Request for Comments: 4593 Nortel
Category: Informational S. Murphy
Sparta, Inc.
Y. Yang
Cisco Systems
October 2006
Generic Threats to Routing Protocols
Status of This Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
Routing protocols are subject to attacks that can harm individual
users or network operations as a whole. This document provides a
description and a summary of generic threats that affect routing
protocols in general. This work describes threats, including threat
sources and capabilities, threat actions, and threat consequences, as
well as a breakdown of routing functions that might be attacked
separately.
Table of Contents
1. Introduction ....................................................2
2. Routing Functions Overview ......................................3
3. Generic Routing Protocol Threat Model ...........................4
3.1. Threat Definitions .........................................4
3.1.1. Threat Sources ......................................4
3.1.1.1. Adversary Motivations ......................5
3.1.1.2. Adversary Capabilities .....................5
3.1.2. Threat Consequences .................................7
3.1.2.1. Threat Consequence Scope ...................9
3.1.2.2. Threat Consequence Zone ...................10
3.1.2.3. Threat Consequence Periods ................10
4. Generally Identifiable Routing Threat Actions ..................11
4.1. Deliberate Exposure .......................................11
4.2. Sniffing ..................................................11
4.3. Traffic Analysis ..........................................12
4.4. Spoofing ..................................................12
4.5. Falsification .............................................13
4.5.1. Falsifications by Originators ......................13
4.5.1.1. Overclaiming ..............................13
4.5.1.2. Misclaiming ...............................16
4.5.2. Falsifications by Forwarders .......................16
4.5.2.1. Misstatement ..............................16
4.6. Interference .........................................17
4.7. Overload .............................................18
5. Security Considerations ........................................18
6. References .....................................................18
6.1. Normative References ......................................18
Appendix A. Acknowledgments .......................................20
Appendix B. Acronyms ..............................................20
1. Introduction
Routing protocols are subject to threats and attacks that can harm
individual users or the network operations as a whole. The document
provides a summary of generic threats that affect routing protocols.
In particular, this work identifies generic threats to routing
protocols that include threat sources, threat actions, and threat
consequences. A breakdown of routing functions that might be
separately attacked is provided.
This work should be considered a precursor to developing a common set
of security requirements for routing protocols. While it is well
known that bad, incomplete, or poor implementations of routing
protocols may, in themselves, lead to routing problems or failures or
may increase the risk of a network’s being attacked successfully,
these issues are not considered here. This document only considers
attacks against robust, well-considered implementations of routing
protocols, such as those specified in Open Shortest Path First (OSPF)
[4], Intermediate System to Intermediate System (IS-IS) [5][8], RIP
[6] and BGP [7]. Attacks against implementation-specific weaknesses
and vulnerabilities are out of scope for this document.
The document is organized as follows: Section 2 provides a review of
routing functions. Section 3 defines threats. In Section 4, a
discussion on generally identifiable routing threat actions is
provided. Section 5 addresses security considerations.
2. Routing Functions Overview
This section provides an overview of common functions that are shared
among various routing protocols. In general, routing protocols share
the following functions:
o Transport Subsystem: The routing protocol transmits messages to
its neighbors using some underlying protocol. For example, OSPF
uses IP, while other protocols may run over TCP.
o Neighbor State Maintenance: Neighboring relationship formation is
the first step for topology determination. For this reason,
routing protocols may need to maintain state information. Each
routing protocol may use a different mechanism for determining its
neighbors in the routing topology. Some protocols have distinct
exchanges through which they establish neighboring relationships,
e.g., Hello exchanges in OSPF.
o Database Maintenance: Routing protocols exchange network topology
and reachability information. The routers collect this
information in routing databases with varying detail. The
maintenance of these databases is a significant portion of the
function of a routing protocol.
In a routing protocol, there are message exchanges that are intended
for the control of the state of the protocol. For example, neighbor
maintenance messages carry such information. On the other hand,
there are messages that are used to exchange information that is
intended to be used in the forwarding function, for example, messages
that are used to maintain the database. These messages affect the
data (information) part of the routing protocol.
