Proceedings of the 2015 Internet Measurement Conference最新文献

Resilience of Deployed TCP to Blind Attacks 部署TCP对盲攻击的恢复能力

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/2815675.2815700

M. Luckie, Robert Beverly, Tiange Wu, M. Allman, K. Claffy

{"title":"Resilience of Deployed TCP to Blind Attacks","authors":"M. Luckie, Robert Beverly, Tiange Wu, M. Allman, K. Claffy","doi":"10.1145/2815675.2815700","DOIUrl":"https://doi.org/10.1145/2815675.2815700","url":null,"abstract":"As part of TCP's steady evolution, recent standards have recommended mechanisms to protect against weaknesses in TCP. But adoption, configuration, and deployment of TCP improvements can be slow. In this work, we consider the resilience of deployed TCP implementations to blind in-window attacks, where an off-path adversary disrupts an established connection by sending a packet that the victim believes came from its peer, causing data corruption or connection reset. We tested operating systems (and middleboxes deployed in front) of webservers in the wild in September 2015 and found 22% of connections vulnerable to in-window SYN and reset packets, 30% vulnerable to in-window data packets, and 38.4% vulnerable to at least one of three in-window attacks we tested. We also tested out-of-window packets and found that while few deployed systems were vulnerable to reset and SYN packets, 5.4% of connections accepted in-window data with an invalid acknowledgment number. In addition to evaluating commodity TCP stacks, we found vulnerabilities in 12 of 14 of the routers and switches we characterized -- critical network infrastructure where the potential impact of any TCP vulnerabilities is particularly acute. This surprisingly high level of extant vulnerabilities in the most mature Internet transport protocol in use today is a perfect illustration of the Internet's fragility. Embedded in historical context, it also provides a strong case for more systematic, scientific, and longitudinal measurement and quantitative analysis of fundamental properties of critical Internet infrastructure, as well as for the importance of better mechanisms to get best security practices deployed.","PeriodicalId":340581,"journal":{"name":"Proceedings of the 2015 Internet Measurement Conference","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124894150","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 13

Detecting Malicious Activity with DNS Backscatter 检测恶意活动与DNS反向散射

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/2815675.2815706

K. Fukuda, J. Heidemann

{"title":"Detecting Malicious Activity with DNS Backscatter","authors":"K. Fukuda, J. Heidemann","doi":"10.1145/2815675.2815706","DOIUrl":"https://doi.org/10.1145/2815675.2815706","url":null,"abstract":"Network-wide activity is when one computer (the originator) touches many others (the targets). Motives for activity may be benign (mailing lists, CDNs, and research scanning), malicious (spammers and scanners for security vulnerabilities), or perhaps indeterminate (ad trackers). Knowledge of malicious activity may help anticipate attacks, and understanding benign activity may set a baseline or characterize growth. This paper identifies DNS backscatter as a new source of information about network-wide activity. Backscatter is the reverse DNS queries caused when targets or middleboxes automatically look up the domain name of the originator. Queries are visible to the authoritative DNS servers that handle reverse DNS. While the fraction of backscatter they see depends on the server's location in the DNS hierarchy, we show that activity that touches many targets appear even in sampled observations. We use information about the queriers to classify originator activity using machine-learning. Our algorithm has reasonable precision (70-80%) as shown by data from three different organizations operating DNS servers at the root or country-level. Using this technique we examine nine months of activity from one authority to identify trends in scanning, identifying bursts corresponding to Heartbleed and broad and continuous scanning of ssh.","PeriodicalId":340581,"journal":{"name":"Proceedings of the 2015 Internet Measurement Conference","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116059690","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 20

