DOCSLIB.ORG

Amplification and Drdos Attack Defense – a Survey and New Perspectives

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Amplification and Drdos Attack Defense – a Survey and New Perspectives Amplification and DRDoS Attack Defense – A Survey and New Perspectives Fabrice J. Ryba∗, Matthew Orlinski∗, Matthias Wahlisch¨ ∗, Christian Rossowy, Thomas C. Schmidtz ∗ Freie Universitat¨ Berlin, Berlin, Germany, Email: ffabrice.ryba, m.orlinski, [email protected] y Saarland University, Saarbruecken, Germany, Email: [email protected] z HAW Hamburg, Hamburg, Germany, Email: [email protected] Abstract—The severity of amplification attacks has attacks, e.g., Slowloris [21] or TCP SYN floods [22], grown in recent years with recent attacks involving several unless their defenses are also applicable to amplification hundreds of Gbps attack volume. In this paper, we survey attacks. Generally, the adversary in amplification attacks the threat of amplification attacks and compare a wide targets vulnerabilities in Internet protocols and services selection of different proposals for preventing, detecting, to amplify the amount of attack traffic. The ease of per- and filtering amplification attack traffic. Since source IP spoofing plays an important part in almost all of the forming amplification attacks and greater understanding amplification attacks surveyed, we also survey state-of- of their effect has led to an increase of attacks in recent the-art of spoofing defenses as well as approaches to trace years. This is supported, e.g., by the OpenDNS Security spoofing sources. This work acts as an introduction into Lab that saw over 5,000 different amplification attacks many different types of amplification attacks and source every hour in 2014 [23], and by Rossow’s survey of IP address spoofing. By combining previous works into a amplification vulnerabilities [13]. single comprehensive discussion we hope to prevent redun- The most prominent form of amplification attack seen dant work and encourage others to find practical solutions in recent years abuses the lack of endpoint verification for defending against future amplification attacks. in the Internet Protocol (IP) in order to trick third-party servers into sending large amounts of data to victims. I. INTRODUCTION That is, attackers spoof source IP addresses [24] to hide Denial of Service (DoS) attacks against networks at- their identity and cause third-parties to send data to the tempt to make a system or an entire network unavailable victim as identified by the source address field of the IP for its intended purpose [1]. In some cases DoS attacks packet. This is also sometimes called reflection because cause a complete loss of Internet connectivity for the attackers “reflect” attack traffic off of benign services. victim [2]. The motivation for DoS attacks can be finan- As well as reflection, attackers sometimes strive to cial [3], [4], political [2], ideological [5], reputation [6], maximize the attack bandwidth sent to the victim by arXiv:1505.07892v3 [cs.NI] 17 May 2016 [7], to test new techniques and prepare for larger attacks, using amplification. For example, many UDP-based pro- or purely for disruptive purposes [8]. tocols (such as DNS or NTP) that have a higher response A general overview of DoS attacks and defense strate- payload size than the requests can be abused to amplify gies can already be found in the surveys by Mirkovic the reflected attack traffic. Consider DNS, while DNS and Reiher [9], Douligeris and Mitrokotsa [10], and lookup requests are typically rather small, the responses more recently Zargar et al. [11]. Instead, this paper may be significantly larger, e.g., due to verbose informa- focuses on a particular type of DoS attack called an tion such as DNSSEC records. amplification attack (also called Distributed Reflective By combining reflection and amplification attackers Denial of Service (DRDoS) attacks [12], [13]) where the can generate attack traffic volumes which are signifi- attacker seeks to maximise the volume of attack traffic cantly higher than their uplink bandwidth [2], [4], [8], sent to the victim whilst minimising the volume of traffic [25]. Furthermore, not only single hosts may be affected they send to trigger the attack [14]–[20]. We will not by such attacks. Entire networks may struggle to cope discuss other low traffic volume and high impact DoS with the extra bandwidth and processing demands [25]. Section 1: Introduction from the past and discuss amplification attacks in great Section 2: Reflection and Amplification Attacks detail. We then describe methods to prevent amplification Previous Attacks Attack Models attacks in Section III. Then special attention is paid to Section 3: Preventing Amplification Attacks preventing reflection and IP spoofing in Section IV. We Alternative Architectures Lowering Amplification Factors Reducing Number of Amplifiers Response Rate Limiting UDP Sessions Filtering Spoofed Packets finish the discussion about the solution space in Sec- tion V by presenting approaches to detect and filter am- Section 4: Source IP Address Spoofing plification attacks. Finally, we conclude in Section VI. Monitoring Spoofing In The Wild Active Monitoring