Internet Routing Security Effort Gains Momentum

Cybercriminals and nation-state hackers routinely hide behind phony IP addresses to mask their location and identity, but an Internet initiative that seeks to thwart that and other malicious and inadvertent traffic on the global Net now has on board some 42 network operators crisscrossing 21 nations.

The Internet Society's Mutually Agreed Norms for Routing Security (MANRS), which launched nearly two years ago as a plan for advancing the security and resilience of the Net's routing infrastructure, has signed up network operators in Asia, North and South America, Africa, and Europe, including six network providers from Russia, five in the Netherlands, five in the US, and four in Germany. AT&T, Comcast, and Level 3, are among the largest US ISPs that have joined the effort.

MANRS consists of four practices: filtering, anti-spoofing, coordination among providers, and global validation. Participating network providers must deploy at least one of them (and it can't just be the coordination activity). According to the Internet Society, the majority of providers have deployed all four practices and none so far have enacted less than three of them.

The effort is one element of the overall vision of updating the aging Internet architecture to address the security issues that weren't an issue back when the Net was built. Security experts such as Dan Kaminsky have been calling for better security on the Net to restore trust and thwart attackers who use it to do their dirty work.

Andrei Robachevsky, technology programme manager for the Internet Society, says the challenge with routing on the Net today is that each network operator must implicitly trust the routing information provided by its neighboring provider when moving traffic.

"Many network operators do this blindly: what my peer said might be true … But it's really easy for false information [to be sent] on the Internet. That results in a situation where traffic and flow goes to an undesired path, or traffic can go to an undesired destination and not the real destination," such as to a malicious actor or for malicious activity, he says.

Network routing errors also can cause big Internet traffic problems. Take the YouTube outage of 2008, he says, which was caused by Pakistan Telecom trying to censor YouTube from that nation. The network provider impersonated YouTube for its local operators in order to keep customers from viewing YouTube, but due to an error in configuration that spread to the larger Internet, most users worldwide were knocked off YouTube for two hours, he recalls. "It was a misconfiguration," Robachevsky says. "The majority [of route filtering] is misconfigurations or mistakes. But there are also malicious attacks that abuse the routing system."

MANRS basically defines a specific set of minimum measures to provider routing security across the Net, he says. Filtering helps prevent phony or incorrect routing information. "You clean your side of the street," he says.

Preventing traffic with spoofed IP addresses can help thwart distributed denial-of-service (DDoS) attacks, which often hide behind phony IPs. "A huge class of volumetric reflection amplification DDoS attacks' root cause is the ability to spoof traffic and IP addresses," he says. "If you close this … it will significantly diminish the prevalence of those attacks."

The other two measures are about network operators working more closely together: one is to communicate and coordinate among their peer networks to stop security threats, for example. It will help network operators know who to contact in the event of a network incident, and to keep their information updated.

The other such practice is validating routing information, so now there will be a database of that information that can be used for reference, he says.

Not all network operators will participate or cooperate, of course. Network operators or regions that abuse the Internet infrastructure for cybercrime or other nefarious activity won't join MANRS, according to Robachevsky, but their lack of participation ultimately could make them more conspicuous.

"We’re closing the window," he says.

Internet pioneer Paul Vixie says MANRS is an important effort in securing the Internet infrastructure. "Look no further than the war I've been fighting against [malicious] source addresses," says Vixie, CEO of FarSight Security. "We would like this looking at source addresses to become a norm … This self-regulation can work."

Don't expect abuse of the Net to decline dramatically right away, however. "The fact that you can rule out certain sources where this packet came from gives us a smaller number of suspects you [network operators] can focus your energy on," Vixie says.

MANRS could provide just the push needed for other areas of improving Internet infrastructure security. "If this succeeds, it's going to inspire something similar in other communities, like DNS," Vixie says. "It's also going to cause people to say now that we've removed the low-hanging fruit and filtered out the obvious bad crap, we can finally see what the landscape looks like … and we may see another landscape we need to address."

Related Content: