Slashdot Mirror
Why Is It Taking So Long To Secure Internet Routing?
CowboyRobot writes: We live in an imperfect world where routing-security incidents can still slip past deployed security defenses, and no single routing-security solution can prevent every attacks. Research suggests, however, that the combination of RPKI (Resource Public Key Infrastructure) with prefix filtering could significantly improve routing security; both solutions are based on whitelisting techniques and can reduce the number of autonomous systems that are impacted by prefix hijacks, route leaks, and path-shortening attacks. "People have been aware of BGP’s security issues for almost two decades and have proposed a number of solutions, most of which apply simple and well-understood cryptography or whitelisting techniques. Yet, many of these solutions remain undeployed (or incompletely deployed) in the global Internet, and the vulnerabilities persist. Why is it taking so long to secure BGP?"
The internet is in production. No one wants to touch anything that's already in production unless they literally can't make it any worse.
Otherwise we would have IPv6 as well.
How can government and LEO's surveil us if everything is locked down?
Most of these solutions require some sort of central authority to manage the security of all the routes. Sounds great until you realize that there is no one that all the users of the Internet can trust. I am not even sure that users can trust their own governments to manage this without exploiting users for the sake of surveillance let alone other countries trust one another. If you can't trust one another the best thing to do is remain insecure but watch each other like hawks for any foul play.
which means they are bought and used for many years if not a decade or longer
your $50 or whatever you pay your ISP a month is not enough to afford new equipment every year
Exactly. The point of the Internet is to interconnect. If you introduce a new, incompatible protocol (more secure though it may be) and refuse to accept updates via the old one, you risk depeering on a massive scale. Remember when the global routing table tipped the scales? And how people freaked out because they couldn't watch their favorite cat video - or conduct meaningful e-commerce? Yeah, expect that type of reaction x 1 million while every major ISP figures out how to rebuild the Internet from scratch.
The Internet was invented with socialist incentive, like all useful things are /invented/ (but not implemented).
Capitalism has done very little to improve the theory underpinning the Internet. It merely provides the grunt work to lay the cables and glue the blinkenlight boxes together, and optimises here and there.
All successful nations balance between socialist (which provides ideas) and capitalist (which implements those ideas) incentive. The US tipped the balance through the '80s, and is now cruising on empty.
Do you know how long it takes for the NSA to backdoor all those routers?
because Microsoft hasn't endorsed any of the solutions yet.
hardee har har, you say? We're talking about Internet backbone routers, not the desktop, and so Microsoft is irrelevant, you say?
But, seriously, nobody seemed to care about IPv6 for centuries, and then suddenly Vista and 7 start supporting IPv6, and now Comcast and Faceb00c have become reachable via IPv6, and sections related to IPv6 get added to CompTIA exams and CCNA. Even Hurricane Electric/TunnelBroker.net's certification now contains content related to IPv6.
Another considering is that cryptography is expensive in CPU. Lots of old gear out there that wouldn't like it much.
When it comes down to it, the main reason is cost. Telcos (or any big business) HATE spending money, and if they feel they can get away without doing so they will.
Ours is not to reason why, just to do as we are told...
How much financial penalty is there for having insecure routes (or routers?) Hmm... None, basically. Ok. How much is this upgrade going to cost? Wow...that much? Well, there's your problem!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Except "Attacker" in this case is the administrator at the peer, and the peers are entire companies, multinationals, and governments. We're not talking about your average basement-dweller script kiddie.
If your peers are messing with you, or their peers are messing with them, how do you defend against an attack where the whole system is based on trust?
You could go to a no-trust solution, but then that would need a central authority that would need to pre-calculate all the routes from every single AS. If a route breaks, that'll be slow to adjust to a backup route. If a new route needs to be added, the ISP would need to apply to a central authority with bureaucracy and red tape.
If a route needed to be blackholed because of a DDOS, and that action had to be approved of by a central authority, which could take days to weeks for a ruling, nothing could be done because routers would not accept changes to any route until then.
Essentially, the answer to security is to effectively lock out the AS ISPs from their own routers.
You either trust the AS administrators or you don't. And since they're humans, they'll make mistakes, be malicious, or be affected by politics. This won't be solved by (trusting) a central bureaucracy similar to the UN, at least not in a manner you'll prefer.
9/16/14 6:27:39.254 PM mDNSResponder[58]: mDNS_Register_internal: ERROR!! Tried to register AuthRecord 00007FD844006FF0 30.3.168.192.in-addr.arpa. (PTR) that's already in the list
Nine.
"Moogs! Would YOU buy that for a quarter?" CMK
Because the sheeple can't can't ass-fucked daily if we truly fixed this?
Its not actually a problem, thats why. The submitter doesn't actually understand what he's suggesting and why the current method of dealing with this issue works fine.
You know who is doing the damage and 'attacking' you, they are easy to identify, and you just stop talking to them. They're only going to connect to a relatively small number of people so disconnecting bad players is trivial, then you never talk to them again. They bare the cost of having all the money invested in setting up the original connections they used to 'attack' with being lost. And lets be clear, BGP attacks aren't done via virtual connections, they're done across physical connections so you know EXACTLY who is doing them and which cable to unplug to solve the problem.
