Slashdot Mirror
GA Tech: Internet's Mid-Layers Vulnerable To Attack
An anonymous reader writes "Evolution has ossified the middle layers of the Internet, leaving it vulnerable but security breaches could be countered by diversification of protocols, according to Georgia Tech, which recommends new middle layer protocols whose functionality does not overlap, thus preventing 'unnatural selection.' Extinction sucks, especially when it's my favorite protocols like FTP."
an article which discusses "the six [sic] layers..."
I understand that IP protocols predate the 7 layer ISO/OSI model, but that's what everything is mapped to in modern terms.
The article seems even more confused, when it reverses the layers, claiming that "at layers five and six, where Ethernet and other data-link protocols such as PPP (Point-to-Point Protocol) communicate..."
What are they teaching at GA Tech? This is networking 101.
"National Security is the chief cause of national insecurity." - Celine's First Law
Surely this article should be nodded "massive ignorance"! It's the simplicity of the middle layers that enables the development of the upper and lower levels. It also makes the middle layer much more immune to security issues.
The real "Libtards" are the Libertarians!
Well, I know for myself a good swift "attack" on my "middle layer" does cause me to fall to the ground and writhe around for a while, so I guess the internet and I do have a lot in common, really vulnerable mid-sections.
Monstar L
Not only did they combine the presentation and application layers from the OSI model they completely misunderstand WHY that the transport layer is less diverse in number of protocols.
They propose that we should create new transport protocols that do not overlap with existing ones.... The reason we only have a handful of them is because of the fact that there are not many ways to differentiate a transport protocol.
Yes, because it's very difficult to understand that protocols which aren't end-to-end require more standardisation then other protocols due to having to cross many nodes thus leading to a situation of relying on a select tried and true protocols. Yes, very difficult.
There seems to be the unstated(but vital to the conclusion asserted) assumption that competition actually makes protocols more secure and that competition must occur at the protocol level, rather than the implementation level. Without those assumptions holding, all this article really says is that people use TCP and UDP a lot. Yup. That they do.
This seems like it might be true in the (not necessarily all that common) case of a protocol whose security is fucked-by-design competing with a protocol that isn't fundamentally flawed, in a marketplace with buyers who place a premium on security, rather than price, features, time-to-market, etc.
Outside of that, though, much of the competition and security polishing seems to be at the level of competing implementations of the same protocols(and, particularly in the case of very complex ones, the de-facto modification of the protocol by abandonment of its weirder historical features). It also often seems to be the case that(unless you are in the very small formally-proven-systems-written-in-Ada market, or something of that sort) v1.0 of snazzynewprotocol is a bit of a clusterfuck, and is available in only a single implementation, also highly dubious, while the old standbys have been polished considerably and have a number of implementations available...
It's the very first Google hit, is still on a public server, and doesn't obviously distort the conclusions like TFSA in an effort to get more clicks. A+ for poorly crafted summaries, Slashdot.
http://www.cc.gatech.edu/~sakhshab/evoarch.pdf
... there is human error there will be weakness. Before innovation, there is caution and upkeep. Careless server admins just leave their gates open, a la Sony. A simple misconfiguration and the East goes dark, a la Amazon.
But like all things founded on good democratic freedoms, we are free to be idiots. And unless we add socialized security, the internet will always be full of gaping weaknesses. And all of us, including those that serve responsibly, will suffer their consequences. A la the United States of America.
Not that either is good or bad, but just sayin' this is the world we surf in.
Evolution always seemed to be too like MS Outlook to me, this article just seems to confirm that, judging by the odd intelligible snippet I can make out from the overuse of metaphors and confused language of the summary. But fear not, mutt does not suffer these problems, and nor does Thunderbird if you need your middle layers of the internet client to have pretty icons.
They forgot a major, new, "middle layer" protocol. Next.
security breaches could be countered by diversification of protocols, according to Georgia Tech, which recommends new middle layer protocols whose functionality does not overlap, thus preventing 'unnatural selection.'
Let's have a lot of protocols right, but to prevent too much diversity (that is, stuff that doesn't work) we'll need to make sure these comply with one or two protocols that everyone will use...