3. Generic Routing Protocol Threat Model
The model developed in this section can be used to identify threats
to any routing protocol.
Routing protocols are subject to threats at various levels. For
example, threats can affect the transport subsystem, where the
routing protocol can be subject to attacks on its underlying
protocol. An attacker may also attack messages that carry control
information in a routing protocol to break a neighboring (e.g.,
peering, adjacency) relationship. This type of attack can impact the
network routing behavior in the affected routers and likely the
surrounding neighborhood as well. For example, in BGP, if a router
receives a CEASE message, it will break its neighboring relationship
to its peer and potentially send new routing information to any
remaining peers.
An attacker may also attack messages that carry data information in
order to break a database exchange between two routers or to affect
the database maintenance functionality. For example, the information
in the database must be authentic and authorized. An attacker who is
able to introduce bogus data can have a strong effect on the behavior
of routing in the neighborhood. For example, if an OSPF router sends
LSAs with the wrong Advertising Router, the receivers will compute a
Shortest Path First (SPF) tree that is incorrect and might not
forward the traffic. If a BGP router advertises a Network Layer
Reachability Information (NLRI) that it is not authorized to
advertise, then receivers might forward that NLRI’s traffic toward
that router and the traffic would not be deliverable. A Protocol
Independent Multicast (PIM) router might transmit a JOIN message to
receive multicast data it would otherwise not receive.
3.1. Threat Definitions
In [1], a threat is defined as a potential for violation of security,
which exists when there is a circumstance, capability, action, or
event that could breach security and cause harm. Threats can be
categorized as threat sources, threat actions, threat consequences,
threat consequence zones, and threat consequence periods.
3.1.1. Threat Sources
In the context of deliberate attack, a threat source is defined as a
motivated, capable adversary. By modeling the motivations (attack
goals) and capabilities of the adversaries who are threat sources,
one can better understand what classes of attacks these threats may
mount and thus what types of countermeasures will be required to deal
with these attacks.
3.1.1.1. Adversary Motivations
We assume that the most common goal of an adversary deliberately
attacking routing is to cause inter-domain routing to malfunction. A
routing malfunction affects data transmission such that traffic
follows a path (sequence of autonomous systems in the case of BGP)
other than one that would have been computed by the routing protocol
if it were operating properly (i.e., if it were not under attack).
As a result of an attack, a route may terminate at a router other
than the one that legitimately represents the destination address of
the traffic, or it may traverse routers other than those that it
would otherwise have traversed. In either case, a routing
malfunction may allow an adversary to wiretap traffic passively, or
to engage in man-in-the-middle (MITM) active attacks, including
discarding traffic (denial of service).
A routing malfunction might be effected for financial gain related to
traffic volume (vs. the content of the routed traffic), e.g., to
affect settlements among ISPs.
Another possible goal for attacks against routing can be damage to
the network infrastructure itself, on a targeted or wide-scale basis.
Thus, for example, attacks that cause excessive transmission of
UPDATE or other management messages, and attendant router processing,
could be motivated by these goals.
Irrespective of the goals noted above, an adversary may or may not be
averse to detection and identification. This characteristic of an
adversary influences some of the ways in which attacks may be
accomplished.
3.1.1.2. Adversary Capabilities
Different adversaries possess varied capabilities.
o All adversaries are presumed to be capable of directing packets to
routers from remote locations and can assert a false IP source
address with each packet (IP address spoofing) in an effort to
cause the targeted router to accept and process the packet as
though it emanated from the indicated source. Spoofing attacks
may be employed to trick routers into acting on bogus messages to
effect misrouting, or these messages may be used to overwhelm the
management processor in a router, to effect DoS. Protection from
such adversaries must not rely on the claimed identity in routing
packets that the protocol receives.
o Some adversaries can monitor links over which routing traffic is
carried and emit packets that mimic data contained in legitimate
routing traffic carried over these links; thus, they can actively
participate in message exchanges with the legitimate routers.
