<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi Gene,<br>
</p>
<br>
<div class="moz-cite-prefix">On 09/26/2016 11:31 PM, GTS wrote:<br>
</div>
<blockquote
cite="mid:de499102-49f9-ba73-ad21-ae841a0df0f3@ics.uci.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<font size="+1"><font face="Times New Roman, Times, serif">Hi
Christos,<br>
<br>
indeed, there's (expected) equilibrium in CCN. <br>
A PIT overflow implies failure of this equilibrium. However,
an attack is not the<br>
only potential cause for a PIT overflow, right? Telling the
difference seems very hard.<br>
</font></font></blockquote>
<br>
<font size="+1"><font face="Times New Roman, Times, serif">I agree
that it is very hard to determine intent - is it a malicious
act or a flash crowd? But is making that distinction important?
The network should defend itself either way.<br>
<br>
But we are diverging. The point is that NDN is a communication
process that does not make a distinction between network
infrastructure and applications as IP does. When communication
fails it is visible to the entire communication chain (because
the equilibrium fails).<br>
<br>
</font></font>
<blockquote
cite="mid:de499102-49f9-ba73-ad21-ae841a0df0f3@ics.uci.edu"
type="cite"><font size="+1"><font face="Times New Roman, Times,
serif"> <br>
Coming back to the specific large-scale DoS issue, you
originally cited the recent attack where<br>
IP-enabled IoT devices acted as attack sources (zombies). I
claim this is possible in CCN<br>
if malware gets in before deployment; in that case, a
CCN-enabled IoT device can become a <br>
DoS *source*.<br>
<br>
The real difference I see is this: a CCN-enabled IoT device
that never publishes anything (e.g., a pure actuator) <br>
can not be a DoS *target*. <br>
</font></font></blockquote>
<br>
<font size="+1"><font face="Times New Roman, Times, serif">Yup, if
you do not attract any Interests (you are purely a consumer)
then you cannot be attacked.<br>
<br>
Christos.<br>
<br>
</font></font>
<blockquote
cite="mid:de499102-49f9-ba73-ad21-ae841a0df0f3@ics.uci.edu"
type="cite"><font size="+1"><font face="Times New Roman, Times,
serif"> <br>
Cheers,<br>
Gene<br>
</font></font>
<pre class="moz-signature" cols="72">======================
Gene Tsudik
Chancellor's Professor of Computer Science
University of California, Irvine
</pre>
<div class="moz-cite-prefix">On 9/26/16 8:36 PM, Christos
Papadopoulos wrote:<br>
</div>
<blockquote
cite="mid:52f157a9-7448-cdf9-9349-43b969236b1e@colostate.edu"
type="cite">
<p>Hi Gene,<br>
</p>
<p>In NDN, with symmetric traffic and the PIT state, there is an
equilibrium imposed (an Interest must be followed by a
response) and more importantly, can be verified (expired or
overflowed PIT state means failure of the equilibrium).</p>
<p>The point is there is a signal available in NDN (failure in
the equilibrium) that is not available in IP. There are very
interesting research questions about how to use this signal.</p>
<p>IP tried to do something similar with pushback. One problem
with it was the coordination required between the routers to
make pushback effective. Imagine for example, how hard it
would be to coordinate at the interdomain level. In NDN a
disturbance in the equilibrium can be detected locally.<br>
</p>
<p>Christos.</p>
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 09/26/2016 02:34 PM, GTS wrote:<br>
</div>
<blockquote
cite="mid:d7d975c3-6aa2-4eee-3037-d5d5aee75967@ics.uci.edu"
type="cite"> <font size="+1"><font face="Times New Roman,
Times, serif">I generally agree with Cedric. In CCN (i.e.,
NDN & CCNx), the so-called "attack surface" <br>
will change shape but it's area will remain almost the
same. In particular, attacks <br>
such as the one Christos mentions, where IoT devices act
as mini-zombies (DoS attack sources), <br>
are unfortunately still possible. Just not in the same
way...<br>
<br>
One notable item in the shifting attack surface is this:
in CCN, an end-entity (e.g., an IoT<br>
device) that only acts as a consumer (never produces
anything), can not be DoS-attacked <br>
in the usual manner, since the only way it can be
