1. Countering Large-Scale Internet Pollution and Poisoning Aleksandar Kuzmanovic Northwestern University http://www.cs.northwestern.edu/~akuzma/

2. Aleksandar Kuzmanovic 2 Problem and Approach (general) Denial of service (DoS) attacks in the Internet –Serious problem –Becoming more and more sophisticated Approach I –Search for new classes of DoS attacks and system vulnerabilities It is interesting; it makes sense; it is relevant; Approach II –Exploit asymmetric costs Small efforts by defenders will require attackers to multiply the amount of resources (e.g., bandwidth, time, precision) Raise the bar high enough to make the attacks hard (vs. impossible) to conduct

3. Aleksandar Kuzmanovic 3 Pollution in P2P File Sharing Systems Music industry vs. p2p networks Our work: –Denial-of-Service Resilience in Peer-to-Peer File Sharing Systems In Proceedings of ACM SIGMETRICS 2005. Insight –Despite highly replicated content and a decentralized system design, pollution attacks can be highly effective Is it feasible to conduct similar type of attacks in the Internet at a large scale?

4. Aleksandar Kuzmanovic 4 Large-Scale TCP Poisoning Attacks Attack scenario –“Sniff and shoot” –Extremely easy to desynchronize TCP endpoints a single packet needed (e.g., low rate attacks)

5. Aleksandar Kuzmanovic

8. 8 Large-Scale TCP Poisoning Attacks (II) Our Approach –No explicit security association between endpoints –Protocol design Raise the bar “high enough” to exploit asymmetric costs Solution-specific details –Deferred protocol reaction –Forward hashing –Self-clocking correlation method Kernel-level implementation in FreeBSD

9. Aleksandar Kuzmanovic 9 Fact: –Majority of requests for Web, p2p, and DNS are served from caches Pollution Attacks against Internet Caches

10. Aleksandar Kuzmanovic 10 Pollution Attack Scenarios (I) Attacking a web cache Attacking an ISP cache

11. Aleksandar Kuzmanovic 11 Pollution Attack Scenarios (II) ① ② ③ ④ ⑤ ⑥ ⑦ ⑧ Pollution attack against a local DNS server

12. Aleksandar Kuzmanovic 12 Pollution Attack Classes (I) ….... Locality-disruption attacks Cache ….... Cache Before attackAfter attack Popular files New unpopular files

13. Aleksandar Kuzmanovic 13 Pollution Attack Classes (II) ….... False locality attacks Cache ….... Cache Before attackAfter attack Popular files Bogus popular files

14. Aleksandar Kuzmanovic 14 Our Solution Design goals –High accuracy and scalability Approach –Streaming computation techniques, i.e., Bloom filters Squid-based implementation Squid AE Daemon AEI Spawn Signal Triggered Module File Detection Module (Main part) Auxiliary part of Detection Module A pair of pipes

15. Aleksandar Kuzmanovic 15 Summary Actively searching (and developing solutions) for new types of DoS attacks Pollution and poisoning –P2p networks, TCP, Internet caches Solutions –Exploit asymmetric costs between defenders and attackers –Prototype implementations