Blind data attack on BGP routers
17Mar_Catudal_Joseph.pdf (801.2Kb)Abstract
Transport Communication Protocol (TCP) implementations may not properly implement blind attack protection, leaving long-standing connections, such as Border Gateway Protocol (BGP) sessions, vulnerable to exploitation. This thesis aims to understand the efficacy of a blind data attack on BGP sessions. This thesis examines BGP, the protocols BGP relies on, and the effectiveness of safeguards against BGP blind attacks. A series of blind attack tests are performed against various production BGP implementations to determine how dangerous and feasible a blind attack is on BGP routing information integrity. Blind data attacks can inject and temporarily propagate erroneous routing information; however, on the routers tested, the complexity required to brute force connection-specific values makes blind data attacks difficult. Also, there is a high probability that a blind data attack will desynchronize a BGP session without modifying routing information. Protective measures are available that could further safeguard BGP sessions, but older router images may not implement some of the most vital protections recommended today. Organizations responsible for routing infrastructure and network security must carefully weigh the risk of not implementing more strict protection measures should a discovered vulnerability reduce attack complexity.
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.Related items
Showing items related by title, author, creator and subject.
-
Optimal Patrol to Uncover Threats in Time When Detection Is Imperfect
(2013-08-12);This paper considers a patrol problem, where a patroller traverses a graph through edges to detect potential attacks at nodes. Attackers arrive at each node according to independent Poisson processes and take a random ... -
Deterring terrorism a framework for making retaliatory threats credible
(Monterey, California. Naval Postgraduate School, 2009-12);To deter terrorism, U.S. deterrence strategy must threaten retaliatory responses that are appropriate to the actions by non-state actors the United States wishes to prevent. The effectiveness of those threats depends on ... -
Evaluation of a multi-agent system for simulation and analysis of distributed denial-of-service attacks
(Monterey, California. Naval Postgraduate School, 2003-12);DDoS attack is evolving at a rapid and alarming rate; an effective solution must be formulated using an adaptive approach. Most of the simulations are performed at the attack phase of the DDoS attack; thus the defense ...