Hmmm, "Middle layer protocols whose functionality does not overlap"... does that mean that we prune the vast abundance of current protocols with sometimes overlapping functionality? I guess we could call that "diversification" though at this level of semantic mismatch, we could call it "Frank" with equal justification.
I guess I'm not quite sold on the argument presented here.
Evolution at the middle layers is also hampered by the proliferation of middleboxes: monkeying with packet headers for policy-enforcement and profit. It's also pretty well de rigueur for IT departments to configure both middleboxes and "smart" switches to drop any unrecognized middle layer packets.
...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
Let FTP die already. Clear text passwords suck.
The only legitimate use of FTP is a way of transferring files over a LAN to something which doesn't have a good implementation of a CIFS or SSH server.
is another man's freedom?
Oh good lord. This paper was rubbish. I was at the conference presentation. Be assured that no one is taking it seriously. Their model can produce any kind of hourglass, and has essentially nothing to do with the internet. It can't account for any of the actual, observed diversity at the waist of the hourglass, and has zero predictive power (which *should* be a test for any model). It isn't grounded in anything particular about protocols or networks. Please just ignore this junk.
>Anyone who has used the Internet for very long knows about its evolution by the number of extinct protocols that are no longer used.
No i know about the evolution by the fitness for a purpose. Like easy identification of a resource by an URL while being able to serve many different server names in a transparent way on a single IP (webhosting).
>For instance, FTP (File Transfer Protocol) used to be the only way to transmit files too large for SMTP (Simple Mail-Transfer Protocol),
Wrong. FTP was not the only way to transmit files "to large for SMTP" (Did i somehow miss a magical size limit in SMTP). I could name a few others, like uucp, tftp, smb, the novell filesystem, zmodem, xmodem, nfs etc.
> but clever programmers have devised ways of using server-side algorithms to deliver large files using HTTP (Hypertext Transfer Protocol).
It was always my impression that serving a large file via http does not require a specially clever programmer. Somehow it just works
> As a result, FTP has become virtually extinct on all but legacy systems.
Its the result on not being able to combine many customers ftp servers onto a single IP
>Researchers at the Georgia Institute of Technology wondered if these evolution and extinction phenomena on the Internet were in any way similar to evolution and extinction in nature.
Well - yes?
> After all, protocols could be viewed as species that compete for resources, with the weaker ones eventually becoming extinct. Similarly, the evolution of the Internet's architecture could be described as a competition among protocols, with some thriving and others becoming extinct.
Weaker ones?
> To test their theory, the group headed by computer science professor Constantine Dovrolis crafted a research program that tracks the evolution of architectures, called EvoArch. The overall goal was to help understand how protocols evolve in order to develop better ones that protect the Internet from the wide variety of threats it is facing today and to prevent extinctions that ossify the Internet, making it more vulnerable to attacks.
All right. So supporting a large number of protocols makes the internet more safe? Linux Kernel bug seem to speak another language. Its good if unused protocols become so extinct that you can turn them of on you server.
> The general conclusion derived from EvoArch was that unless new protocols are crafted to avoid competition, they will inevitably lead to extinctions.
Yes. Its orthogonality. But it does not have anything to do with protocols becoming extinct. These guys make it sound like the extinction is the problem in reality its the lack of orthogonality in the designs (and when it comes to security also in the layer functions - on how many layers are here half-assed attempts to authenticate?).
file sharing / distributed FS protocol that lives outside tcp/ip!
forgive me, but nothing useful turned up on Google or urban dictionary. what does this word mean? (I am a native English speaker)
Do you want fries with that?
The premise and solution provided seem a little whimsical.
gopher over SPX/IPX forever!
Maybe researchers at Georgia Tech?
Or did some idiot named Mr. Tech name his kid Georgia?
More outstanding editing...
Everything is vulnerable to attack, especially if it's connected to a worldwide network.
Let FTP die? go f__k yourself
ARPANET predates the OSI model, and the current Internet Protocols came after the definition of the OSI stuff. (That's a little hard to see in the current wikipedia articles, but it's there.) The IETF in fact deliberately chose to combine two of the OSI layers.
The article does have some issues. I'm not sure if the author actually doesn't understand the paper he or she is trying to summarize. Maybe the intent was to make it easier for the lay person to understand. But there is some creativity going on, and parts of the summary don't really reflect the paper.