Investigating Interdomain Routing Policies in the Wild 在野外调查域间路由策略

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/2815675.2815712

R. Anwar, Haseeb Niaz, D. Choffnes, Ítalo F. S. Cunha, Phillipa Gill, Ethan Katz-Bassett

{"title":"Investigating Interdomain Routing Policies in the Wild","authors":"R. Anwar, Haseeb Niaz, D. Choffnes, Ítalo F. S. Cunha, Phillipa Gill, Ethan Katz-Bassett","doi":"10.1145/2815675.2815712","DOIUrl":"https://doi.org/10.1145/2815675.2815712","url":null,"abstract":"Models of Internet routing are critical for studies of Internet security, reliability and evolution, which often rely on simulations of the Internet's routing system. Accurate models are difficult to build and suffer from a dearth of ground truth data, as ISPs often treat their connectivity and routing policies as trade secrets. In this environment, researchers rely on a number of simplifying assumptions and models proposed over a decade ago, which are widely criticized for their inability to capture routing policies employed in practice. In this study we put Internet topologies and models under the microscope to understand where they fail to capture real routing behavior. We measure data plane paths from thousands of vantage points, located in eyeball networks around the globe, and find that between 14-35% of routing decisions are not explained by existing models. We then investigate these cases, and identify root causes such as selective prefix announcement, misclassification of undersea cables, and geographic constraints. Our work highlights the need for models that address such cases, and motivates the need for further investigation of evolving Internet connectivity.","PeriodicalId":340581,"journal":{"name":"Proceedings of the 2015 Internet Measurement Conference","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123382120","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 76

Going Wild: Large-Scale Classification of Open DNS Resolvers 疯狂:开放DNS解析器的大规模分类

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/2815675.2815683

Marc Kührer, Thomas Hupperich, Jonas Bushart, C. Rossow, Thorsten Holz

{"title":"Going Wild: Large-Scale Classification of Open DNS Resolvers","authors":"Marc Kührer, Thomas Hupperich, Jonas Bushart, C. Rossow, Thorsten Holz","doi":"10.1145/2815675.2815683","DOIUrl":"https://doi.org/10.1145/2815675.2815683","url":null,"abstract":"Since several years, millions of recursive DNS resolvers are-deliberately or not-open to the public. This, however, is counter-intuitive, since the operation of such openly accessible DNS resolvers is necessary in rare cases only. Furthermore, open resolvers enable both amplification DDoS and cache snooping attacks, and can be abused by attackers in multiple other ways. We thus find open recursive DNS resolvers to remain one critical phenomenon on the Internet. In this paper, we illuminate this phenomenon by analyzing it from two different angles. On the one hand, we study the landscape of DNS resolvers based on empirical data we collected for over a year. We analyze the changes over time and classify the resolvers according to device type and software version. On the other hand, we take the viewpoint of a client and measure the response authenticity of these resolvers. Besides legitimate redirections (e.g., to captive portals or router login pages), we find millions of resolvers to deliberately manipulate DNS resolutions (i.e., return bogus IP address information). To understand this threat in more detail, we systematically analyze non-legitimate DNS responses and reveal open DNS resolvers that manipulate DNS resolutions to censor communication channels, inject advertisements, serve malicious files, perform phishing, or redirect to other kinds of suspicious or malicious activities.","PeriodicalId":340581,"journal":{"name":"Proceedings of the 2015 Internet Measurement Conference","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121641819","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 100

Session details: Measurement and/or Platforms 会议细节:测量和/或平台

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/3260502

M. Luckie

引用次数: 0

Management Plane Analytics 管理平面分析

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/2815675.2815684

Aaron Gember, Wenfei Wu, Xiujun Li, Aditya Akella, Ratul Mahajan

引用次数: 30

Is Explicit Congestion Notification usable with UDP? 显式拥塞通知可用UDP?

