not clear for some networks- majority of networks do seem to deploy filtering- filtering gives an operator moral high-ground to pressureother networks to deploy, which does benefit the operator- “Cyber Insurance” takes into account security

practice of the network: QuadMetrics.com• ISOC RoutingManifesto.org: Mutually Agreed

Norms for Routing Security (MANRS)

6

Which networks have deployed filtering?
• No public data that allows a network to showthat they have (or have not) deployed filtering• OpenResolverProject: allows detection of which

networks have not deployed filtering based on DNS request
forwarding- requires a buggy open resolver- public reporting at network and AS level• MIT/CMAND Spoofer Project: aggregate statistics ofspoofability based on crowd-sourced tests- user had to manually run tests- no public reporting at network or AS level
7

Spoofer: Client/Server Overview
ClientTCP control connection Spoofer
ServerSpoofedpackets
CAIDA Ark Vantage Points

Database
8

Spoofer: Client/Server Overview• Client tests ability to spoof packets of different types- Routed and Private- IPv4 and IPv6
- Ingress and Egress• traceroute to infer forward path to destinations• tracefilter to infer first location of filtering in a path- traceroute but with spoofed packets• Filtering prefix granularity: how many addresses in the same

network prefix can be spoofed?

9

CAIDA Spoofer Project: New Features• Client/Server system provides new useful features- opt-in to publicly share anonymized results, andopt-in to share unanonymized results for remediation- Runs in background, automatically testing new networks thehost is attached to, once per week, IPv4 and IPv6

- GUI to browse test results from your host, and scheduletests- Speed improvements through parallelized probing

https://spoofer.caida.org/recent_tests.php
10CAIDA Spoofer Project: New Features• Reporting Engine publicly shows outcomes of sharable

tests- Allows users to select outcomes• per country: which networks in a country need attention?
• per ASN: which subnets need attention?
• per provider: which of my BGP customers can spoof?
- What address space does an AS announce, or could act astransit for? Is that address space stable?
• Useful for deploying ACLs

https://spoofer.caida.org/recent_tests.php11

Client GUI
SignedInstallers
MacOSWindowsLinuxOpenSourceC++
12

Client/Server Deployment• Since releasing new client in May 2016, increasing trend ofmore tests (yellow line)- Benefit of system running in background13

Reporting Engine: Recent Tests

14

Reporting Engine: Recent Tests
Able to break down by country, perhaps
useful for regional CERTs.
In this case US-CERT

15

Reporting Engine: Recent Tests

Addresses anonymized:
IPv4: /24
IPv6: /40

16

Reporting Engine: Recent Tests

NATs behave differently:
Some may block spoofed traffic
Some uselessly rewrite
Some do not rewrite and pass spoofed packets
17Reporting Engine: Recent Tests

Some spoofing from behind a NAT
prevented by egress filtering

18

Reporting Engine: Recent Tests

Some networks may have deployed IPv4 filtering,
but forgotten to deploy IPv6 filtering

19Notifications and Remediation• Currently, we (Matthew) manually send notifications to abuse

contacts of prefixes from which we received spoofed packet

https://spoofer.caida.org/remedy.php
20Notifications and Remediation
200

Pause in notifications
150

800
Remediation
600

100
400
50
200

0Jan’16

Notifications

May’16

Sep’16Jan’17May’17

Sep’17Jan’18Cumulative Remediation Inferences

Cumulative Notification Emails

10000Sent 1061 private notifications, 203 remediation inferences21

Delay from Notification to Remediation
10.9
0.8
0.7

CDF

0.6
0.5
0.4

50% within 5 weeks

0.3
0.2

22% within 1 week

0.1
00

10

20
30
Delay (Weeks)

40

5022

Practicality of Ingress Access Lists
ACLs are “the most bulletproof solution when done properly”, andthe “best fit ... when the configuration is not too dynamic, .. if thenumber of used prefixes is low”. - BCP84

Fraction of Stub ASes

During 2015, ~5% and ~3% of ASes announced different IPv4and IPv6 address space month-to-month, respectively.
25BCP−38

20IPv4IPv6BCP−841510
50
Jan’98Jan’00

Jan’02Jan’04Jan’06Jan’08Jan’10Jan’12

Jan’14Jan’16

Source: Routeviews and RIPE RIS data 23

Practicality of Ingress Access Lists
ACLs are the “best fit ... when the configuration is not too
dynamic, .. if the number of used prefixes is low”. - BCP84

11

Fraction unchanged

Fraction of Stub ASes

In August 2016, 86.9% of stub ASes would require an IPv4
ACL of no more than 4 prefixes. More than half of IPv4 ACLs
defined in January 2012 would still be unchanged today.
0.8
0.6

August 2016:
IPv4, 46693 ASes
IPv6, 7265 ASes

0.4
0.2
002468# Prefixes in Ingress ACL

100.8
0.6
IPv4 ASes
IPv6 ASes

0.4
0.2
0
Jan’12

Jan’13Jan’14Jan’15Jan’16

Source: Routeviews and RIPE RIS data 24

Should I install the client?
• Yes!
• Room full of laptops and people who travel (use differentnetworks). Great opportunity to collect new users and growvisibility of filtering deployment practice• What about NAT?
- Not all NAT systems filter packets with spoofed sourceaddresses- Roughly 35% of test results that showed spoof-ability wereconducted from behind a NAT

25

Reporting Engine: IIJ Tests

No issues found in IIJ!
26

Summary• Reporting Engine publicly shows outcomes of sharable

tests, ~6K unique IPs in hundreds of ASNs per month.
- Allows users to select outcomes• per country: which networks in a country need attention?
• per ASN: which subnets need attention?
• per provider: which of my BGP customers can spoof?
- Allows operators to view address space announced by an

AS announce, or could act as transit for, over time.

- Please install and use the system!

https://spoofer.caida.org/

27

Acknowledgements• Project funded by U.S. Department of Homeland Security(DHS) Science and Technology (S&T) directorate• Contacts:- spoofer-info@caida.org

28