The paper itself is offering a framework of analysis of the evolution of the Internet Protocols. It might have been interesting to see a bit more analysis of ARPANET and some of the other protocols the IP protocols eventually replaced. It might have been interesting to see them address the OSI model a bit more, but the OSI model never was really implemented fully, and might be considered not part of the evolution.
I see that the take IPv6 up as a competitor of IPv4 instead of the heir apparent, which is probably a useful thing to do, if we want to understand why so many IT managers are still failing to move in a timely manner.
I'm not sure I understand their work well enough to either agree or disagree, but I think it offers food for thought, including the idea that IPv4/6 doesn't actually have to be the only protocol existing at that layer.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Courtesy of this AC post down the page a bit.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Hit post without thinking again. This AC post down the way a bit links the original paper.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Show me someone using ftp and I'll show you a password theft followed by a crack.
Crack this: FTP over TLS.
Having skimmed the article, I am concerned that they seem to ignore the well-known network effect: the value of a network to those attached to it increases at a rate faster than linear as a function of the number of others attached. This property has generally meant that once a network-layer protocol is sufficiently well established, it is hard to displace; a winner-take-all situation. Telegraph network. Telephone network. In the data world, IP, ATM, and a handful of others slugged it out, and eventually IPv4 reached critical mass and "won".
on a les puma cat sur la site http://www.puma-ferrari-cat.com http://www.edhardyfrance.biz http://www.louboutin-sandales.com http://www.fingers-five.com
Dammit, I should have never trusted that e-mail client.
"Anyone who has used the Internet for very long knows about its evolution by the number of extinct protocols that are no longer used"
I'd have to think real hard to name any besides gopher.
"For instance, FTP (File Transfer Protocol) used to be the only way to transmit files too large for SMTP (Simple Mail-Transfer Protocol), but clever programmers have devised ways of using server-side algorithms to deliver large files using HTTP (Hypertext Transfer Protocol). "
LOL It takes more ingenuity to send a large file via HTTP.
"Researchers at the Georgia Institute of Technology wondered if these evolution and extinction phenomena on the Internet were in any way similar to evolution and extinction in nature"
I often wonder could a more useless question evolve from a group of monkies armed with glitter bombs?
All successful protocols have the following traits in common:
1. fulfill a real need
2. Do not require disruptive change unless abs necessary
3. simple/low cost
The IETF is full of morons who disregard the above for their own academic reasons. As a result their work never sees the light of day.
"In particular, the six layers of the Internet have evolved into an hour-glass shape where protocols at the very top and bottom continue to evolve, but where those toward the middle have become stagnant, leaving unnecessary security-risk opportunities open for exploitation."
Your mom is an unnecessary security risk.
"In the middle layers, however, extinction has left only a few survivors, ossifying its structure. At the transport layer (layer three), TCP (Transmission Control Protocol) competes with only a few other alternatives, such as UDP (User Datagram Protocol),"
Let me guess you found the list of registered IP protocols at IANA and drew some rediculous conclusion about the "decline" of all those protocols that have never actually ever been used by anyone.
"and at layer five, the network protocol, IP (Internet Protocol) and ICMP (Internet Control Message Protocol) are used almost exclusively." ...
"Diversity resurfaces at layers five and six, where Ethernet and other data-link protocols such as PPP (Point-to-Point Protocol) communicate "
It is actually layer 73. When you "ossify" something you set its value to 73 just because.
"From running simulations with the EvoArch program these researchers have concluded that the only way to reintroduce diversity into the middle layers without inevitable extinctions is to create protocols that do not overlap with the others. By thus eliminating competition for the same resources, a rich set of middle layer protocols with increased security should be able to survive"
The reason we don't see new L4 protocols is because TCP and UDP are good enough compared to the crap you have to go through to get E2E support for a new protocol implemented at the socket layer by all operating system vendors.