"reached" is by content that *it*<br>
has actually requested. In IP, that's certainly not the
case. <br>
<br>
But, if an end-entity can request content, it can in
principle be infected by malware.^$<br>
Thus, it can still be turned into a mini-zombie. :-)<br>
<br>
Cheers,<br>
Gene<br>
<br>
$ Or, it can be infected prior to being put in service.<br>
<br>
</font></font>
<pre class="moz-signature" cols="72">======================
Gene Tsudik
Chancellor's Professor of Computer Science
University of California, Irvine
</pre>
<div class="moz-cite-prefix">On 9/26/16 11:43 AM, Cedric
Westphal wrote:<br>
</div>
<blockquote
cite="mid:369480A01F73974DAC423D05A977B4F21D4A6F7C@SJCEML701-CHM.china.huawei.com"
type="cite">
<pre wrap="">That's very interesting. But since it's sent on this mailing list: would NDN be an answer to this? If the millions of IoT devices involved in the attack request a distinct object under the attacked page's prefix, it would happen exactly the same way, wouldn't it? And if all requests are for the same name, then it's the caching infrastructure of the high degree nodes that becomes attacked and shifting the attack target from akamai to a highly connected router is not a good trade-off.
C.
-----Original Message-----
From: Ndn-interest [<a moz-do-not-send="true" class="moz-txt-link-freetext" href="mailto:ndn-interest-bounces@lists.cs.ucla.edu">mailto:ndn-interest-bounces@lists.cs.ucla.edu</a>] On Behalf Of Christos Papadopoulos
Sent: Sunday, September 25, 2016 6:04 PM
To: <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:ndn-interest@lists.cs.ucla.edu">ndn-interest@lists.cs.ucla.edu</a>
Subject: [Ndn-interest] Largest DDoS attack ever delivered by botnet of hijacked IoT devices
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.networkworld.com/article/3123672/security/largest-ddos-attack-ever-delivered-by-botnet-of-hijacked-iot-devices.html">http://www.networkworld.com/article/3123672/security/largest-ddos-attack-ever-delivered-by-botnet-of-hijacked-iot-devices.html</a>
Apologies if you have seen this already, but 600+Gbps DDoS attack from
IoT devices is truly remarkable. Moreover, it was *not* and reflection
attack! The target was protected by Akamai, who had to drop them (it was
hosted pro-bono) after a few days of sustained attack because it was
costing too much.
There are a few elements that might make this event a game changer. (a)
from now on, people may want to always talk about security in IoT, (b)
it raises questions about protecting the little guy from DDoS, the
customer here found a home at Google's Project Shield, but obviously
this is not scalable, and (c) cloud protection from DDoS is not a
general solution despite what cloud providers will have you believe.
To me such events bring to focus the weaknesses and fragility of the IP
architecture. With billions of IoT devices projected in the future, even
one packet/second (or even per minute) from a fraction of these devices
would be enough to cause real damage. We all know about the code quality
and ease of patching of IoT devices, this will not change.
Maybe Bruce Schneier 's near-apocalyptic thoughts are not too far off.
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://www.schneier.com/crypto-gram/archives/2016/0915.html#2">https://www.schneier.com/crypto-gram/archives/2016/0915.html#2</a>
Christos.
_______________________________________________
Ndn-interest mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:Ndn-interest@lists.cs.ucla.edu">Ndn-interest@lists.cs.ucla.edu</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.lists.cs.ucla.edu/mailman/listinfo/ndn-interest">http://www.lists.cs.ucla.edu/mailman/listinfo/ndn-interest</a>
_______________________________________________
Ndn-interest mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:Ndn-interest@lists.cs.ucla.edu">Ndn-interest@lists.cs.ucla.edu</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://www.lists.cs.ucla.edu/mailman/listinfo/ndn-interest">http://www.lists.cs.ucla.edu/mailman/listinfo/ndn-interest</a>
.
</pre>
</blockquote>
<br>
</blockquote>
<br>
</blockquote>
<br>
</blockquote>
<br>
</body>
</html>