This increases the opportunities for an adversary to generate
bogus routing traffic that may be accepted by a router, to effect
misrouting or DoS. Retransmission of previously delivered
management traffic (replay attacks) exemplify this capability. As
a result, protection from such adversaries ought not to rely on
the secrecy of unencrypted data in packet headers or payloads.
o Some adversaries can effect MITM attacks against routing traffic,
e.g., as a result of active wiretapping on a link between two
routers. This represents the ultimate wiretapping capability for
an adversary. Protection from such adversaries must not rely on
the integrity of inter-router links to authenticate traffic,
unless cryptographic measures are employed to detect unauthorized
modification.
o Some adversaries can subvert routers, or the management
workstations used to control these routers. These Byzantine
failures represent the most serious form of attack capability in
that they result in emission of bogus traffic by legitimate
routers. As a result, protection from such adversaries must not
rely on the correct operation of neighbor routers. Protection
measures should adopt the principle of least privilege, to
minimize the impact of attacks of this sort. To counter Byzantine
attacks, routers ought not to trust management traffic (e.g.,
based on its source) but rather each router should independently
authenticate management traffic before acting upon it.
We will assume that any cryptographic countermeasures employed to
secure BGP will employ algorithms and modes that are resistant to
attack, even by sophisticated adversaries; thus, we will ignore
cryptanalytic attacks.
Deliberate attacks are mimicked by failures that are random and
unintentional. In particular, a Byzantine failure in a router may
occur because the router is faulty in hardware or software or is
misconfigured. As described in [3], "A node with a Byzantine failure
may corrupt messages, forge messages, delay messages, or send
conflicting messages to different nodes". Byzantine routers, whether
faulty, misconfigured, or subverted, have the context to provide
believable and very damaging bogus routing information. Byzantine
routers may also claim another legitimate peer’s identity. Given
their status as peers, they may even elude the authentication
protections, if those protections can only detect that a source is
one of the legitimate peers (e.g., the router uses the same
cryptographic key to authenticate all peers).
We therefore characterize threat sources into two groups:
Outsiders: These attackers may reside anywhere in the Internet, have
the ability to send IP traffic to the router, may be able to
observe the router’s replies, and may even control the path for a
legitimate peer’s traffic. These are not legitimate participants
in the routing protocol.
Byzantine: These attackers are faulty, misconfigured, or subverted
routers; i.e., legitimate participants in the routing protocol.
3.1.2. Threat Consequences
A threat consequence is a security violation that results from a
threat action [1]. To a routing protocol, a security violation is a
compromise of some aspect of the correct behavior of the routing
system. The compromise can damage the data traffic intended for a
particular network or host or can damage the operation of the routing
infrastructure of the network as a whole.
There are four types of general threat consequences: disclosure,
deception, disruption, and usurpation [1].
o Disclosure: Disclosure of routing information happens when an
attacker successfully accesses the information without being
authorized. Outsiders who can observe or monitor a link may cause
disclosure, if routing exchanges lack confidentiality. Byzantine
routers can cause disclosure, as long as they are successfully
involved in the routing exchanges. Although inappropriate
disclosure of routing information can pose a security threat or be
part of a later, larger, or higher layer attack, confidentiality
is not generally a design goal of routing protocols.
o Deception: This consequence happens when a legitimate router
receives a forged routing message and believes it to be authentic.
Both outsiders and Byzantine routers can cause this consequence if
the receiving router lacks the ability to check routing message
integrity or origin authentication.
o Disruption: This consequence occurs when a legitimate router’s
operation is being interrupted or prevented. Outsiders can cause
this by inserting, corrupting, replaying, delaying, or dropping
routing messages, or by breaking routing sessions between
legitimate routers. Byzantine routers can cause this consequence
by sending false routing messages, interfering with normal routing
exchanges, or flooding unnecessary routing protocol messages.
(DoS is a common threat action causing disruption.)
o Usurpation: This consequence happens when an attacker gains
control over the services/functions a legitimate router is
providing to others. Outsiders can cause this by delaying or
dropping routing exchanges, or fabricating or replaying routing
information. Byzantine routers can cause this consequence by
sending false routing information or interfering with routing
exchanges.
Note: An attacker does not have to control a router directly to
control its services. For example, in Figure 1, Network 1 is dual-
homed through Router A and Router B, and Router A is preferred.