Passive Monitoring II. AMPLIFICATION ATTACKS Detecting and Filtering Spoofed Packets Flow Correlation This section provides a detailed introduction into the Validating Source Address Using Network Knowledge End-to-end IP Headers, e.g., TTL different techniques for amplifying attack traffic. We start Encryption Ingress and Egress Filtering Third-party Authentication Learning Flow Directions by giving a brief taxonomy and timeline of different Routing Tables types of amplificaiton attacks, and then we end the section by describing the techniques used in more detail. Tracing Spoofing Attacks Traffic Logs Packet Marking ICMP Traceback Link Testing Section 5: Detecting Amplification Attacks and Filtering Attack Traffic A. Taxonomy and Historical Background Locations for Detecting and Filtering Attack Traffic There are many ways of amplifying the volume of Victim-end Source-end Reflectors/Amplifiers Distributed attack traffic in DoS attacks. In this paper we give Predicting Future Attacks special focus to amplification attacks which use UDP Game Therory Scan Detection based amplifying protocols and reflection. However, it is Section 6: Conclusions, ongoing projects, and future work important to be able to distinguist between the different types of amplificaiton attacks. Fig. 1. Categorisation of the amplification DDoS literature. 1) DNS Servers as Amplifiers: In 1999, AusCERT [27] warned about amplification attacks where attackers trick DNS servers into sending large Defending against this form of amplification attack amounts of data to spoofed IP addresses [24]. In 2000, is challenging for network operators. Firstly, the attack the CIAC warned of Distributed Denial of Service traffic blends in benign communication and may be (DDoS) attacks where attackers can send spoofed IP hard to distinguish from legitimate traffic. Secondly, packets from many different locations [28]. the attack packets received by victims are reflected by Today, DNS is widely used in amplification attacks many distributed benign third-parties such as open DNS because a 60 byte request from an attacker can easily resolvers, effectively hiding the attacker’s identity [26]. generate a 512 byte response [2], [8], [14]. Furthermore, In this survey paper, we systematically structure ex- DNS servers which support Extension mechanisms for isting research on amplification attacks to assist future DNS (EDNS) [29] can generate responses which are research in this direction. To the best of our knowledge, nearly 100 times larger than requests [13]. Some at- we are the first to categorize an research area that spans tackers even ensure large responses by creating domains almost 200 publications and has become an important specifically to use in amplification attacks [23]. problem both in academia and practice. To this end, we Any public DNS server which is configured to respond first compare various definitions and types of amplifica- to requests for hosts outside of their domain can be used tion attacks. With this foundation, we then systematize in amplification attacks. DNS servers that are configured preventive countermeasures, and particularly look at the to respond to all such requests are known as open DNS problem of (identifying and mitigating) IP spoofing. We resolvers. According to the Open DNS Resolver Project complete our survey with works that proposed reactive approximately 25 million open DNS resolvers currently countermeasures to defend against ongoing amplification “pose a significant threat” to the Internet [26]. It is also attacks. Our main contribution is thus a comprehensive not difficult to find enough open DNS resolvers to use survey of existing literature that until now was scattered. in amplification attacks. Rossow showed that it currently The rest of this paper is organised as shown in only takes 90 seconds to acquire a list of 100,000 open Figure 1. In Section II, we present prominent incidents DNS resolvers [13]. 2 400 300 167 SNMP attack at MIT and100 SSDP attack Vaughn and Evron present DNS 54 AusCERT warns about DNS DNS is regularly used in DERP claims responsibility for many Estimated attack traffic (Gbps) amplification attacks Akamai reports a 54Gbps based amplification attacks 300Gbps DNS attack against SpamHaus 100Gbps DNS attack against GreenNet CloudFlare reports a 400Gbps NTP attack Amplification Attacks at DEFCON 14 Prolexic reports a 167Gbps DNS attack attacks against the gaming industry 1998 2001 2004 2007 2013 F eb Mar Apr May Jun Jul Aug Sep Oct Nov Dec 2014 F eb Mar Oct Fig. 2. Timeline of amplification attacks and related events. 2) Other UDP Based Services: The DNS based broadcast may be amplifiers as well. For example, in amplification attacks just described use source IP ad- Fraggle attacks an attacker may send CharGen requests dress spoofing to trick third-parties into attacking a to the broadcast address of many networks at the same victim [24]. time [37]. End hosts which receive CharGen requests Source IP address spoofing also makes it very difficult may respond with much more data than they receive, for the victim to track attacker because all attack traffic thus the end hosts in Fraggle attacks are amplifiers as they receive will come from third-parties.
