(ARPANET) link-state algorithm, some errors in a router introduced
three instances of a Link-State Announcement (LSA). All of them
flooded throughout the network continuously, until the entire network
was power cycled [2].
4. Generally Identifiable Routing Threat Actions
This section addresses generally identifiable and recognized threat
actions against routing protocols. The threat actions are not
necessarily specific to individual protocols but may be present in
one or more of the common routing protocols in use today.
4.1. Deliberate Exposure
Deliberate exposure occurs when an attacker takes control of a router
and intentionally releases routing information to other entities
(e.g., the attacker, a web page, mail posting, other routers) that
otherwise should not receive the exposed information.
The consequence of deliberate exposure is the disclosure of routing
information.
The threat consequence zone of deliberate exposure depends on the
routing information that the attackers have exposed. The more
knowledge they have exposed, the bigger the threat consequence zone.
The threat consequence period of deliberate exposure might be longer
than the duration of the action itself. The routing information
exposed will not be outdated until there is a topology change of the
exposed network.
4.2. Sniffing
Sniffing is an action whereby attackers monitor and/or record the
routing exchanges between authorized routers to sniff for routing
information. Attackers can also sniff data traffic information
(however, this is out of scope of the current work).
The consequence of sniffing is disclosure of routing information.
The threat consequence zone of sniffing depends on the attacker’s
location, the routing protocol type, and the routing information that
has been recorded. For example, if the outsider is sniffing a link
that is in an OSPF totally stubby area, the threat consequence zone
should be limited to the whole area. An attacker that is sniffing a
link in an External Border Gateway Protocol (EBGP) session can gain
knowledge of multiple routing domains.
The threat consequence period might be longer than the duration of
the action. If an attacker stops sniffing a link, their acquired
knowledge will not be out-dated until there is a topology change of
the affected network.
4.3. Traffic Analysis
Traffic analysis is an action whereby attackers gain routing
information by analyzing the characteristics of the data traffic on a
subverted link. Traffic analysis threats can affect any data that is
sent over a communication link. This threat is not peculiar to
routing protocols and is included here for completeness.
The consequence of data traffic analysis is the disclosure of routing
information. For example, the source and destination IP addresses of
the data traffic and the type, magnitude, and volume of traffic can
be disclosed.
The threat consequence zone of the traffic analysis depends on the
attacker’s location and what data traffic has passed through. An
attacker at the network core should be able to gather more
information than its counterpart at the edge and would therefore have
to be able to analyze traffic patterns in a wider area.
The threat consequence period might be longer than the duration of
the traffic analysis. After the attacker stops traffic analysis, its
knowledge will not be outdated until there is a topology change of
the disclosed network.
4.4. Spoofing
Spoofing occurs when an illegitimate device assumes the identity of a
legitimate one. Spoofing in and of itself is often not the true
attack. Spoofing is special in that it can be used to carry out
other threat actions causing other threat consequences. An attacker
can use spoofing as a means for launching other types of attacks.
For example, if an attacker succeeds in spoofing the identity of a
router, the attacker can send out unrealistic routing information
that might cause the disruption of network services.
There are a few cases where spoofing can be an attack in and of
itself. For example, messages from an attacker that spoof the
identity of a legitimate router may cause a neighbor relationship to
form and deny the formation of the relationship with the legitimate
router.
The consequences of spoofing are as follows:
o The disclosure of routing information. The spoofing router will
be able to gain access to the routing information.
o The deception of peer relationship. The authorized routers, which
exchange routing messages with the spoofing router, do not realize
that they are neighboring with a router that is faking another
router’s identity.
The threat consequence zone is as follows:
o The consequence zone of the fake peer relationship will be limited
to those routers trusting the attacker’s claimed identity.
o The consequence zone of the disclosed routing information depends
on the attacker’s location, the routing protocol type, and the
routing information that has been exchanged between the attacker
and its deceived neighbors.
Note: This section focuses on addressing spoofing as a threat on its
own. However, spoofing creates conditions for other threats actions.
The other threat actions are considered falsifications and are
treated in the next section.
4.5. Falsification
Falsification is an action whereby an attacker sends false routing
information. To falsify the routing information, an attacker has to
be either the originator or a forwarder of the routing information.
It cannot be a receiver-only. False routing information describes
the network in an unrealistic fashion, whether or not intended by the
authoritative network administrator.
4.5.1. Falsifications by Originators
An originator of routing information can launch the falsifications
that are described in the next sections.
4.5.1.1. Overclaiming
Overclaiming occurs when a Byzantine router or outsider advertises
its control of some network resources, while in reality it does not,
or if the advertisement is not authorized. This is given in Figures
2 and 3.