Do you upgrade every router running BGP, or just turn off the 2 connections to the bad guy? Its just not worth the effort to 'fix the problem' with a technical solution when good old fashion common sense tactics work just as well and for far less cost (read: effort for everyone involved) Even if it were a major backbone provider, the number of connections to cut is still trivial compared to even upgrading all the routers that the single largest backbone providers connect to.
This is a stupid question to ask and just illustrates not understanding the actual problem. The costs of 'fixing' the problem technical FAR outweighs the benefits of doing so (not having to manually disconnect troublesome players).
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
What is really required is a combination of BCP38 and RPKI. BCP38 is 14 years old and is fairly easy to implement. I did so for a major network about a decade ago. It simply means blocking packets from addresses that do not belong to your customers. Since a great many attacks including BGP spoofing involve inserting packets to spoof the routing system, simply doing this will prevent a huge part of the problem and no new technology or techniques are required. What is required are tools to maintain a record of the network prefixes allowed from each customer and maintain the prefix lists on each router.
The ONLY excuse for the very limited implementation of this Best Current Practice is that it does cost money and the provider business is highly competitive. This puts pressure on them to avoid any added cost that can be either ignored or kicked down the road. As a result, the majority of the providers don't implement this practice that is so critical to securing the network.
RPKI is routing specific, but is far more effective. The problems at the moment are limited implementation and, again, cost. It is probably quite a bit more expensive to implement, though post implementation is probably a bit less expensive. It also is a far bigger change in the operation of routing and, therefore, more frightening. Still, any network experiencing a routing attack will certainly wish that they had implemented RPKI and that it was implemented by all. But, unlike BCP38 which generally protects others, each provider implementing RPKI is protecting themselves.
P.S. I am only an anonymous coward because some bug leaved me no longer logged in when I make comments via a new post. (Works OK for replies.) I am kevmeister, formerly a senior network engineer at ESnet.
> and then suddenly we completely ran out of IPv4 addresses, so everyone, even Microsoft, had no choice but to get moving on IPv6
Ftfy . Most computing devices sold in the last three years don't run Windows. Microsoft is now a minority player. Android is #1, iOS #2.
So which companies have influence? Android is the most popular operating system, so it's support of IPv6 is important. Most end points that need new addresses get those addresses assigned by one of the major mobile carriers, while older equipment is still using the same old IPs on Comcast and Time Warner. The equipment on the backbones is mostly Cisco gear, so it matters what Cisco supports the best, but they'll provide whatever Comcast and Level3 want to buy.
There are more than 600 million Web sites, according to NetCraft. Who is going to maintain a list like that? It's going to cost a lot of money...who is going to pay for it? Who is going to have the power to decide who gets in, and who doesn't? What about appeals, for those who feel they have been unjustly removed from the list? What about opposing points of view? Does the US get to decide which Chinese sites get to be on the list, or vice versa?
Americans.
There's also the issue that when you attack the CPT (central points of trust), you effectively disable everything. It is easier to think of DNSSEC than RPKI in this case, but the same basic attack vector holds: break the root signatures, and everything starts to unravel. I.e., DoS.
RPKI is no different. We actually have five natural central points of trust: the RIRs. And I suppose ASO could be the root if you want one instead of five.
What really causes design issues on RPKI is the trust databases. And what really causes operational issues is the absolute lack of proper hardware and firmware support to naturally inject verification points on every eBGP link. Maybe if people start embedding powerful multi-core Xeons or Opterons in the routing engines, but currently you cannot trust anything but Cisco ASR and the larger x86 software-based routers to have control planes that are not wimp crap. Not even the otherwise marvelous Juniper MX5/10/40/80 series (which has a wimpy single-core or dual-core RE that is too slow to converge eBGP) would be able to deal with it.
The headline made me do a double-take. It's like asking "why is it taking so long to develop an invisibility cloak?" or "why is it taking so long to develop flying cars?".
> In the corporate world no-one's manipulating huge spreadsheets or writing 500 page legal documents on an iPad.
I'm guessing that in your corporate world, nobody HAS huge spreadsheets because they're putting the huge stuff in the RDMS whre it belongs. iPads aren't the right tool for significant datasets, and neither is Excel. In my world, most people do not use the right tool for the job.
'Nuff said. Can't get shit done with his constant bullshit spouting.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I train massive numbers of people in BGP every year. The best would go for it. The average are just happy to peer and move on.
IT completely lacks process. ITIL is a joke. People insist on wasting time doing the same thing over and over. The best networking companies I know with the absolute best people are rarely more professional than a bunch of script kiddies. The best of the best hack away on networking and routing like and orangoutang playing with a toy piano. Modern IT is rarely better off than a bunch of idiots in comfort zones who make changes indiscriminately and send the invoice.
There is no profit in fixing BGP. It works and most IT engineers operating peers don't care. There is nothing which says "the internet won't work if we don't do this.". There's not even a clear line of how you would gain money by making such a change.
The internet will never implement a feature simply because it's useful or right. We do it because of the money, because it's fun or because our peering won't function without it.