Load more

Recommended publications
  • Final Report
    Augment Spoofer Project to Improve Remediation Efforts (ASPIRE) Final Report Dr. Kimberly Claffy and Dr. Matthew Luckie September 21, 2020 Table of Contents A Executive Summary 2 B Problem: Long-standing vulnerability that threatens U.S. critical infrastructure 3 C Technical Approach 3 D Development Deliverables 6 D.1 Extend visibility capabilities to infrastructure behindNATs............. 6 D.2 SupportforAS-levelopt-innotificationsystem . ............ 7 D.3 Automated monthly reports to regional operator mailing lists............ 7 D.4 Maintainspooferoperations . ...... 8 E Analysis of Remediation Efforts 10 E.1 Impactofprivatenotificationsonremediation . ............ 10 E.2 Impact of public (“name-and-shame”) notifications . ............. 10 F Technology Transition and Commercialization 12 F.1 Commercializationopportunities . ......... 12 F.2 Expansiontoothermeasurementplatforms . ......... 12 G Overcoming misaligned incentives to deploy SAV 12 G.1 Impactofexogenousinterventions . ........ 13 G.2 Liability,insurance,andindustrystandards . ............. 13 G.3 Regulatingtransparency . ..... 14 G.4 Regulatinggovernmentprocurement . ........ 14 G.5 Stickydefaults: vendorSAVresponsibility . ............ 15 H Deliverables 17 A Executive Summary 1. Performer: University of California, San Diego (UCSD) & University of Waikato, NZ 2. Award: DHS S&T contract 140D7018C0010. 3. Period of Performance: 1 Sept 2018 - 19 Sept 2020. Despite source IP address spoofing being a known vulnerability – arguably the greatest archi- tectural vulnerability in the TCP/IP protocol suite as designed – for close to 30 years, and despite many efforts to shed light on the problem, spoofing remains a viable attack method for redirection, amplification, and anonymity. While some application-layer patches can mitigate these attacks, attackers continuously search for new vectors. To defeat DDoS attacks requires operators to en- sure their networks filter packets with spoofed source IP addresses, a best current practice (BCP) known as source address validation (SAV).
    [Show full text]
  • Firewalls and Vpns
    Firewalls and VPNs Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-17/ Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-1 Overview 1. What is a Firewall? 2. Types of Firewalls 3. Proxy Servers 4. Firewall Location and Configuration 5. Virtual Private Networks These slides are based on Lawrie Brown’s slides supplied with William Stalling’s th book “Cryptography and Network Security: Principles and Practice,” 7 Ed, 2017. Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-2 What is a Firewall? Interconnects networks with differing trust Only authorized traffic is allowed Auditing and controlling access Can implement alarms for abnormal behavior Provides network address translation (NAT) and usage monitoring Implements VPNs Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-3 Firewall Limitations Cannot protect from attacks bypassing it E.g., sneaker net, utility modems, trusted organisations, trusted services (e.g., SSL/SSH) Cannot protect against internal threats E.g., disgruntled or colluding employees Cannot protect against access via Wireless LAN If improperly secured against external use, e.g., personal hot spots Cannot protect against malware imported via laptops, PDAs, and storage infected outside Washington University in St. Louis http://www.cse.wustl.edu/~jain/cse571-17/ ©2017 Raj Jain 23-4 Firewalls – Packet Filters Examine each IP packet (no context) and permit or deny according to rules Washington University in St.
