[论文解读] The Closed Resolver Project: Measuring the Deployment of Source Address Validation of Inbound Traffic

Yevheniya Nosyk, Maciej Korczyński+4 more|arXiv (Cornell University)|Jun 9, 2020

Network Security and Intrusion Detection被引用 4

一句话总结

本文介绍了封闭解析器项目（Closed Resolver Project），这是一项面向全球互联网的主动测量研究，通过向DNS解析器发送伪造源地址的查询请求，识别出缺乏入站源地址验证（SAV）的网络。研究发现，49%的IPv4自治系统（AS）和26%的IPv6自治系统缺乏一致的入站SAV，导致250万个IPv4和10万个IPv6封闭解析器面临基于欺骗的攻击（如NXNSAttack）风险。

ABSTRACT

Source Address Validation (SAV) is a standard aimed at discarding packets with spoofed source IP addresses. The absence of SAV for outgoing traffic has been known as a root cause of Distributed Denial-of-Service (DDoS) attacks and received widespread attention. While less obvious, the absence of inbound filtering enables an attacker to appear as an internal host of a network and may reveal valuable information about the network infrastructure. Inbound IP spoofing may amplify other attack vectors such as DNS cache poisoning or the recently discovered NXNSAttack. In this paper, we present the preliminary results of the Closed Resolver Project that aims at mitigating the problem of inbound IP spoofing. We perform the first Internet-wide active measurement study to enumerate networks that filter or do not filter incoming packets by their source address, for both the IPv4 and IPv6 address spaces. To achieve this, we identify closed and open DNS resolvers that accept spoofed requests coming from the outside of their network. The proposed method provides the most complete picture of inbound SAV deployment by network providers. Our measurements cover over 55 % IPv4 and 27 % IPv6 Autonomous Systems (AS) and reveal that the great majority of them are fully or partially vulnerable to inbound spoofing. By identifying dual-stacked DNS resolvers, we additionally show that inbound filtering is less often deployed for IPv6 than it is for IPv4. Overall, we discover 13.9 K IPv6 open resolvers that can be exploited for amplification DDoS attacks - 13 times more than previous work. Furthermore, we enumerate uncover 4.25 M IPv4 and 103 K IPv6 vulnerable closed resolvers that could only be detected thanks to our spoofing technique, and that pose a significant threat when combined with the NXNSAttack.

研究动机与目标

• 测量全球互联网中入站源地址验证（SAV）的部署情况，重点关注未能过滤伪造入站流量的网络。
• 识别并量化存在入站SAV不一致或缺失的网络，特别是那些托管易受欺骗攻击的封闭DNS解析器的网络。
• 提高网络运营商对缺失入站SAV风险的认识，并推动采用最佳实践，包括MANRS建议。
• 评估双栈IPv4和IPv6网络中SAV部署的一致性，并识别两种协议之间的差异。

提出的方法

• 使用非伪造源地址和伪造源地址查询探测全球范围内的开放与封闭DNS解析器，以检测是否过滤了伪造源IP的数据包。
• 利用扫描器向解析器发送伪造源和非伪造源的DNS查询，通过观察响应行为推断网络边缘的SAV策略。
• 随机化扫描顺序以避免对单个网络造成过载，并在15天内分散扫描以最小化对网络运营的影响。
• 根据运营商反馈，排除请求不被扫描的网络，并将其IP地址范围从分析和报告中移除。
• 对双栈解析器和自治系统进行指纹识别，以比较IPv4和IPv6之间SAV部署的一致性。
• 托管一个公共网站（https://closedresolver.korlabs.io），用户可查询其自身网络是否易受入站欺骗攻击。

实验结果

研究问题

• RQ1 在IPv4和IPv6自治系统（AS）中，有多少比例在网路边缘实施或缺乏入站源地址验证（SAV）？
• RQ2 由于缺少入站SAV，有多少封闭DNS解析器面临欺骗攻击风险？此类攻击的潜在放大效应如何？
• RQ3 在双栈网络中，入站SAV部署是否一致？IPv4和IPv6的过滤策略是否对齐？
• RQ4 导致入站SAV部署不一致或缺失的因素有哪些？为何尽管其具有直接安全收益，入站SAV仍不如出站SAV受重视？
• RQ5 与出站SAV相比，入站SAV的部署情况如何，特别是在参与MANRS计划的网络中？

主要发现

• 49%的IPv4自治系统和26%的IPv6自治系统表现出一致或部分缺失的入站SAV，表明存在广泛的安全漏洞。
• 本研究识别出530万个IPv4和1.6万个IPv6开放DNS解析器，另有250万个IPv4和10万个IPv6封闭解析器可能面临欺骗攻击风险。
• 入站SAV在双栈主机和自治系统中总体部署一致，尽管少数情况下IPv4过滤比IPv6更严密。
• 尽管反射DDoS攻击的风险已广为人知，全球范围内入站SAV仍部署不足，而其可直接保护内部网络和服务。
• 在自治系统层面，出站SAV的部署程度高于入站SAV，尤其是在参与MANRS的运营商中，凸显了安全激励的错配。
• 该项目共收到9个大型网络的排除请求（包括/8、/9和/10前缀），导致2900万个IPv4地址和两个IPv6前缀被从后续扫描和分析中移除。