+-------------+ +-------+ +-------+
| Internet |---| Rtr B |---| Rtr A |
+------+------+ +-------+ +---+---+
| .
| |
| .
| *-+-*
+-------+ / \
| Rtr C |------------------* N 1 *
+-------+ \ /
*---*
Figure 2. Overclaiming-1
+-------------+ +-------+ +-------+
| Internet |---| Rtr B |---| Rtr A |
+------+------+ +-------+ +-------+
|
|
|
| *---*
+-------+ / \
| Rtr C |------------------* N 1 *
+-------+ \ /
*---*
Figure 3. Overclaiming-2
The above figures provide examples of overclaiming. Router A, the
attacker, is connected to the Internet through Router B. Router C is
authorized to advertise its link to Network 1. In Figure 2, Router A
controls a link to Network 1 but is not authorized to advertise it.
In Figure 3, Router A does not control such a link. But in either
case, Router A advertises the link to the Internet, through Router B.
Both Byzantine routers and outsiders can overclaim network resources.
The consequences of overclaiming include the following:
o Usurpation of the overclaimed network resources. In Figures 2 and
3, usurpation of Network 1 can occur when Router B (or other
routers on the Internet not shown in the figures) believes that
Router A provides the best path to reach the Network 1. As a
result, routers forward data traffic destined to Network 1 to
Router A. The best result is that the data traffic uses an
unauthorized path, as in Figure 2. The worst case is that the
data never reaches the destination Network 1, as in Figure 3. The
ultimate consequence is that Router A gains control over Network
1’s services, by controlling the data traffic.
o Usurpation of the legitimate advertising routers. In Figures 2
and 3, Router C is the legitimate advertiser of Network 1. By
overclaiming, Router A also controls (partially or totally) the
services/functions provided by the Router C. (This is NOT a
disruption, as Router C is operating in a way intended by the
authoritative network administrator.)
o Deception of other routers. In Figures 2 and 3, Router B, or
other routers on the Internet, might be deceived into believing
that the path through Router A is the best.
o Disruption of data planes on some routers. This might happen to
routers that are on the path that is used by other routers to
reach the overclaimed network resources through the attacker. In
Figures 2 and 3, when other routers on the Internet are deceived,
they will forward the data traffic to Router B, which might be
overloaded.
The threat consequence zone varies based on the consequence:
o Where usurpation is concerned, the consequence zone covers the
network resources that are overclaimed by the attacker (Network 1
in Figures 2 and 3), and the routers that are authorized to
advertise the network resources but lose the competition against
the attacker (Router C in Figures 2 and 3).
o Where deception is concerned, the consequence zone covers the
routers that do believe the attacker’s advertisement and use the
attacker to reach the claimed networks (Router B and other
deceived routers on the Internet in Figures 2 and 3).
o Where disruption is concerned, the consequence zone includes the
routers that are on the path of misdirected data traffic (Router B
in Figures 2 and 3 and other routers in the Internet on the path
of the misdirected traffic).
The threat consequence will not cease when the attacker stops
overclaiming and will totally disappear only when the routing tables
are converged. As a result, the consequence period is longer than
the duration of the overclaiming.
4.5.1.2. Misclaiming
A misclaiming threat is defined as an action whereby an attacker is
advertising some network resources that it is authorized to control,
but in a way that is not intended by the authoritative network
administrator. For example, it may be advertising inappropriate link
costs in an OSPF LSA. An attacker can eulogize or disparage when
advertising these network resources. Byzantine routers can misclaim
network resources.
The threat consequences of misclaiming are similar to the
consequences of overclaiming.
The consequence zone and period are also similar to those of
overclaiming.
4.5.2. Falsifications by Forwarders
In each routing protocol, routers that forward routing protocol
messages are expected to leave some fields unmodified and to modify
other fields in certain circumscribed ways. The fields to be
modified, the possible new contents of those fields and their
computation from the original fields, the fields that must remain
unmodified, etc. are all detailed in the protocol specification.
They may vary depending on the function of the router or its network
environment. For example, in RIP, the forwarder must modify the
routing information by increasing the hop count by 1. On the other
hand, a forwarder must not modify any field of the type 1 LSA in OSPF
except the age field. In general, forwarders in distance vector
routing protocols are authorized to and must modify the routing
information, while most forwarders in link state routing protocols
are not authorized to and must not modify most routing information.
As a forwarder authorized to modify routing messages, an attacker
might also falsify by not forwarding routing information to other
authorized routers as required.
4.5.2.1. Misstatement
This is defined as an action whereby the attacker modifies route
attributes in an incorrect manner. For example, in RIP, the attacker
might increase the path cost by two hops instead of one. In BGP, the
attacker might delete some AS numbers from the AS PATH.
Where forwarding routing information should not be modified, an
attacker can launch the following falsifications:
o Deletion. Attacker deletes valid data in the routing message.
o Insertion. Attacker inserts false data in the routing message.
o Substitution. Attacker replaces valid data in the routing message
with false data.
A forwarder can also falsify data by replaying out-dated data in the
routing message as current data.