    [Show full text]
  • Anti Spoofing
    Anti-Spoofing What is Spoofing? In simple terms, A technique used to gain unauthorized access to computers, whereby the intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host. Types Of Spoofing Attacks IP Address ARP DNS Spoofing Spoofing Spoofing IP Address Spoofing Attacks • IP address spoofing is one of the most frequently used spoofing attack methods. • An attacker sends IP packets from a false (or “spoofed”) source address in order to disguise itself. ARP Spoofing Attacks • ARP is short for Address Resolution Protocol, a protocol that is used to resolve IP addresses to MAC (Media Access Control) addresses for transmitting data. • In this attack, a malicious party sends spoofed ARP messages across a local area network in order to link the attacker’s MAC address with the IP address of a legitimate member of the network. • ARP spoofing only works on local area networks that use the Address Resolution Protocol. DNS Server Spoofing Attacks • The Domain Name System (DNS) is a system that associates domain names with IP addresses. • In a DNS server spoofing attack, a malicious party modifies the DNS server in order to reroute a specific domain name to a different IP address. • In such cases, the new IP address will be for a server that is actually controlled by the attacker and contains files infected with malware. • DNS server spoofing attacks are often used to spread computer worms and viruses. Anti-Spoofing Antispoofing is a technique for identifying and dropping packets that have a false source address.
    [Show full text]
  • Cases of IP Address Spoofing and Web Spoofing —
    3-3 StudiesonCountermeasuresforThwarting SpoofingAttacks—CasesofIPAddress SpoofingandWebSpoofing— MIYAMOTO Daisuke, HAZEYAMA Hiroaki, and KADOBAYASHI Youki This article intends to give case studies for of thwarting spoofing attack. Spoofing is widely used when attackers attempt to increase the success rate of their cybercrimes. In the context of Denial of Service (DoS) attacks, IP address spoofing is employed to camouflage the attackers’ location. In the context of social engineering, Web spoofing is used to persuade victims into giv- ing away personal information. A Web spoofing attacker creates a convincing but false copy of the legitimate enterprises’ web sites. The forged websites are also known as phishing sites. Our research group developed the algorithms, systems, and practices, all of which analyze cybercrimes that employ spoofing techniques. In order to thwart DoS attacks, we show the deployment scenario for IP traceback systems. IP traceback aims to locate attack source, regardless of the spoofed source IP addresses. Unfortunately, IP traceback requires that its sys- tems are widely deployed across the Internet. We argue the practical deployment scenario within Internets of China, Japan, and South Korea. We also develop a detection method for phishing sites. Currently, one of the most important research agenda to counter phishing is improving the accuracy for detecting phishing sites. Our approach, named HumanBoost, aims at improving the detection accuracy by utilizing Web users’ past trust decisions. Based on our subject experiments, we analyze the average detection accuracy of both HumanBoost and CANTINA. Keywords IP spoofing, Web spoofing, Internet emulation, IP traceback, Machine learning 1 Introduction measures. IP traceback aims to locate attack sources, regardless of the spoofed source IP DoS attacks exhaust the resources of addresses.
    [Show full text]
  • Towards Remediating Ddos Attacks
    Towards Remediating DDoS Attacks Arturs Lavrenovs NATO CCDCOE, Tallinn, Estonia [email protected] DOI: 10.34190/IWS.21.046 Abstract: The Internet infrastructure has been struggling with distributed denial­of­service (DDoS) attacks for more than two decades. This paper reviews aspects of current remediation strategies for reflected amplified DDoS attacks and identifies elements that are insufficiently researched which might be hindering remediation efforts. It identifies additional actors who should be playing a role in these efforts and reviews their incentives and motivation. The issue has long been whether it is possible to remediate abused protocols faster than the protocols get deprecated while devices using them remain functional until the end of their life. It now appears that it is. The Memcache protocol attack capacity was only 319 Mbps in May 2020 but it was 1.7 Tbps only two years previously. Thus it can be considered fully remediated. The paper examines why this was a successful remediation effort and whether it could be applied to other commonly abused protocols by using the reflector capacity measurement methodology. In contrast, the long­term abused DNS protocol has not seen a significant drop in capacity, which is lingering around 27.5 Tbps. Keywords: DDoS attacks, DDoS attack capacity, DDoS attack remediation, reflectors, amplifiers 1. Introduction The first DDoS network attack was two decades ago and was soon followed by reflected amplified DDoS attacks that have been plaguing the Internet ever since. Although the number of reflectors observed by scanning projects has been steadily decreasing, the attack capacity is ever­growing and is setting new records.
