Bestavros, Azer

English

Boston University Institutional Repository (OpenBU)

Boston UniversityOpenBU http://open.bu.eduBU Open Access Articles BU Open Access Articles2004-04-30Exploiting the transients ofadaptation for RoQ attacks oninternet resourcesThis work was made openly accessible by BU Faculty. Please share how this access benefits you.Your story matters.VersionCitation (published version): A Bestavros. 2004. "Exploiting the Transients of Adaptation for RoQAttacks on Internet Resources."https://hdl.handle.net/2144/26099Boston University1http://www.cs.bu.edu/groups/wingExploiting the Transients of Adaptation for RoQ Attacks on Internet ResourcesAzer BestavrosJoint work withMina Guirguis & Ibrahim MattaAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 2Denial of Service (DoS) Attacks How: Subject a service to a load that exceeds its steady-state capacity… Goal: Make resource unavailable to legitimate users…Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 3Denial of Service Attacks Most Recent Example: Attack on SCO’sWeb site on 2/2/04 courtesy of MyDoom A nuisance?  Freedom of Expression? Act of Patriotism? How about $26.1B of lost productivity!!!Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 4DoS: The Good News Need lots of resources to mount attack Attack can be anticipated There is a Red Sox Game; stay home! Easy to detect intrusion/attack Attack signature is simple When was the last time you saw elephants crossing the BU Bridge?  Theoretically can trace back perpetrators If nothing else, getting a ticket is a deterrent—maybe ☺Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 5What If… It takes less resources to mount attack Attack cannot be anticipated It’s just another day of gridlock on the BU Bridge Intrusion/attack detection is hard Attack signature is not as simple! No suspicious traffic patterns seen on bridge It is hard to trace back perpetrators Attacker is keen on not being exposed (a.k.a. “Reduction of Liability”, or RoL)Î Say hello to the world of “low-rate” DoS attacksAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 6Prior Work: Shrew Attack [KK03] Goal: Cause a subset of TCP flows to perpetually timeout How: Synchronize the attack traffic to exploit TCP timeout mechanism Upon a loss of a window of packets, a TCP flow is forced into timeout minRTO is lower bounded by 1 sec [RFC2988]2Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 7Our Work: RoQ Attacks Goal: “Bleed” the system of its capacity by forcing it to operate in its most inefficient region—with minimal exposure How: “Exploit” built-in load adaptation mechanisms to make the system perpetually in a transient state—unstable Hint: Make other drivers brake when they should accelerate and accelerate when they should brake. Just be a Boston driver ☺Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 8Our Work: RoQ AttacksAny adaptation TCP/AQM; BGP; Admission Control; Load Balancers; sensor coordinationTCP flows using timeout mechanismsAny systemWeb Servers; DNS; Internet RoutersWhat it targetsHarderSpoofing can be used for both source and destinationHardTransients could occur under normal operation; gridlock on the bridgeFewAttack goal is to maximize damage while minimizing exposureAdaptationDynamicsRoQHard Spoofing can be usedEasyElephants spotted periodicallyDepends on targeted victims’ RTTTCP Timeout MechanismShrewEasyFind elephant owners!EasyWatch for elephants!LotsFind Elephants and herd them to bridgeSteady-stateDoSTrace-backIntrusion detectionWhat it needsWhat it ExploitsAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 9Adversarial Exploits of Adaptation Adaptation mechanisms are built under an assumption of a non-adversarial loads Examples: random traffic patterns, random arrival processes, etc. Questions: What load patterns would be most virulent to a given adaptation scheme? How much adversarial load would it take to make adaptation harmful? …Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 10RoQ Attack: Definition RoQ Attacks maximize the marginal utility of attack traffic Î Potency Many Possible Instantiations  Damage = Rejected requests, response time, wasted BW Cost = Injected requests, # of attackers, attack BW Aggressiveness = Tolerance to exposure Large Omega Î Largest level of aggression Small Omega Î Minimal exposureAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 11Adversarial Exploits of Adaptation We considered three examples of RoQ: Congestion Control in Networks Admission Control for Web Servers Load Balancing in CDNs Many other vulnerabilities exist Dynamic routing (e.g., BGP) Power conservation in sensor networks Hard to find systems that would be safe!Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 12 Adopted Kelly’s optimization framework Maximize users’ utilities subject to  the network’s capacity constraints [K99] Primal source algorithmRoQ: Fundamental ConceptAdditive IncreaseMultiplicative DecreaseP1P3P23Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 13 Link price functions reflect prices fed back to sources as the load on the links varies Convergence and stability can be proved through Lyapunov function [K99]RoQ: Fundamental ConceptLoad/DemandPriceCapacitySources’ algorithms iterate over ratesLinks’ algorithms iterate over prices Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 14 RoQ attacks will hinder convergence Can destroy the “contractive mapping”of the pricing functionRoQ: Fundamental ConceptLoad/DemandPriceCapacityWithout attackDuring attackAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 15 Potency can be computed as a function of the convergence   Example Optimal attack exists that maximizes the potencyRoQ: Fundamental ConceptDamageCostP1 P2Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 16Network Adaptation: Part UnA packet loss = congestion signal AIMD Control No packet lossÎ increase sending rate linearly Packet lossÎ decrease sending rate exponentially Timeout Nothing is going throughÎ shut off for exponentially longer periods of timeAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 17Network Adaptation: Part Deux What generates a loss? No space in router queue (a.k.a. DropTail) Drop packet if queue builds up (a.k.a. RED) RED as example of Active Queue Mgmt Tries to avoid “herding behavior” by randomizing packet losses across flows and by relating loss probability to queue lengthAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 18Premise of a RoQ & RoL Attack1. RoQ: Attacker sends packets at high rate—enough to cause lots of flows to slow down exponentially fast (e.g., by halving their sending rate)2. RoL: Attacker shuts off3. Resource