Internet Quarantine David Moore et al

1、Internet QuarantineDavid Moore et alSysSeminarAndreas Terzis10/23/03Slides from N. WeaverWhat Are Computer Worms? Self replicating network programs Exploit vulnerabilities to infect remote machines Victim machines continue to propagate the infection Three main stages Detect new targets Attempt to in

2、fect new targets Activate the code on the victim machineWhy Worry About Worms? Worms can be fast Code Red required 13 hours to spread worldwide See Moores analysis and “How to 0wn the Internet.” Other techniques can be even faster Eg, “Warhol Worm” 15 minutes Sapphire 10 minutes Faster than human re

3、action Worms can have highlymalicious payloads Distributed Denial of Service Attacks Internet scale espionage Data corruption, manipulation BIOS reflashingGraph from David Moores analysis ()Some Major WormsWormYearStrategyVictimsOther NotesMorris1988Topological6000First major autonomous wor

4、m. Attacked multiple vulnerabilities.Code Red2001Scanning300,000First recent fast wormCRClean2001PassivenoneUnreleased Anti-Code-Red worm. Nimda2001ScanningOthers200,000Local subnet scanning. Effective mix of techniquesScalper2002Scanning75,000Spread worldwide in 10 minutesWhy Do Attackers Like Worm

5、s? Worms are useful attacker tools Can attack an entire vulnerable population at once Can be harder to trace than conventional attacks Worms are easy to write Propagation routines can be generic, enabling code reuse (Slapper) Drop in an exploit and release Payload is independent of propagation Curre

6、nt record: 10 days from disclosure to worm (Scalper) Can easily be reduced to 1 day Smart attacker can produce a “0 day” worm A worm which attacks an otherwise unknown vulnerabilityHow to stop Worms Three potential solutions Prevention Treatment ContainmentWhat Are Some Worm EcologiesHomeMachinesFir

7、ewallWebserversGame Servers, Halflife: 20,000Web Servers, IIS/Apache: 3,000,000P2P, KaZaA:5,000,000Windows CIFS and RPC: 50,000,000?Prevention Reduce the size of the vulnerable population Very difficult problem Tools still dont exist Legacy codeTreatment Once a host is infected, clean it up as soon

8、as possible Antivirus software Patches Problems Long time to develop cleanup code People dont seem to install patchesContainment Once a host is infected try to reduce the number of machines it can infect Firewalls Content filters Routing blacklists Most promising solution (?) Easier to automate Easi

9、er to deployMain QuestionHow effectively can any containment approach counter a worm epidemic on the Internet System Parameters Time to detect and react Containment strategy Breadth and topological placement of deploymentWorm propagation model Number of infected hosts at time t is I(t) = eb*(t-T)/(1

10、+eb*(t-T) b is the contact rate, b = r*N/232 R is probe rate N is the size of the susceptible population I(t) increases exponentially at first then it slows down as most of population is infected (look at Fig. 1)Containment Strategies Two main strategies Address blacklisting Content FilteringResults

11、: Idealized Study Global deployment, instantaneous communication Parameters 360K vulnerable hosts Probe rate 10 IP/sec The existence of an infected machine is learned after time R (reaction time) Look at Fig. 2Results: Generalized Worm Containment Containment reaction time as a function of the probe

12、 rate Look at Fig. 3 Results Address blacklisting slower than content filtering High infection rate requires almost impossible reaction timePractical Deployment Methodology Used AS level graph from RouteViews Mapped CodeRed infected hosts to AS Calculated shortest AS paths Deployment scenarios x% of Customer Ases Y% of most connected Ases Fig. 4 shows CodeRed containment Practical Deployment (contd) Look at Fig. 5 Neither containment stra