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/2815675.2815716

Stephen McQuistin, C. Perkins

引用次数: 13

Neither Snow Nor Rain Nor MITM...: An Empirical Analysis of Email Delivery Security 不下雪，不下雨，也不下雨……:电子邮件传递安全的实证分析

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/2815675.2815695

Z. Durumeric, David Adrian, A. Mirian, James Kasten, Elie Bursztein, Nicolas Lidzborski, Kurt Thomas, Vijay Eranti, Michael Bailey, J. A. Halderman

{"title":"Neither Snow Nor Rain Nor MITM...: An Empirical Analysis of Email Delivery Security","authors":"Z. Durumeric, David Adrian, A. Mirian, James Kasten, Elie Bursztein, Nicolas Lidzborski, Kurt Thomas, Vijay Eranti, Michael Bailey, J. A. Halderman","doi":"10.1145/2815675.2815695","DOIUrl":"https://doi.org/10.1145/2815675.2815695","url":null,"abstract":"The SMTP protocol is responsible for carrying some of users' most intimate communication, but like other Internet protocols, authentication and confidentiality were added only as an afterthought. In this work, we present the first report on global adoption rates of SMTP security extensions, including: STARTTLS, SPF, DKIM, and DMARC. We present data from two perspectives: SMTP server configurations for the Alexa Top Million domains, and over a year of SMTP connections to and from Gmail. We find that the top mail providers (e.g., Gmail, Yahoo, and Outlook) all proactively encrypt and authenticate messages. However, these best practices have yet to reach widespread adoption in a long tail of over 700,000 SMTP servers, of which only 35% successfully configure encryption, and 1.1% specify a DMARC authentication policy. This security patchwork---paired with SMTP policies that favor failing open to allow gradual deployment---exposes users to attackers who downgrade TLS connections in favor of cleartext and who falsify MX records to reroute messages. We present evidence of such attacks in the wild, highlighting seven countries where more than 20% of inbound Gmail messages arrive in cleartext due to network attackers.","PeriodicalId":340581,"journal":{"name":"Proceedings of the 2015 Internet Measurement Conference","volume":"59 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131153005","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 118

Session details: Traffic and Routing 会话详细信息:流量和路由

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/3260497

M. Luckie

引用次数: 0

Dissecting UbuntuOne: Autopsy of a Global-scale Personal Cloud Back-end 剖析UbuntuOne:剖析全球规模的个人云后端

Proceedings of the 2015 Internet Measurement Conference Pub Date : 2015-10-28 DOI: 10.1145/2815675.2815677

Raúl Gracia Tinedo, Yongchao Tian, Josep Sampé, Hamza Harkous, John Lenton, P. López, Marc Sánchez Artigas, M. Vukolic

{"title":"Dissecting UbuntuOne: Autopsy of a Global-scale Personal Cloud Back-end","authors":"Raúl Gracia Tinedo, Yongchao Tian, Josep Sampé, Hamza Harkous, John Lenton, P. López, Marc Sánchez Artigas, M. Vukolic","doi":"10.1145/2815675.2815677","DOIUrl":"https://doi.org/10.1145/2815675.2815677","url":null,"abstract":"Personal Cloud services, such as Dropbox or Box, have been widely adopted by users. Unfortunately, very little is known about the internal operation and general characteristics of Personal Clouds since they are proprietary services. In this paper, we focus on understanding the nature of Personal Clouds by presenting the internal structure and a measurement study of UbuntuOne (U1). We first detail the U$1$ architecture, core components involved in the U1 metadata service hosted in the datacenter of Canonical, as well as the interactions of U$1$ with Amazon S3 to outsource data storage. To our knowledge, this is the first research work to describe the internals of a large-scale Personal Cloud. Second, by means of tracing the U$1$ servers, we provide an extensive analysis of its back-end activity for one month. Our analysis includes the study of the storage workload, the user behavior and the performance of the U1 metadata store. Moreover, based on our analysis, we suggest improvements to U1 that can also benefit similar Personal Cloud systems. Finally, we contribute our dataset to the community, which is the first to contain the back-end activity of a large-scale Personal Cloud. We believe that our dataset provides unique opportunities for extending research in the field.","PeriodicalId":340581,"journal":{"name":"Proceedings of the 2015 Internet Measurement Conference","volume":"104 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-10-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115657303","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 46