    [Show full text]
  • Proposed Methods of IP Spoofing Detection & Prevention
    International Journal of Science and Research (IJSR), India Online ISSN: 2319-7064 Proposed Methods of IP Spoofing Detection & Prevention Sharmin Rashid1, Subhra Prosun Paul2 1, 2World University of Bangladesh, Dhanmondi, Dhaka, Bangladesh Abstract: In computer networking, the term IP address spoofing or IP spoofing refers to the creation of Internet Protocol (IP) packets with a forged source IP address, called spoofing, with the purpose of concealing the identity of the sender or impersonating another computing system. On January 22, 1995, in an article entitled, ―New form of attack on computers linked to Internet is uncovered, John Markoff of the New York Times reported on the TCP/IP protocol suite's security weakness known as IP spoofing. The IP spoofing security weakness was published by S. M. Bellovin (1989). However, not much attention has been paid to the security weaknesses of the TCP/IP protocol by the general public. This is changing as more people and companies are connecting to the Internet to conduct business. This paper is on ― “Proposed methods of IP Spoofing Detection & Prevention”. This paper contains an overview of IP address and IP Spoofing and its background. It also shortly discusses various types of IP Spoofing, how they attack on communication system. This paper also describes some methods to detection and prevention methods of IP spoofing and also describes impacts on communication system by IP Spoofing. We think that our proposed methods will be very helpful to detect and stop IP spoofing and give a secured communication system. Keywords: IP address, IP Spoofing, TCP/IP, Compression, Cryptography 1.
    [Show full text]
  • Lecture 16: TCP/IP Vulnerabilities and Dos Attacks: IP Spoofing, SYN Flooding, and the Shrew Dos Attack
    Lecture 16: TCP/IP Vulnerabilities and DoS Attacks: IP Spoofing, SYN Flooding, and The Shrew DoS Attack Lecture Notes on “Computer and Network Security” by Avi Kak ([email protected]) March 16, 2021 5:43pm ©2021 Avinash Kak, Purdue University Goals: • To review the IP and TCP packet headers • Controlling TCP Traffic Congestion and the Shrew DoS Attack • The TCP SYN Flood Attack for Denial of Service • IP Source Address Spoofing Attacks • BCP 38 for Thwarting IP Address Spoofing for DoS Attacks • Python and Perl Scripts for Mounting DoS Attacks with IP Address Spoofing and SYN Flooding • Troubleshooting Networks with the Netstat Utility CONTENTS Section Title Page 16.1 TCP and IP 3 16.2 The TCP/IP Protocol Stack 5 16.3 The Network Layer (also known as the Internet 14 Layer or the IP Layer) 16.4 TCP, The Transport Layer Protocol for Reliable 25 Communications 16.5 TCP versus IP 34 16.6 How TCP Breaks Up a Byte Stream That 36 Needs to be Sent to a Receiver 16.7 The TCP State Transition Diagram 38 16.8 A Demonstration of the 3-Way Handshake 44 16.9 Splitting the Handshake for Establishing 52 a TCP Connection 16.10 TCP Timers 58 16.11 TCP Congestion Control and the Shrew DoS Attack 60 16.12 SYN Flooding 68 16.13 IP Source Address Spoofing for SYN Flood 71 DoS Attacks 16.14 Thwarting IP Source Address Spoofing With BCP 38 84 16.15 Demonstrating DoS through IP Address Spoofing and 89 SYN Flooding When The Attacking and The Attacked Hosts Are in The Same LAN 16.16 Using the Netstat Utility for Troubleshooting 103 Networks 16.17 Homework Problems 113 Computer and Network Security by Avi Kak Lecture 16 Back to TOC 16.1 TCP and IP • We now live in a world in which the acronyms TCP and IP are almost as familiar as some other computer-related words like bits, bytes, megabytes, etc.