The lynx, the tuna, and the lemming have become seriously ossified. They have overlapping functionality. Both the lynx and the lemming have legs. This is not acceptable. We must create a new lynx-lemming hybrid and kill off all remaining lemmings-only and lynxes-only. The tuna is an even bigger abomination. Much like the lynx and the lemming and probably the lynx-lemming hybrid, it has a brain and a central nervous system. However, it can swim. We must remove its brain. That way the tuna will swim and the lynx-lemming hybrids can follow each other off of cliffs, but will drown. This means the brainless tuna and the lynx-lemming hybrid will not be competing for the same ocean.
Last time I checked, ICMP and IGMP were both layer 3 and pretty popular. According to Wikipedia IPSec is also "officially" layer 3, but I always considered it part of IPv6, and an extension to IPv4.
More for integrity, but the service layer architecture is purely based on trust. It turns out, that you can more readily do the most when you have trust, which partly explains the rapid growth of the Internet. However, a bunch of trusting souls make an irresistible target for those who are willing to exploit their trust. I believe the only way to deal with them is to move faster than they can. FTP should have been enhanced to the point that few would use the older version, hence a smaller target. I don't mean secure FTP. I refer to features and functionality. There should be no reason to use HTTP for file transfers, but that is now more common than FTP. Perhaps it has evolved after all, into HTTP.
Don't SFTP, SCP, and anything else tunneled over SSH require a shell account? A lot of budget web hosting services provide FTP but no shell account.
Another study by academics who have no real world experience. Move along, nothing to see here.
This has such a nice ring and the twist-in-tongue is really beautiful. But I'm afraid that almost no one here ever read X.200, the OSI reference model ...
People still use FTP? I exclusively use SFTP and/or SCP these days. I can't remember when I last used FTPS, let alone plain FTP.
These guys aren't aware of the end-to-end argument, I take it. Essentially, it's not possible to secure the mid-points of data communication as the mid-points have no idea of what they're transmitting. Only at the endpoints do you have enough information to properly secure the communication.
In essence, securing the middle layers can only give you a small amount of protection, at best, and at worst they can introduce a large overhead.
My mid-layers are pretty vulnerable to attack, too. Soft, squidgy, and flabby.
I'm not sure I understand their work well enough to either agree or disagree, but I think it offers food for thought, including the idea that IPv4/6 doesn't actually have to be the only protocol existing at that layer.
IPX is another layer 3 protocol, right? Was Netware's IPX something that exceeded the addressing capabilities of IPv4? Looking @ Wiki, I see
IPX addressing
- Logical networks are assigned a unique 32-bit hexadecimal address in the range of 0x1 - 0xFFFFFFFE.
- Hosts have a 48-bit node address which by default is set to the network interface card's MAC address. The node address is appended to the network address to create a unique identifier for the host on the network.
- Network number 00:00:00:00 means current network
- Broadcast address is FF:FF:FF:FF
Would the 48-bit address have been a viable stopgap until IPv6 was more widely adopted?
you know, I went to Georgia Tech in the late 80s (I remember the 88 Morris worm) and thought it was a reasonably prestigious school (not MIT but far from "generic") but these days whenever I see GT featured prominently on /. summary I cringe...
I do know (socially) some guys at GTRI who are doing some pretty cool work so there are definitely still some serious brains there even if they're not getting the press (some of that's intentional given nature of work)...
The original paper introduces an evolutionary framework to study network protocol stacks and their evolution. This article has almost nothing to do with the original paper. The six layers that they consider as one sample of such protocol stacks are clearly described in the paper. You can probably get more information from the introduction and conclusion of that paper rather than this hatchet job of an article!
The Evolution of Layered Protocol Stacks Leads to an Hourglass-Shaped Architecture
Read the original paper and you will see that this article is a hatchet job that has nothing to do with the original paper. The paper introduces a framework to study network protocol stacks and their evolution and it clearly describes the six layers (which are totally twisted in this article) as an instance of such protocol stacks. You can probably get more info from the intro and conclusion of the paper.
The Evolution of Layered Protocol Stacks Leads to an Hourglass-Shaped Architecture
Sit ups...
Didnt know sit ups made your nads stronger.
Monstar L
Well, maybe not X.25, but you know how much grief has been caused by layering essentially connection-oriented traffic on IP. The world need a virtual circuit network layer!
You are free to install whatever network protocol drivers strike your fancy in any OS, AFAIK.
I know tobacco is bad for you, so I smoke weed with crack.