will be underutilized until flows “rev-up” their sending rate, which is a slow linear process by design4. Go back to 1…4Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 19 A simple “square wave” Values of δ, τ, and T will depend on setting—stay tuned…Attack PatterntT » ττy(t)δAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 20 Modeled as a set of difference equations for a set of n flows, each subject to a feedback control  loopNetwork Adaptation: RED+TCPAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 21Network Adaptation: Router Instantaneous buffer size S RCb(t)αiDixi(t)Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 22Network Adaptation: RED Queue (EWM) Average Size Loss RateAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 23Network Adaptation: TCP Sending Rate Evolution (a la AIMD)Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 24Network Adaptation: RED+TCP Model can be instantiated and numerical results obtainedAttack Starts Here Attack Period5Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 25Model Validation: RED SimulationAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 26RED versus DropTailAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 27How Bad Is It?Exposure/Aggressiveness IndexAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 28“Really”, How Bad Is It?  Can This Really Happen? It Did…Attack Sink Attack SourceAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 29Implementation ResultsLong RTT = 120 msecShort RTT = 15 mecAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 30Implementation ResultsLong RTT = 120 msec Harder to time-out [shrew]Short RTT = 15 mec1.6Mbps Shrew Attack [KK03]8.08 Mbps Î 1.25 Mbps Π = 4.20.37Mbps RoQ Attack8.08 Mbps Î 3.6 Mbps Π = 126Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 31It is even scarier… Could be mounted as a distributed RoQ Time multiplexed Traffic multiplexing  Traceback is that much harder! Spoofing source addresses Attack sink does not even have to exist!Any source! Any Destination!Victim LinkAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 32Steeling Quality (vs bandwidth)… or how to make a RED link look like a DropTail link?Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 33Tuning Attack ParametersCould be done using an on-line controllertτδTTδτ =5δm=20δδτ =5PotencyAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 34Adversarial Exploits of Adaptation We considered three examples of RoQ: Congestion Control in Networks Admission Control for Web Servers Load Balancing in CDNs Many other vulnerabilities exist Dynamic routing (e.g., BGP) Power conservation in sensor networks Hard to find systems that would be safe!Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 35Admission Control A “Gate” used to protect from overload Admit (cross the bridge ☺) Reject (into the river /) PostponeAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 36Admission Control Adaptation Admission Controller What percentage of requests should be admitted? Calculated based on the deviation between the server’s state and a target value PI Controller, AIMD Controller, etc… Feedback Monitor Measures the server’s state and report it back to the Controller Feedback delay7Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 37Admission Control Adaptation Modeled as a discrete time systemAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 38Admission Control: Model Controller: Proportional Integrative (PI) GateError SignalAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 39Server: Model Pending requestsLoad/Utilization Utilization/Service RateThrashing IndexAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 40RoQ Attack Premise1. RoQ: Attacker sends requests at high rate in a very small period of time, enough to push the server into overload2. RoL: Attacker shuts off3. Admission control will shut off subsequent legitimate requests. Since the system is thrashing, recovery will take a longer time4. Go back to 1…Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 41RoQ Attack Pattern A simple “square wave”tT » ττy(t)δAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 42 Model can be instantiated and solved Large potencies possible “theoretically”Admission Control Adaptation8Azer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 43Implementation Setup Server: Minihttpd Admission Control Forks a cgi script Access 1MB ~ 20 msec Clients: Httperf Utilization Memory utilization = Used / TotalAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 44Implementation ResultsAttack Start at 120 (, 740, …) with 800 requests; system recovers only at time 500 (, 1120, …)Potency depends on controller settings (e.g., gain) and other system characteristicsAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 45Implementation Results Effect of Feedback Delay Real Delay Averaging (EWMA) Limitations Linux alleviates thrashing: It Kills threads making collecting of data real hardÎ Only able to cause moderate thrashing Limitation on number of open connections generated by HttperfÎ Only able to use 4 machinesAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 46Take Home Messages RoQ Attacks Exploit Dynamics: It is NOT capitalizing on a static property of a protocol—unlike the “shrew” attack which causes perpetual timeouts RoQ Attacks Trade off Damage and Cost:It is NOT aiming to take a resource down at any cost, but rather it is aiming to get the maximum damage per attack byteAzer Bestavros Exploiting Transients of Adaptation for RoQ Attacks on Internet Resources 47Food For Thought… More elaborate attacks Complex attack patterns Are there fundamental tradeoffs? RoQ tolerance versus utilization/delay/fairness Other adaptation susceptibilities Routing algorithms, sensor nets, … Countermeasures Randomized adaptation Intrusion detection Traceback http://www.cs.bu.edu/groups/wingExploiting the Transients of Adaptation for RoQ Attacks on Internet ResourcesMore information available from WING Publicationshttp://www.cs.bu.edu/groups/wingMina Guirguis, Azer Bestavros, and Ibrahim Matta. Exploiting the Transients of Adaptation for RoQ Attacks on Internet Resources. In IEEE ICNP 2004.Mina Guirguis, Azer Bestavros, Ibrahim Matta, and Yuting Zhang. Reduction of Quality (RoQ) Attacks on Internet End-Systems. In IEEE INFOCOM 2005.

Exploiting the transients of adaptation for RoQ attacks on internet resources

https://open.bu.edu/bitstream/2144/26099/1/RoQ.pdf

Exploiting the transients of adaptation for RoQ attacks on internet resources

Abstract

Similar works

Full text

Available Versions

Boston University Institutional Repository (OpenBU)