    [Show full text]
  • A Survey of Defence Mechanisms Against IP Spoofing
    UGC Approved Journal IARJSET ISSN (Online) 2393-8021 ISSN (Print) 2394-1588 International Advanced Research Journal in Science, Engineering and Technology ISO 3297:2007 Certified Vol. 4, Issue 7, July 2017 A Survey of Defence Mechanisms against IP Spoofing Sarita Sahni1, Pankaj Jagtap2 M. Tech Student, SCSIT, DAVV, Indore, India1 Lecturer, SCSIT, DAVV, Indore, India2 Abstract: IP address spoofing is a serious threat to the legitimate use of the Internet. Many Preventive mechanisms are thwarted by the ability of attackers to forge or spoof the source addresses in IP packets. Attackers can evade detection and put a substantial burden on the destination network for policing attack packets. In this paper a study of methods for detection of IP address spoofing is undertaken. It compares various host based methods such as IPSec, the OS Fingerprinting, TCP probing, SYN Cookies and IP puzzles with router based methods such as ingress and egress filtering, Reverse Path Forwarding (RPF), Router based Filtering (RBF), Spoofing Prevention Method (SPM), Distributed Packet Filtering (DPF), Inter Domain Packet Filtering (IDPF), SAVE, BASE, Hop Count Filtering (HCF), Pi and StackPi on the bases of their performances and effectiveness. Keywords: Reverse Path Forwarding (RPF); Router Based Filtering (RBF); Spoofing Prevention Method (SPM); Distributed Packet Filtering (DPF); Inter Domain Packet Filtering (IDPF); Path Identification; Stack Path Identification. INTRODUCTION The Internet Protocol or IP is used for sending and receiving data over the Internet and computers that are connected to a network. Each packet has header that contain some field like fragmentation, sequence number field, flag including source and destination address. The source address is normally the address that the packet was sent from.
    [Show full text]
  • Netsec Notes
    Practical Network Security: Basic Tools & Techniques Guevara Noubir Northeastern University [email protected] Counter Hack Reloaded, Ed Skoudis, 2005, Prentice-Hall. Based on Nick Plante’s slides. Taxonomy of Discussion Points Threats: Basic Network Recon and Info Gathering Threats: More Intrusive Probes and Scans Threats: Network Vulnerabilities Network Architecture Vulnerabilities Denial of Service (DoS) Threats: Application/OS Vulnerabilities Remote to Local (R2L) Attacks User to Root (U2R) aka Privilege Escalation Attacker Access Maintenance (root kits, etc) Defenses Reviewed Firewalls, Intrusion Detection, etc. CSU610: SWARM Practice – Tools 2 Recon & Info Gathering Social Engineering: “the weakest link” Physical Security Physical access, Theft, Dumpster diving Defenses: Locks, Policies (access, screen savers, etc.), Encrypted file systems, Paper shredders Web Searching and Online Recon Check company website, get contact names, look for comments in html, etc. Use Search Engines, Usenet to discover technologies in use, employee names, etc. Defenses: “Security Through Obscurity”, Policies CSU610: SWARM Practice – Tools 3 Recon & Info Gathering Whois database via Internic (.com, .net, .org) Publicly-available starting place for determining contacts, name servers, etc. for a given domain Network Solutions (edu), nic.mil, nic.gov, Allwhois Query listed registrar for detailed whois entries including contacts, postal address, name servers, emails (and formats of email) Also: Use ARIN to find IP blocks for organizations!
