Feds Plot Massive Internet Router Security Upgrade

BobB-nw writes "The U.S. federal government is accelerating its efforts to secure the Internet's routing system, with plans this year for the Department of Homeland Security to quadruple its investment in research aimed at adding digital signatures to router communications. DHS says its routing security effort will prevent routing hijack attacks as well as accidental misconfigurations of routing data. The effort is nicknamed BGPSEC because it will secure the Internet's core routing protocol known as the Border Gateway Protocol (BGP). (A separate federal effort is under way to bolster another Internet protocol, DNS, and it is called DNSSEC.) Douglas Maughan, program manager for cybersecurity R&D in the DHS Science and Technology Directorate, says his department's spending on router security will rise from around $600,000 per year during the last three years to approximately $2.5 million per year starting in 2009."

Comments

It's a plot!

[PixelThis]

This plan to upgrade router security is a plot? Are there some nefarious evil masterminds behind it?

Re:It's a plot!

[MooseMuffin]

Wrong meaning of plot. This is referring to a small patch of land.

Re:It's a plot!

[jmauro]

I think they're just enabling MD5 on the BGP sessions. It's already specified in RFC 2385 - Protection of BGP Sessions via the TCP MD5 Signature Option. It's basically a $600k program to manage the logistics of turing this on. I do give props for Network World for making a mundane task 5 whole pages.

Re:It's a plot!

[youknowjack]

Where the hell is the IETF in all this, I want to know?

http://www.ietf.org/internet-drafts/draft-ietf-rpsec-bgpsecrec-10.txt

Abstract:

The security of BGP, the Border Gateway Protocol, is critical to the proper operation of large-scale internetworks, both public and private. While securing the information transmitted between two BGP speakers is a relatively easy technical matter, securing BGP, as a routing system, is more complex. This document describes a set of requirements for securing BGP and the routing information carried within BGP.

Re:It's a plot!

[Stile 65]

I think it's actually referring to S-BGP. I also thought it was just the MD5 signature option, but it's not.

Then again, one of the comments in TFA is that it won't require any new software or hardware to be installed, so maybe it IS just the MD5 option. The features didn't sound like it; it sounded like they were establishing a whole PKI.

Re:It's a plot!

[X0563511]

OK smartass...
I'll give you a BGP packet, and you have to replace it with another working BGP packet (with addresses that you want) that has the same hash.

Go ahead. I'll wait for you. Well, not really - I'm sure the universe will reach heat-death before you find one.

Now, assuming you do find one... find some for the whole communication. Also, you only have a few milliseconds to do it.

Starting to sound difficult?

Don't spout off bullshit when you KNOW you have no idea what you are talking about.

Re:It's a plot!

[Have Blue]

MD5 is only weak when used on data in formats which allow for large amounts of padding. BGP packets are a much less flexible format so collision attacks are much more difficult.

Is it must me, or is that sum peanuts?

[dmomo]

I don't know much about security and cost, but the 600k does indeed seem fairly small to me for something like this. Even 2.x million seems like a sizzle in the pan. Can anyone speak to the costs involved?

Re:Is it must me, or is that sum peanuts?

[Morty]

They're talking about funding research, not deployment. RTFA. The dollar amounts in question sound about right.

Note also that this goes way beyond SSL. This is not about identifying your BGP peers -- that's a relatively simple problem that can easily be solved with MD5 [or one of the hash algorithms that is replacing MD5, since MD5 is problematic.] This is about validating that your BGP peers have the right to announce what they are announcing. This is a much harder problem than SSL.

That is, let's say you have a router that peers with $someco's router. It's easy to use MD5 [or replace it with something better] so you are sure that you are talking to $someco's router. It might also be possible to set up SSL instead, so you are even more sure you are talking to $someco. But even if you know you are talking to $someco, how do you know you can trust what $someco is telling you? What if $someco's router says it's a good path to get to a chunk of address space that belongs to $otherco -- should you believe it? BGP is full of settings that let you limit how much you trust your peers, but how do you know what you should set them to? Note that this is not a simple question of "is address space X associated with the $someco that is announcing it" -- even if address space X belongs to $otherco, it's possible that $someco is a legitimate transit network rather than a malicious third party.

Sounds like DHS is funding research to try to solve this.

This is somewhat different than the DNSSEC push. The DNSSEC effort is looking to deploy an existing but unpopular technology across the US federal government. The BGPSEC effort seems to be about creating a new technology for possible future deployment.

Re:Question for the experts

[Klootzak]

will this only increase security at things that are .gov? That's the impression I get but I don't know enough technically to be sure.

