[Paper Review] Notes On The Design Of An Internet Adversary

David S. H. Rosenthal, Petros Maniatis+3 more|ArXiv.org|Nov 22, 2004

Network Security and Intrusion Detection27 references3 citations

TL;DR

This paper proposes a conservative, threat-model-driven adversary specification for designing resilient Internet systems, particularly for peer-to-peer digital preservation systems like LOCKSS. It models an adversary with unlimited computational power, spoofable identities, and coordinated compromise capabilities, concluding that systems must prioritize graceful degradation and human intervention over perfect resilience due to the infeasibility of testing such extreme attack scenarios.

ABSTRACT

The design of the defenses Internet systems can deploy against attack, especially adaptive and resilient defenses, must start from a realistic model of the threat. This requires an assessment of the capabilities of the adversary. The design typically evolves through a process of simulating both the system and the adversary. This requires the design and implementation of a simulated adversary based on the capability assessment. Consensus on the capabilities of a suitable adversary is not evident. Part of the recent redesign of the protocol used by peers in the LOCKSS digital preservation system included a conservative assessment of the adversary's capabilities. We present our assessment and the implications we drew from it as a step towards a reusable adversary specification.

Motivation & Objective

• To develop a realistic, reusable adversary model for designing resilient Internet systems, especially for peer-to-peer digital preservation systems.
• To address the lack of consensus on adversary capabilities in system defense design.
• To guide the redesign of the LOCKSS protocol by assessing realistic threat capabilities based on real-world worm behavior.
• To establish design principles that prioritize survivability and human intervention over perfect fault tolerance under extreme attack conditions.

Proposed method

• Conducts a capability-based threat assessment of Internet adversaries using observed worm behavior (e.g., Code Red, Slapper) as empirical basis.
• Models the adversary as having unlimited computational power, enabling large-scale, sustained attacks on vulnerable systems.
• Assumes the adversary can assume unlimited identities via IP spoofing and compromised hosts, even with ingress filtering.
• Considers the adversary’s ability to exploit common vulnerabilities and uncover secrets through coordinated, persistent attacks.
• Proposes design strategies such as rate-limiting, 'newcomer pays' mechanisms, and bimodal behaviors to detect and delay failure.
• Uses game-theoretic and formal verification approaches from related fields as reference points for adversary modeling.

Experimental results

Research questions

• RQ1 What capabilities must a realistic Internet adversary be assumed to possess in order to design effective system defenses?
• RQ2 How do real-world worm outbreaks inform the upper bounds of adversary computational and network capabilities?
• RQ3 To what extent can traditional defense mechanisms (e.g., rate-limiting, puzzles) be subverted by a resource-rich adversary?
• RQ4 What design principles are necessary for systems to survive attacks by an adversary with near-unlimited resources and coordination?
• RQ5 How can system resilience be achieved when exhaustive testing of such attacks is infeasible?

Key findings

• An adversary with unlimited computational power can command up to 10,000 machine-years of processing time by exploiting widely deployed vulnerabilities, exceeding the effort used in the 1999 RSA DES Challenge III by a factor of 35.
• A significant proportion of vulnerable systems (e.g., 1/3) remain compromised for months after vulnerability disclosure, indicating long-lived attack surfaces.
• The adversary can assume unlimited identities via IP spoofing and compromised hosts, even under ingress filtering, due to low-cost spoofing on local subnets.
• The adversary can mount full-scale, undetected attacks with no warning, making proactive detection extremely difficult.
• Testing systems for resilience under such attacks is economically infeasible, making 'graceful failure' a more realistic design goal than perfect resilience.
• Techniques like rate-limiting, 'newcomer pays', and bimodal behaviors are essential to delay failure and enable human intervention.