    [Show full text]
  • Libvirt XML Schemas
    APPENDIX A Libvirt XML Schemas This appendix covers the XML schemas used by libvirt. Each major section in the appendix describes a single libvirt domain. Everything needed to completely describe all the elements of a libvirt domain are contained in the schema. The Domain Schema The Domain schema completely describes a libvirt domain, i.e., a virtual machine. The domain can be any of the supported libvirt types including QEMU/KVM, XEN, and so on. Obviously, some of the schema sections apply to only some of the supported domain types, so it makes sense that you need to include only the parts of the schema that apply to your domain. The same applies to devices and features. If your domain does not support or have certain devices or features, then simply do not include those sections. The Domain XML schema consists of a large number of XML elements (Listing A-1). The documentation for this schema is quite extensive, but in most cases the uses of the elements in the schema are obvious. If you need documentation, refer to https://libvirt.org/formatdomain.html for more specific information about each element and attribute. © W. David Ashley 2019 257 W. D. Ashley, Foundations of Libvirt Development, https://doi.org/10.1007/978-1-4842-4862-1 APPENDIX A LIBVIRT XML SCHEmas Listing A-1. The Domain Schema <!--General metadata --> <domain type='kvm' id='1'> <name>MyGuest</name> <uuid>4dea22b3-1d52-d8f3-2516-782e98ab3fa0</uuid> <genid>43dc0cf8-809b-4adb-9bea-a9abb5f3d90e</genid> <title>A short description - title - of the domain</title> <description>Some
    [Show full text]
  • Technical Report RHUL–ISG–2019–3 27 March 2019
    A secure framework for protecting IPv6 Neighbor Discovery Protocol Colin Putman Technical Report RHUL–ISG–2019–3 27 March 2019 Information Security Group Royal Holloway University of London Egham, Surrey, TW20 0EX United Kingdom Student Number: 100885782 Colin Putman Title: A Secure Framework for Protecting IPv6 Neighbor Discovery Protocol. Supervisor: Chris Mitchell Submitted as part of the requirements for the award of the MSc in Information Security at Royal Holloway, University of London. I declare that this assignment is all my own work and that I have acknowledged all quotations from published or unpublished work of other people. I also declare that I have read the statements on plagiarism in Section 1 of the Regulations Governing Examination and Assessment Offences, and in accordance with these regulations I submit this project report as my own work. Signature: Date: A Secure Framework for Protecting IPv6 Neighbor Discovery Protocol Table of Contents List of Abbreviations……………………………………………….………2 Executive Summary ………………………………………………………3 1. Introduction…………………………………………………………….….4 2. Overview of NDP…………………………………………………………..5 2.1. NDP Messages 5 2.2. Functions of NDP 6 2.3. Vulnerabilities in NDP 7 2.4. Challenges with securing NDP 8 3. Secure Neighbor Discovery…………………………………………...…...10 3.1. Features of SEND 10 3.1.1. Cryptographically-Generated Addresses 10 3.1.2. Digital signatures 11 3.1.3. Certificate paths 12 3.1.4. Replay prevention 13 3.1.5. Compatibility with non-SEND devices 13 3.2. Drawbacks of SEND 14 3.3. Alternatives to SEND 16 3.3.1. Simple Secure Addressing Scheme 16 3.3.2. Source Address Validation Improvement 18 3.3.3.
    [Show full text]
  • Deployment of Source Address Validation In
    Network Hygiene, Incentives, and Regulation: Deployment of Source Address Validation in the Internet Matthew Luckie Robert Beverly Ryan Koga University of Waikato Naval Postgraduate School CAIDA, UC San Diego [email protected] [email protected] [email protected] Ken Keys Joshua A. Kroll k claffy CAIDA, UC San Diego Naval Postgraduate School CAIDA, UC San Diego [email protected] [email protected] [email protected] ABSTRACT ACM Reference Format: The Spoofer project has collected data on the deployment and char- Matthew Luckie, Robert Beverly, Ryan Koga, Ken Keys, Joshua A. Kroll, acteristics of IP source address validation on the Internet since 2005. and k claffy. 2019. Network Hygiene, Incentives, and Regulation: Deploy- ment of Source Address Validation in the Internet. In 2019 ACM SIGSAC Data from the project comes from participants who install an active Conference on Computer and Communications Security (CCS ’19), November probing client that runs in the background. The client automati- 11–15, 2019, London, United Kingdom. ACM, New York, NY, USA, 16 pages. cally runs tests both periodically and when it detects a new network https://doi.org/10.1145/3319535.3354232 attachment point. We analyze the rich dataset of Spoofer tests in multiple dimensions: across time, networks, autonomous systems, 1 INTRODUCTION countries, and by Internet protocol version. In our data for the year IP source address spoofing is the process of generating IP packets ending August 2019, at least a quarter of tested ASes did not filter with arbitrary source addresses, i.e., addresses other than those packets with spoofed source addresses leaving their networks.
    [Show full text]