Pretty much... it means that when Router A says to Router B "I have a new path to this network." the routers will first authenticate eachothers identity utilizing Digital Signatures.

Basically it's applying elements of PKI to router communications, so the router receiving the information knows it can trust other router's updates. If you didn't do it I could (potentially) spoof updates and say "this network exists here now" and all the information destined for that network would then be routed to me to packet-sniff to my heart's content.

This type of stuff (in addition to SSL/TLS encryption of sensitive data communication channels) has been used internally in (most) Banking networks for awhile now, I'm actually surprised they didn't have something like it in place already.

Re:Question for the experts

[Anonymous Coward]

If you didn't do it I could (potentially) spoof updates and say "this network exists here now" and all the information destined for that network would then be routed to me to packet-sniff to my heart's content.

Couldn't you just not do that? Why do the Feds have to roll out a $600k program because of you? That is taxpayers money for gods sake!

Re:+1 Funny! :)

[guruevi]

then IANA could ask various NICs to revoke the Certificates of AS's that do dodgy things

Sounds like a great way to implement censorship or force traffic to follow certain (compromised) routes. Simply say: Wikipedia does something dodgy, they allow free speech and free information, let's revoke their cert (since IANA can be controlled by a government).

The biggest 'problem' with all these 'old' protocols like DNS, SMTP, TCP/IP... is that they were built primarily (by the military) for allowing decentralized communication protecting against massive failures (due to atomic bombs) and secondary (as soon as the academics jumped on) to allow free communications, free speech and research (science) to flourish through open, decentralized, ungoverned communications (the message will get there one way or another) and censorship would be treated as damage and routed around.

The 'problem' is that free speech also includes spam and other 'nasty' things to go through. To protect against that you need to start censoring the communications channels. As soon as you do that you destroy the original purpose of the Internet for what? Terrorists? Children? Hackers? Not really, the only people that would be able to successfully pull that off (rerouting major traffic through their own DNS or BGP-routers) against a clean subnet would have to be large enough to influence your life or make you do what they want without being deceptive which are currently, the ones that own the lines (but they won't do it because they would instantly lose their business) on the other hand they would like to clean house so they can oversell even more without adding capacity and governments (which have proved do anything to remain in control no matter the legality).

Don't give up your free speech and the open nature of the Internet just because you are inconvenienced. If you are really inconvenienced by spam, just let the machine learn to ignore it. My mail server is set up to do so and there are wonderful tools that help you with that.

Re:DNSSEC

[Morty]

They're not claiming that they invented it, they're just trying to help it along. While DNSSEC has been around a while, the overwhelming majority of zones, including the root zone and .com, are not signed yet. It may look like the US government is late to the party, they're actually ahead of most of the US commercial sector on this one.

So how does this "bolster" DNSSEC? Answer: the government is hoping that a large-scale implementation by a major buyer will push vendors to properly support DNSSEC. Many vendors don't support DNSSEC at all, or only support part of it; Microsoft, for example, only has minimal DNSSEC support. How do you think vendors will respond when .gov customers start telling them "we can't buy your product because it doesn't support DNSSEC. We'll have to go with one of your competitors."

RTFA.

Re:+1 Funny! :)

[Klootzak]

Sounds like a great way to implement censorship or force traffic to follow certain (compromised) routes. Simply say: Wikipedia does something dodgy, they allow free speech and free information, let's revoke their cert (since IANA can be controlled by a government).

Preaching to the converted here my friend...

I immediately thought of this topic when I was reading the BGP article and thinking about the implications of a hierarchal structure (incidentally, they can pretty much "disconnect" direct connections between eachother NOW if they want to... but of course we can route around it, if required - adding encryption/PKI doesn't make all that much of a difference if people don't enforce it).

See, Governments are still duking it out (Diplomatically and Militarily) while their populations talk to eachother on the net' - the wonderful thing about this is I can talk to you, not knowing if you're White, Black, Green, Yellow, Blue, Purple, Male, Female, American, French, Canadian, Belgian or Martian... if you call me an idiot, I can't say "You called me an idiot because I'm (insert racial/gender type here)", well, I CAN, but you can reply... "I didn't know that, but I still just think you're an idiot!".

The concept of a Worldwide Global Communications network with almost ubiquitous availability is something we really haven't had for along time, it's going to take the Governments of the world a bit of time to get their head around it... Personally I think the Politicians/Diplomats of the world should read The Truth by Terry Pratchett (if they haven't already), as it has alot of similar concepts regarding local, social, and geo-political issues in it, just with a different "new" Technology.