Network operation security forums

Tue Nov 13 10:45:21 UTC 2001

On Mon, 12 Nov 2001, Sean Donelan wrote:

> The public discussions I know about have focused on "popular"
> subjects such as root servers, ddos, viruses.  While interesting,
> and challanging topics, are they really the biggest security
> problems facing Internet operators?  I don't think so.  But
> that's just my opinion.

> What are the biggest security risks Internet operaters need to
> manage?

> I'm concerned about route integrity, multi-provider facility risks,
> and multi-provider restoration deadlock.  Why do I worry about them,
> because they are risks no single provider can manage alone.

These are by no means trivial concerns, but if we want to look at
intentional disruption of a large portion of the internet I think we have
to look elsewhere. By its nature the internet is very distributed so
taking out a single location won't do all that much damage to the whole.
Also, if a really big network starts to intentionally disrupt BGP
stability, it is only a matter of hours (hopefully) or days
(realistically) before this network is isolated and the problem is
contained.

A physical attack on the root nameservers would probably be very effective
for a short time: without root servers pretty much nothing works anymore.
But a physical attack on 13 facilities on 4 coasts of 3 continents isn't
easy and as long as not all master databases and all recent copies of the
tld zone files are destroyed, root service would probably be repaired in
no more than a couple of days.

I think a physical attack on the major fiber bundles between the US coasts
would disrupt both the internet and many other services very effectively.
Obviously it won't be possible to take out every single fiber, but
experience shows there are places where huge amounts of bandwidth are
present in the same ditch and they run through large uninhabited
(unsupervised) areas such as mountains and deserts. If the five most
important of those paths are out of service, I'm pretty sure the remaining
paths can't handle the extra bandwidth. The northern paths are especially
vulnerable in the winter because snow and ice make it very hard to repair
the fibers. There are also other possibilities to prohibit repair.

As for attacks over the network itself: the Nimda worm already had an
impact on BGP stability (http://www.renesys.com/projects/bgp_instability/),
without even trying. I'm hesitant to discuss particulars here, but try to
imagine a worm with some knowledge of routing infrastructure
vulnerabilities.