Demystifying the IP Blackspace Quentin Jacquemart1 , Pierre-Antoine Vervier2, Guillaume Urvoy-Keller3, and Ernst Biersack4 1 Eurecom, Sophia Antipolis
[email protected] 2 Symantec Research Labs, Sophia Antipolis Pierre-Antoine
[email protected] 3 Univ. Nice Sophia Antipolis, CNRS, I3S, UMR 7271, 06900 Sophia Antipolis
[email protected] 4
[email protected] Abstract. A small part of the IPv4 address space has still not been assigned for use to any organization. However, some of this IP space is announced through BGP, and is, therefore, globally reachable. These prefixes which are a subset of the bogon prefixes, constitute what we call the blackspace. It is generally admitted that the blackspace stands to be abused by anybody who wishes to carry out borderline and/or illegal activities without being traced. The contribution of this paper is twofold. First, we propose a novel methodology to accurately identify the IP blackspace. Based on data collected over a period of seven months, we study the routing-level characteristics of these networks and identify some benign reasons why these networks are announced on the Internet. Second, we focus on the security threat associated with these networks by looking at their application-level footprint. We identify live IP addresses and leverage them to fingerprint services running in these networks. Using this data we uncover a large amount of spam and scam activities. Finally, we present a case study of confirmed fraudulent routing of IP blackspace. 1 Introduction The global BGP (Boder Gateway Protocol) routing table now contains over 600k dis- tinct IPv4 prefixes. A few of these prefixes should not be globally announced (such as the private IP space) and are collectively referred to as bogon prefixes.