All types of attackers, outsiders and Byzantine routers, can falsify
the routing information when they forward the routing messages.
The threat consequences of these falsifications by forwarders are
similar to those caused by originators: usurpation of some network
resources and related routers; deception of routers using false
paths; and disruption of data planes of routers on the false paths.
The threat consequence zone and period are also similar.
4.6. Interference
Interference is a threat action whereby an attacker inhibits the
exchanges by legitimate routers. The attacker can do this by adding
noise, by not forwarding packets, by replaying out-dated packets, by
inserting or corrupting messages, by delaying responses, by denial of
receipts, or by breaking synchronization.
Byzantine routers can slow down their routing exchanges or induce
flapping in the routing sessions of legitimate neighboring routers.
The consequence of interference is the disruption of routing
operations.
The consequence zone of interference depends on the severity of the
interference. If the interference results in consequences at the
neighbor maintenance level, then there may be changes in the
database, resulting in network-wide consequences.
The threat consequences might disappear as soon as the interference
is stopped or might not totally disappear until the networks have
converged. Therefore, the consequence period is equal to or longer
than the duration of the interference.
4.7. Overload
Overload is defined as a threat action whereby attackers place excess
burden on legitimate routers. For example, it is possible for an
attacker to trigger a router to create an excessive amount of state
that other routers within the network are not able to handle. In a
similar fashion, it is possible for an attacker to overload database
routing exchanges and thus to influence the routing operations.
5. Security Considerations
This entire document is security related. Specifically, the document
addresses security of routing protocols as associated with threats to
those protocols. In a larger context, this work builds upon the
recognition of the IETF community that signaling and
control/management planes of networked devices need strengthening.
Routing protocols can be considered part of that signaling and
control plane. However, to date, routing protocols have largely
remained unprotected and open to malicious attacks. This document
discusses inter- and intra-domain routing protocol threats that are
currently known and lays the foundation for other documents that will
discuss security requirements for routing protocols. This document
is protocol independent.
6. References
6.1. Normative References
[1] Shirey, R., "Internet Security Glossary", RFC 2828, May 2000.
[2] Rosen, E., "Vulnerabilities of network control protocols: An
example", RFC 789, July 1981.
[3] Perlman, R., "Network Layer Protocols with Byzantine
Robustness", PhD thesis, MIT LCS TR-429, October 1988.
[4] Moy, J., "OSPF Version 2", STD 54, RFC 2328, April 1998.
[5] Callon, R., "Use of OSI IS-IS for routing in TCP/IP and dual
environments", RFC 1195, December 1990.
[6] Malkin, G., "RIP Version 2", STD 56, RFC 2453, November 1998.
[7] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway Protocol 4
(BGP-4)", RFC 4271, January 2006.
[8] ISO 10589, "Intermediate System to Intermediate System intra-
domain routeing information exchange protocol for use in
conjunction with the protocol for providing the connectionless-
mode network service (ISO 8473)", ISO/IEC 10589:2002.
Appendix A. Acknowledgments
This document would not have been possible save for the excellent
efforts and teamwork characteristics of those listed here.
o Dennis Beard, Nortel
o Ayman Musharbash, Nortel
o Jean-Jacques Puig, int-evry, France
o Paul Knight, Nortel
o Elwyn Davies, Nortel
o Ameya Dilip Pandit, Graduate student, University of Missouri
o Senthilkumar Ayyasamy, Graduate student, University of Missouri
o Stephen Kent, BBN
o Tim Gage, Cisco Systems
o James Ng, Cisco Systems
o Alvaro Retana, Cisco Systems
Appendix B. Acronyms
AS - Autonomous system. Set of routers under a single technical
administration. Each AS normally uses a single interior gateway
protocol (IGP) and metrics to propagate routing information within
the set of routers. Also called routing domain.
AS-Path - In BGP, the route to a destination. The path consists of
the AS numbers of all routers a packet must go through to reach a
destination.
BGP - Border Gateway Protocol. Exterior gateway protocol used to
exchange routing information among routers in different autonomous
systems.
LSA - Link-State Announcement
NLRI - Network Layer Reachability Information. Information that is
carried in BGP packets and is used by MBGP.
OSPF - Open Shortest Path First. A link-state IGP that makes routing
decisions based on the shortest-path-first (SPF) algorithm (also
referred to as the Dijkstra algorithm).
Authors’ Addresses
Abbie Barbir
Nortel
3500 Carling Avenue
Nepean, Ontario K2H 8E9
Canada
EMail: abbieb@nortel.com
Sandy Murphy
Sparta, Inc.
7110 Samuel Morse Drive
Columbia, MD
USA
Phone: 443-430-8000
EMail: sandy@sparta.com
Yi Yang
Cisco Systems
7025 Kit Creek Road
RTP, NC 27709
USA
EMail: yiya@cisco.com
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).