However, Router B is compromised and advertises a better metric.
Consequently, devices on the Internet choose the path through Router
B to reach Network 1. In this way, Router B steals the data traffic,
and Router A loses its control of the services to Router B. This is
depicted in Figure 1.
+-------------+ +-------+
| Internet |---| Rtr A |
+------+------+ +---+---+
| |
| |
| |
| *-+-*
+-------+ / \
| Rtr B |----------* N 1 *
+-------+ \ /
*---*
Figure 1. Dual-homed network
Several threat consequences might be caused by a single threat
action. In Figure 1, there exist at least two consequences: routers
using Router B to reach Network 1 are deceived, and Router A is
usurped.
3.1.2.1. Threat Consequence Scope
As mentioned above, an attack might damage the data traffic intended
for a particular network or host or damage the operation of the
routing infrastructure of the network as a whole. Damage that might
result from attacks against the network as a whole may include the
following:
o Network congestion. More data traffic is forwarded through some
portion of the network than would otherwise need to carry the
traffic.
o Blackhole. Large amounts of traffic are unnecessarily re-directed
to be forwarded through one router and that router drops
many/most/all packets.
o Looping. Data traffic is forwarded along a route that loops, so
that the data is never delivered (resulting in network
congestion).
o Partition. Some portion of the network believes that it is
partitioned from the rest of the network when it is not.
o Churn. The forwarding in the network changes (unnecessarily) at a
rapid pace, resulting in large variations in the data delivery
patterns (and adversely affecting congestion control techniques).
o Instability. The protocol becomes unstable so that convergence on
a global forwarding state is not achieved.
o Overcontrol. The routing protocol messages themselves become a
significant portion of the traffic the network carries.
o Clog. A router receives an excessive number of routing protocol
messages, causing it to exhaust some resource (e.g., memory, CPU,
battery).
The damage that might result from attacks against a particular host
or network address may include the following:
o Starvation. Data traffic destined for the network or host is
forwarded to a part of the network that cannot deliver it.
o Eavesdrop. Data traffic is forwarded through some router or
network that would otherwise not see the traffic, affording an
opportunity to see the data or at least the data delivery pattern.
o Cut. Some portion of the network believes that it has no route to
the host or network when it is in fact connected.
o Delay. Data traffic destined for the network or host is forwarded
along a route that is in some way inferior to the route it would
otherwise take.
o Looping. Data traffic for the network or host is forwarded along
a route that loops, so that the data is never delivered.
It is important to consider all consequences, because some security
solutions can protect against one consequence but not against others.
It might be possible to design a security solution that protects
against eavesdropping on one destination’s traffic without protecting
against churn in the network. Similarly, it is possible to design a
security solution that prevents a starvation attack against one host,
but not a clogging attack against a router. The security
requirements must be clear as to which consequences are being avoided
and which consequences must be addressed by other means (e.g., by
administrative means outside the protocol).
3.1.2.2. Threat Consequence Zone
A threat consequence zone covers the area within which the network
operations have been affected by threat actions. Possible threat
consequence zones can be classified as a single link or router,
multiple routers (within a single routing domain), a single routing
domain, multiple routing domains, or the global Internet. The threat
consequence zone varies based on the threat action and the position
of the target of the attack. Similar threat actions that happen at
different locations may result in totally different threat
consequence zones. For example, when an outsider breaks the routing
session between a distribution router and a stub router, only
reachability to and from the network devices attached to the stub
router will be impaired. In other words, the threat consequence zone
is a single router. In another case, if the outsider is located
between a customer edge router and its corresponding provider edge
router, such an action might cause the whole customer site to lose
its connection. In this case, the threat consequence zone might be a
single routing domain.
3.1.2.3. Threat Consequence Periods
A threat consequence period is defined as the portion of time during
which the network operations are impacted by the threat consequences.
The threat consequence period is influenced by, but not totally
dependent on, the duration of the threat action. In some cases, the
network operations will get back to normal as soon as the threat
action has been stopped. In other cases, however, threat
consequences may persist longer than does the threat action. For
example, in the original Advanced Research Projects Agency Network